GCVE - cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:*

part: a version: 1.8.0 update: *

Vendor	Djangoproject (`070db687-4713-5da4-80b0-4a67baf0d0d4`)
Product	Django (`b34a5fd0-fae8-5096-941f-bded7e4dd228`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:docker/django/django`	purl2cpe	2026-06-01 10:17:26.827786
`pkg:github/django/django`	purl2cpe	2026-06-01 10:17:26.827788
`pkg:pypi/django`	purl2cpe	2026-06-01 10:17:26.827790

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-7234`	vulnerable	2026-06-08 05:09:55.521906	Details available A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability. Published: 2017-04-04T17:00:00.000Z Updated: 2024-08-05T15:56:36.057Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1038177 http://www.securityfocus.com/bid/97401 http://www.debian.org/security/2017/dsa-3835 https://www.djangoproject.com/weblog/2017/apr/04/security-releases/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-7233`	vulnerable	2026-06-08 05:09:55.493982	Details available Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack. Published: 2017-04-04T17:00:00.000Z Updated: 2024-08-05T15:56:36.158Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1038177 https://access.redhat.com/errata/RHSA-2017:1596 http://www.securityfocus.com/bid/97406 https://access.redhat.com/errata/RHSA-2017:3093 http://www.debian.org/security/2017/dsa-3835	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-8213`	vulnerable	2026-06-08 05:07:03.310574	Details available The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY. Published: 2015-12-07T20:00:00.000Z Updated: 2024-08-06T08:13:31.831Z Open on db.gcve.eu Reference links https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4 http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html http://www.ubuntu.com/usn/USN-2816-1 http://rhn.redhat.com/errata/RHSA-2016-0129.html https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5964`	vulnerable	2026-06-08 05:06:51.097245	Details available The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors. Published: 2015-08-24T14:00:00.000Z Updated: 2024-08-06T07:06:34.982Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html http://rhn.redhat.com/errata/RHSA-2015-1894.html http://www.debian.org/security/2015/dsa-3338 http://www.securitytracker.com/id/1033318 http://rhn.redhat.com/errata/RHSA-2015-1767.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5963`	vulnerable	2026-06-08 05:06:51.093077	Details available contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record. Published: 2015-08-24T14:00:00.000Z Updated: 2024-08-06T07:06:34.935Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html http://lists.opensuse.org/opensuse-updates/2015-09/msg00026.html http://rhn.redhat.com/errata/RHSA-2015-1894.html http://www.debian.org/security/2015/dsa-3338 http://www.securitytracker.com/id/1033318	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5145`	vulnerable	2026-06-08 05:06:48.896646	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5144`	vulnerable	2026-06-08 05:06:48.896148	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5143`	vulnerable	2026-06-08 05:06:48.886460	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3982`	vulnerable	2026-06-08 05:06:38.944203	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2317`	vulnerable	2026-06-08 05:06:28.004898	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2316`	vulnerable	2026-06-08 05:06:27.988249	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.