FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  374986
Date:      2014-12-20
Time:      00:21:30Z
Committer: delphij

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
bd760627-3493-11e0-8103-00215c6a37bbdjango -- multiple vulnerabilities

Django project reports:

Today the Django team is issuing multiple releases -- Django 1.2.5 and Django 1.1.4 -- to remedy three security issues reported to us. All users of affected versions of Django are urged to upgrade immediately.


Discovery 2011-02-08
Entry 2011-02-09
py23-django
py24-django
py25-django
py26-django
py27-django
py30-django
py31-django
gt 1.2 lt 1.2.5

gt 1.1 lt 1.1.4

py23-django-devel
py24-django-devel
py25-django-devel
py26-django-devel
py27-django-devel
py30-django-devel
py31-django-devel
lt 15470,1

http://www.djangoproject.com/weblog/2011/feb/08/security/
bd760627-3493-11e0-8103-00215c6a37bbdjango -- multiple vulnerabilities

Django project reports:

Today the Django team is issuing multiple releases -- Django 1.2.5 and Django 1.1.4 -- to remedy three security issues reported to us. All users of affected versions of Django are urged to upgrade immediately.


Discovery 2011-02-08
Entry 2011-02-09
py23-django
py24-django
py25-django
py26-django
py27-django
py30-django
py31-django
gt 1.2 lt 1.2.5

gt 1.1 lt 1.1.4

py23-django-devel
py24-django-devel
py25-django-devel
py26-django-devel
py27-django-devel
py30-django-devel
py31-django-devel
lt 15470,1

http://www.djangoproject.com/weblog/2011/feb/08/security/
14a37474-1383-11e0-8a58-00215c6a37bbdjango -- multiple vulnerabilities

Django project reports:

Today the Django team is issuing multiple releases -- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 -- to remedy two security issues reported to us. All users of affected versions of Django are urged to upgrade immediately.

Information leakage in Django administrative interface

The Django administrative interface, django.contrib.admin supports filtering of displayed lists of objects by fields on the corresponding models, including across database-level relationships. This is implemented by passing lookup arguments in the querystring portion of the URL, and options on the ModelAdmin class allow developers to specify particular fields or relationships which will generate automatic links for filtering.

Denial-of-service attack in password-reset mechanism

Django's bundled authentication framework, django.contrib.auth, offers views which allow users to reset a forgotten password. The reset mechanism involves generating a one-time token composed from the user's ID, the timestamp of the reset request converted to a base36 integer, and a hash derived from the user's current password hash (which will change once the reset is complete, thus invalidating the token).


Discovery 2010-12-22
Entry 2010-12-29
py23-django
py24-django
py25-django
py26-django
py27-django
py30-django
py31-django
gt 1.2 lt 1.2.4

gt 1.1 lt 1.1.3

py23-django-devel
py24-django-devel
py25-django-devel
py26-django-devel
py27-django-devel
py30-django-devel
py31-django-devel
lt 15032,1

45562
45563
https://bugzilla.redhat.com/show_bug.cgi?id=665373
http://secunia.com/advisories/42715/
14a37474-1383-11e0-8a58-00215c6a37bbdjango -- multiple vulnerabilities

Django project reports:

Today the Django team is issuing multiple releases -- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 -- to remedy two security issues reported to us. All users of affected versions of Django are urged to upgrade immediately.

Information leakage in Django administrative interface

The Django administrative interface, django.contrib.admin supports filtering of displayed lists of objects by fields on the corresponding models, including across database-level relationships. This is implemented by passing lookup arguments in the querystring portion of the URL, and options on the ModelAdmin class allow developers to specify particular fields or relationships which will generate automatic links for filtering.

Denial-of-service attack in password-reset mechanism

Django's bundled authentication framework, django.contrib.auth, offers views which allow users to reset a forgotten password. The reset mechanism involves generating a one-time token composed from the user's ID, the timestamp of the reset request converted to a base36 integer, and a hash derived from the user's current password hash (which will change once the reset is complete, thus invalidating the token).


Discovery 2010-12-22
Entry 2010-12-29
py23-django
py24-django
py25-django
py26-django
py27-django
py30-django
py31-django
gt 1.2 lt 1.2.4

gt 1.1 lt 1.1.3

py23-django-devel
py24-django-devel
py25-django-devel
py26-django-devel
py27-django-devel
py30-django-devel
py31-django-devel
lt 15032,1

45562
45563
https://bugzilla.redhat.com/show_bug.cgi?id=665373
http://secunia.com/advisories/42715/