[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
OVAL

MDVSA-2011:031 -- Mandriva python-django

ID: oval:org.secpod.oval:def:300410Date: (C)2012-01-07   (M)2021-09-12
Class: PATCHFamily: unix




Multiple vulnerabilities has been found and corrected in python-django: Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery attacks via forged AJAX requests that leverage a combination of browser plugins and redirects, a related issue to CVE-2011-0447 . Cross-site scripting vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload . Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / character in a key in a session cookie, related to session replays . The updated packages have been upgraded to the 1.1.4 version which is not vulnerable to these issues.

Platform:
Mandriva Linux 2010.0
Mandriva Linux 2010.1
Product:
python-django
Reference:
MDVSA-2011:031
CVE-2011-0698
CVE-2011-0697
CVE-2011-0696
CVE    3
CVE-2011-0697
CVE-2011-0698
CVE-2011-0696
CPE    2
cpe:/o:mandriva:linux:2010.1
cpe:/o:mandriva:linux:2010.0

© SecPod Technologies