Show filters
19 Total Results
Displaying 11-19 of 19
Sort by:
Attacker Value
Unknown
CVE-2016-6186
Disclosure Date: August 05, 2016 (last updated November 08, 2023)
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.
0
Attacker Value
Unknown
CVE-2016-2513
Disclosure Date: April 08, 2016 (last updated November 25, 2024)
The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.
0
Attacker Value
Unknown
CVE-2016-2512
Disclosure Date: April 08, 2016 (last updated November 25, 2024)
The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\@attacker.com.
0
Attacker Value
Unknown
CVE-2016-2048
Disclosure Date: February 08, 2016 (last updated November 25, 2024)
Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.
0
Attacker Value
Unknown
CVE-2015-8213
Disclosure Date: December 07, 2015 (last updated October 05, 2023)
The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
0
Attacker Value
Unknown
CVE-2012-1405
Disclosure Date: March 07, 2012 (last updated October 04, 2023)
Unspecified vulnerability in the GO Note Widget (com.gau.go.launcherex.gowidget.notewidget) application 1.5 and 1.9 for Android has unknown impact and attack vectors.
0
Attacker Value
Unknown
CVE-2012-1407
Disclosure Date: March 07, 2012 (last updated October 04, 2023)
Unspecified vulnerability in the GO Message Widget (com.gau.go.launcherex.gowidget.smswidget) application 1.9, 2.1, and 2.3 for Android has unknown impact and attack vectors.
0
Attacker Value
Unknown
CVE-2012-1396
Disclosure Date: March 07, 2012 (last updated October 04, 2023)
Unspecified vulnerability in the GO FBWidget (com.gau.go.launcherex.gowidget.fbwidget) application 1.9 and 2.1 for Android has unknown impact and attack vectors.
0
Attacker Value
Unknown
CVE-2011-0020
Disclosure Date: January 24, 2011 (last updated October 04, 2023)
Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file, related to the glyph box for an FT_Bitmap object.
0
