Vulnerabilities > Djangoproject

DATE CVE VULNERABILITY TITLE RISK
2021-07-02 CVE-2021-35042 SQL Injection vulnerability in multiple products
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
network
low complexity
djangoproject fedoraproject CWE-89
7.5
2021-06-08 CVE-2021-33571 Server-Side Request Forgery (SSRF) vulnerability in Djangoproject Django
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals.
network
low complexity
djangoproject CWE-918
5.0
2021-06-08 CVE-2021-33203 Path Traversal vulnerability in Djangoproject Django
Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs.
network
low complexity
djangoproject CWE-22
4.0
2021-05-06 CVE-2021-32052 Cross-site Scripting vulnerability in multiple products
In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used).
4.3
2021-05-05 CVE-2021-31542 Unrestricted Upload of File with Dangerous Type vulnerability in multiple products
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
network
low complexity
djangoproject debian fedoraproject CWE-434
5.0
2021-04-06 CVE-2021-28658 Path Traversal vulnerability in multiple products
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names.
network
low complexity
djangoproject debian fedoraproject CWE-22
5.0
2021-02-22 CVE-2020-35681 Information Exposure vulnerability in Djangoproject Channels 3.0.0/3.0.1/3.0.2
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope.
5.8
2021-02-15 CVE-2021-23336 HTTP Request Smuggling vulnerability in multiple products
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking.
4.0
2021-02-02 CVE-2021-3281 Path Traversal vulnerability in multiple products
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
network
low complexity
djangoproject fedoraproject netapp CWE-22
5.0
2020-09-01 CVE-2020-24583 Incorrect Default Permissions vulnerability in multiple products
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used).
network
low complexity
djangoproject canonical CWE-276
5.0