GCVE - cpe:2.3:a:djangoproject:django:1.1.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:djangoproject:django:1.1.3:*:*:*:*:*:*:*

part: a version: 1.1.3 update: *

Vendor	Djangoproject (`070db687-4713-5da4-80b0-4a67baf0d0d4`)
Product	Django (`b34a5fd0-fae8-5096-941f-bded7e4dd228`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:docker/django/django`	purl2cpe	2026-06-01 10:17:26.737543
`pkg:github/django/django`	purl2cpe	2026-06-01 10:17:26.737544
`pkg:pypi/django`	purl2cpe	2026-06-01 10:17:26.737546

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-3444`	vulnerable	2026-06-08 05:02:09.932804	Details available The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image. Published: 2012-07-31T17:00:00.000Z Updated: 2024-08-06T20:05:12.482Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/07/31/1 https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/ http://www.mandriva.com/security/advisories?name=MDVSA-2012:143 http://www.ubuntu.com/usn/USN-1560-1 http://www.openwall.com/lists/oss-security/2012/07/31/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3443`	vulnerable	2026-06-08 05:02:09.931735	Details available The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file. Published: 2012-07-31T17:00:00.000Z Updated: 2024-08-06T20:05:12.549Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/07/31/1 https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/ http://www.mandriva.com/security/advisories?name=MDVSA-2012:143 http://www.ubuntu.com/usn/USN-1560-1 http://www.openwall.com/lists/oss-security/2012/07/31/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3442`	vulnerable	2026-06-08 05:02:09.924428	Details available The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL. Published: 2012-07-31T17:00:00.000Z Updated: 2024-08-06T20:05:12.572Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/07/31/1 https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/ http://www.mandriva.com/security/advisories?name=MDVSA-2012:143 http://www.ubuntu.com/usn/USN-1560-1 http://www.openwall.com/lists/oss-security/2012/07/31/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4140`	vulnerable	2026-06-08 04:59:29.681439	Details available The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code. Published: 2011-10-19T10:00:00.000Z Updated: 2024-08-07T00:01:51.120Z Open on db.gcve.eu Reference links https://hermes.opensuse.org/messages/14700881 http://www.debian.org/security/2011/dsa-2332 https://bugzilla.redhat.com/show_bug.cgi?id=737366 http://secunia.com/advisories/46614 http://openwall.com/lists/oss-security/2011/09/11/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4139`	vulnerable	2026-06-08 04:59:29.680599	Details available Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request. Published: 2011-10-19T10:00:00.000Z Updated: 2024-08-07T00:01:50.429Z Open on db.gcve.eu Reference links https://hermes.opensuse.org/messages/14700881 http://www.debian.org/security/2011/dsa-2332 https://bugzilla.redhat.com/show_bug.cgi?id=737366 http://secunia.com/advisories/46614 http://openwall.com/lists/oss-security/2011/09/11/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4138`	vulnerable	2026-06-08 04:59:29.679455	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4137`	vulnerable	2026-06-08 04:59:29.678454	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4136`	vulnerable	2026-06-08 04:59:29.667202	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0698`	vulnerable	2026-06-08 04:56:38.692478	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0697`	vulnerable	2026-06-08 04:56:38.691914	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0696`	vulnerable	2026-06-08 04:56:38.690059	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.