GCVE - cpe:2.3:a:djangoproject:django:1.4.11:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:djangoproject:django:1.4.11:*:*:*:*:*:*:*

part: a version: 1.4.11 update: *

Vendor	Djangoproject (`070db687-4713-5da4-80b0-4a67baf0d0d4`)
Product	Django (`b34a5fd0-fae8-5096-941f-bded7e4dd228`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:docker/django/django`	purl2cpe	2026-06-01 10:17:26.765310
`pkg:github/django/django`	purl2cpe	2026-06-01 10:17:26.765313
`pkg:pypi/django`	purl2cpe	2026-06-01 10:17:26.765314

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-5964`	vulnerable	2026-06-08 05:06:51.096825	Details available The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors. Published: 2015-08-24T14:00:00.000Z Updated: 2024-08-06T07:06:34.982Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html http://rhn.redhat.com/errata/RHSA-2015-1894.html http://www.debian.org/security/2015/dsa-3338 http://www.securitytracker.com/id/1033318 http://rhn.redhat.com/errata/RHSA-2015-1767.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5963`	vulnerable	2026-06-08 05:06:51.088620	Details available contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record. Published: 2015-08-24T14:00:00.000Z Updated: 2024-08-06T07:06:34.935Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html http://lists.opensuse.org/opensuse-updates/2015-09/msg00026.html http://rhn.redhat.com/errata/RHSA-2015-1894.html http://www.debian.org/security/2015/dsa-3338 http://www.securitytracker.com/id/1033318	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3730`	vulnerable	2026-06-08 05:05:42.569457	Details available The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com." Published: 2014-05-16T15:00:00.000Z Updated: 2024-08-06T10:50:18.338Z Open on db.gcve.eu Reference links http://secunia.com/advisories/61281 http://www.debian.org/security/2014/dsa-2934 http://ubuntu.com/usn/usn-2212-1 http://www.securityfocus.com/bid/67410 http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-1418`	vulnerable	2026-06-08 05:05:24.532554	Details available Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers. Published: 2014-05-16T15:00:00.000Z Updated: 2024-08-06T09:42:35.452Z Open on db.gcve.eu Reference links http://secunia.com/advisories/61281 http://www.debian.org/security/2014/dsa-2934 http://ubuntu.com/usn/usn-2212-1 http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html http://www.openwall.com/lists/oss-security/2014/05/15/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0483`	vulnerable	2026-06-08 05:05:13.118531	Details available The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI. Published: 2014-08-26T14:00:00.000Z Updated: 2024-08-06T09:20:18.489Z Open on db.gcve.eu Reference links https://www.djangoproject.com/weblog/2014/aug/20/security/ http://secunia.com/advisories/61276 http://secunia.com/advisories/61281 http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html http://www.debian.org/security/2014/dsa-3010	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0482`	vulnerable	2026-06-08 05:05:13.117080	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0481`	vulnerable	2026-06-08 05:05:13.115550	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0480`	vulnerable	2026-06-08 05:05:13.113938	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.