Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2015-2317
4.3
MEDIUMCVSS v2
Published
March 25, 2015
Affected
5 projects
Assigned by
MITRE
Severity scale
010
Description
The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.
django/django
GitHubThe Web framework for perfectionists with deadlines.
GitHubThe Web framework for perfectionists with deadlines.= 1.7.5, = 1.5, = 1.5.7, = 1.5.1, = 1.7.3, = 1.6, <= 1.4.19, = 1.6.7, = 1.7, = 1.5.10, = 1.6.10, = 1.6.8, = 1.7.2, = 1.6.6, = 1.8.0, = 1.5.5, = 1.6.5, = 1.7.6, = 1.5.3, = 1.5.4, = 1.5.12, = 1.6.3, = 1.7.4, = 1.5.2, = 1.5.11, = 1.6.1, = 1.6.9, = 1.7.1, = 1.5.8, = 1.5.9, = 1.5.6, = 1.6.4, = 1.6.2, < 1.4.20, >= 1.5, < 1.6.11, >= 1.7, < 1.7.7, >= 1.8a1, < 1.8c1, >= 1.8a0, < 1.8c1NVD
DjangoPython Package IndexA high-level Python web framework that encourages rapid development and clean, pragmatic design.
Python Package IndexA high-level Python web framework that encourages rapid development and clean, pragmatic design.= 1.7.5, = 1.5, = 1.5.7, = 1.5.1, = 1.7.3, = 1.6, <= 1.4.19, = 1.6.7, = 1.7, = 1.5.10, = 1.6.10, = 1.6.8, = 1.7.2, = 1.6.6, = 1.8.0, = 1.5.5, = 1.6.5, = 1.7.6, = 1.5.3, = 1.5.4, = 1.5.12, = 1.6.3, = 1.7.4, = 1.5.2, = 1.5.11, = 1.6.1, = 1.6.9, = 1.7.1, = 1.5.8, = 1.5.9, = 1.5.6, = 1.6.4, = 1.6.2, < 1.4.20, >= 1.5, < 1.6.11, >= 1.7, < 1.7.7, >= 1.8a1, < 1.8c1, >= 1.8a0, < 1.8c1
NPM
RubyGems