Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2017-12794
4.3
MEDIUMCVSS v2
Published
September 7, 2017
Affected
4 projects
Assigned by
MITRE
Severity scale
010
Description
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.
django/django
GitHubThe Web framework for perfectionists with deadlines.
GitHubThe Web framework for perfectionists with deadlines.= 1.10.0, = 1.11.2, = 1.11.1, = 1.10.3, = 1.11.4, = 1.10.1, = 1.10.5, = 1.10.7, = 1.10.2, = 1.11.0, = 1.10.4, = 1.11.3, = 1.10.6, >= 1.10a1, < 1.10.8, >= 1.11a1, < 1.11.5, >= 1.10, < 1.10.8, >= 1.11, < 1.11.5NVD
DjangoPython Package IndexA high-level Python web framework that encourages rapid development and clean, pragmatic design.
Python Package IndexA high-level Python web framework that encourages rapid development and clean, pragmatic design.= 1.10.0, = 1.11.2, = 1.11.1, = 1.10.3, = 1.11.4, = 1.10.1, = 1.10.5, = 1.10.7, = 1.10.2, = 1.11.0, = 1.10.4, = 1.11.3, = 1.10.6, >= 1.10a1, < 1.10.8, >= 1.11a1, < 1.11.5, >= 1.10, < 1.10.8, >= 1.11, < 1.11.5NVD
Docker Hub
NPM