Most recent entries from all

bdu:2020-05726

BIT-django-2020-9402

Affected: Bitnami: django

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

EUVD-2026-39108

fkie_cve-2020-9402

GHSA-3gh2-xw74-jmcw — SQL injection in Django

Affected: PyPI: Django

gsd-2020-9402

openSUSE-SU-2024:11205-1 — python36-Django-3.2.7-2.3 on GA media

python36-Django-3.2.7-2.3 on GA media

Withdrawn: PYSEC-2020-345

Withdrawn by the publisher.

Affected: PyPI: django

Withdrawn as duplicate of PYSEC-2020-36. Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

RHSA-2021:1313 — Red Hat Security Advisory: Satellite 6.9 Release

rubygem-rest-client: session fixation vulnerability Set-Cookie headers present in an HTTP 30x redirection responses rubygem-rest-client: unsanitized application logging foreman: Managing repositories with their id via hammer does not respect the role filters rack-protection: Timing attack in authenticity_token.rb rubygem-rack: hijack sessions by using timing attacks targeting the session id python-psutil: Double free because of refcount mishandling rubygem-activestorage: circumvention of file size limits in ActiveStorage rubygem-actionpack: possible strong parameters bypass rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore rubygem-actionpack: ability to forge per-form CSRF tokens given a global CSRF token rubygem-actionview: CSRF vulnerability in rails-ujs rubygem-rails: untrusted users able to run pending migrations in production django: potential SQL injection via "tolerance" parameter in GIS functions and aggregates on Oracle netty: compression/decompression codecs don't enforce limits on buffer allocation sizes foreman: world-readable OMAPI secret through the ISC DHCP server rubygem-activeview: Cross-site scripting in translation helpers resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling

UBUNTU-CVE-2020-9402

Affected: Ubuntu:16.04:LTS: python-django, Ubuntu:18.04:LTS: python-django