https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 01:53:21 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-108481 EUVD-2026-108481 https://cve.radiocsirt.org/vuln/euvd-2026-108481 https://cve.radiocsirt.org/vuln/fkie_cve-2013-6044 <p>The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL&#39;s scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by &#34;the login view in django.contrib.auth.views&#34; and the javascript: scheme.</p> <p>The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL&#39;s scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by &#34;the login view in django.contrib.auth.views&#34; and the javascript: scheme.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2013-6044 https://cve.radiocsirt.org/vuln/ghsa-9cwg-mhxf-hh59 <p><strong>Affected:</strong> PyPI: Django</p> <p>The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL&#39;s scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by &#34;the login view in django.contrib.auth.views&#34; and the javascript: scheme.</p> <p><strong>Affected:</strong> PyPI: Django</p> <p>The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL&#39;s scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by &#34;the login view in django.contrib.auth.views&#34; and the javascript: scheme.</p> https://cve.radiocsirt.org/vuln/ghsa-9cwg-mhxf-hh59 https://cve.radiocsirt.org/vuln/gsd-2013-6044 gsd-2013-6044 https://cve.radiocsirt.org/vuln/gsd-2013-6044 https://cve.radiocsirt.org/vuln/pysec-2013-21 <p><strong>Affected:</strong> PyPI: django</p> <p>The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL&#39;s scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by &#34;the login view in django.contrib.auth.views&#34; and the javascript: scheme.</p> <p><strong>Affected:</strong> PyPI: django</p> <p>The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL&#39;s scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by &#34;the login view in django.contrib.auth.views&#34; and the javascript: scheme.</p> https://cve.radiocsirt.org/vuln/pysec-2013-21 https://cve.radiocsirt.org/vuln/rhsa-2013:1521 <p>python-django: directory traversal with &#34;ssi&#34; template tag python-django: xss in is_safe_url function</p> <p>python-django: directory traversal with &#34;ssi&#34; template tag python-django: xss in is_safe_url function</p> https://cve.radiocsirt.org/vuln/rhsa-2013:1521