GCVE - cpe:2.3:a:djangoproject:django:1.8.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:djangoproject:django:1.8.1:*:*:*:*:*:*:*

part: a version: 1.8.1 update: *

Vendor	Djangoproject (`070db687-4713-5da4-80b0-4a67baf0d0d4`)
Product	Django (`b34a5fd0-fae8-5096-941f-bded7e4dd228`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:docker/django/django`	purl2cpe	2026-06-01 10:17:26.827812
`pkg:github/django/django`	purl2cpe	2026-06-01 10:17:26.827814
`pkg:pypi/django`	purl2cpe	2026-06-01 10:17:26.827815

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-7234`	vulnerable	2026-06-08 05:09:55.522002	Details available A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability. Published: 2017-04-04T17:00:00.000Z Updated: 2024-08-05T15:56:36.057Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1038177 http://www.securityfocus.com/bid/97401 http://www.debian.org/security/2017/dsa-3835 https://www.djangoproject.com/weblog/2017/apr/04/security-releases/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-7233`	vulnerable	2026-06-08 05:09:55.497048	Details available Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack. Published: 2017-04-04T17:00:00.000Z Updated: 2024-08-05T15:56:36.158Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1038177 https://access.redhat.com/errata/RHSA-2017:1596 http://www.securityfocus.com/bid/97406 https://access.redhat.com/errata/RHSA-2017:3093 http://www.debian.org/security/2017/dsa-3835	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9014`	vulnerable	2026-06-08 05:08:22.419542	Details available Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS. Published: 2016-12-09T20:00:00.000Z Updated: 2024-08-06T02:35:02.332Z Open on db.gcve.eu Reference links https://www.djangoproject.com/weblog/2016/nov/01/security-releases/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/ http://www.securityfocus.com/bid/94068 http://www.debian.org/security/2017/dsa-3835 http://www.ubuntu.com/usn/USN-3115-1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9013`	vulnerable	2026-06-08 05:08:22.407594	Details available Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary. Published: 2016-12-09T20:00:00.000Z Updated: 2024-08-06T02:35:02.828Z Open on db.gcve.eu Reference links https://www.djangoproject.com/weblog/2016/nov/01/security-releases/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/ http://www.debian.org/security/2017/dsa-3835 http://www.ubuntu.com/usn/USN-3115-1 http://www.securityfocus.com/bid/94069	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-8213`	vulnerable	2026-06-08 05:07:03.311099	Details available The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY. Published: 2015-12-07T20:00:00.000Z Updated: 2024-08-06T08:13:31.831Z Open on db.gcve.eu Reference links https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4 http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html http://www.ubuntu.com/usn/USN-2816-1 http://rhn.redhat.com/errata/RHSA-2016-0129.html https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5964`	vulnerable	2026-06-08 05:06:51.097261	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5963`	vulnerable	2026-06-08 05:06:51.093095	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5145`	vulnerable	2026-06-08 05:06:48.896667	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5144`	vulnerable	2026-06-08 05:06:48.896181	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5143`	vulnerable	2026-06-08 05:06:48.886987	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3982`	vulnerable	2026-06-08 05:06:38.944774	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.