The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python-django | Jul 30, 2024 | Aug 26, 2014 |
| Freebsd | — | Upgrade py33-django15Upgrade py32-django-develUpgrade py27-django15Upgrade py27-django14Upgrade py27-django-develUpgrade py27-djangoUpgrade py34-django15Upgrade py34-django-develUpgrade py32-djangoUpgrade py33-djangoUpgrade py34-djangoUpgrade py33-django-develUpgrade py32-django15 | Dec 10, 2025 | Aug 21, 2014 |
| Gentoo Linux | — | Upgrade dev-python/django. | Oct 30, 2017 | Aug 26, 2014 |
| Suse | — | Upgrade python-django | Dec 18, 2015 | Aug 26, 2014 |
| Ubuntu | — | Upgrade python-django | Nov 8, 2024 | Aug 26, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub