Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2015-0220
4.3
MEDIUMCVSS v2
Published
January 16, 2015
Affected
3 projects
Assigned by
Red Hat
Severity scale
010
Description
The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.
django/django
GitHubThe Web framework for perfectionists with deadlines.
GitHubThe Web framework for perfectionists with deadlines.<= 1.4.17, = 1.6.7, = 1.6.5, = 1.6.8, = 1.6.6, = 1.7.2, = 1.6.3, = 1.6, = 1.6.4, = 1.6.2, = 1.7, = 1.7.1, = 1.6.1, = 1.6.9, < 1.4.18, >= 1.6, < 1.6.10, >= 1.7, < 1.7.3, >= 1.5, < 1.6.10NVD
DjangoPython Package IndexA high-level Python web framework that encourages rapid development and clean, pragmatic design.
Python Package IndexA high-level Python web framework that encourages rapid development and clean, pragmatic design.<= 1.4.17, = 1.6.7, = 1.6.5, = 1.6.8, = 1.6.6, = 1.7.2, = 1.6.3, = 1.6, = 1.6.4, = 1.6.2, = 1.7, = 1.7.1, = 1.6.1, = 1.6.9, < 1.4.18, >= 1.6, < 1.6.10, >= 1.7, < 1.7.3, >= 1.5, < 1.6.10NVD
NPM