https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:53:59 +0000 https://cve.radiocsirt.org/vuln/cnvd-2019-45150 cnvd-2019-45150 https://cve.radiocsirt.org/vuln/cnvd-2019-45150 https://cve.radiocsirt.org/vuln/euvd-2026-59107 EUVD-2026-59107 https://cve.radiocsirt.org/vuln/euvd-2026-59107 https://cve.radiocsirt.org/vuln/fkie_cve-2019-19118 <p>Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model&#39;s save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)</p> <p>Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model&#39;s save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-19118 https://cve.radiocsirt.org/vuln/ghsa-hvmf-r92r-27hr <p><strong>Affected:</strong> PyPI: Django</p> <p>Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model&#39;s save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)</p> <p><strong>Affected:</strong> PyPI: Django</p> <p>Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model&#39;s save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)</p> https://cve.radiocsirt.org/vuln/ghsa-hvmf-r92r-27hr https://cve.radiocsirt.org/vuln/gsd-2019-19118 gsd-2019-19118 https://cve.radiocsirt.org/vuln/gsd-2019-19118 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11205-1 <p>python36-Django-3.2.7-2.3 on GA media</p> <p>python36-Django-3.2.7-2.3 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:11205-1 https://cve.radiocsirt.org/vuln/pysec-2019-15 <p><strong>Affected:</strong> PyPI: django</p> <p>Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model&#39;s save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)</p> <p><strong>Affected:</strong> PyPI: django</p> <p>Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model&#39;s save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)</p> https://cve.radiocsirt.org/vuln/pysec-2019-15