HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2014-0474

CVSS 10.0v2.0pub. 2014-04-23upd. 2026-05-06

The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting."

CVSS Vector
AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Canonical Ubuntu

    OS
    Canonical
    10.0412.0412.1013.1014.04

  • Djangoproject Django

    APP
    Djangoproject
    1.41.4.11.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.91.51.5.11.5.21.5.31.5.4+ 6 more
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2025-32463CRITICAL9.3⚠ KEVPL ✓same product

Sudo: eskalacja uprawnień do root poprzez opcję --chroot (CVE-2025-32463)

CVE-2022-0543CRITICAL10.0⚠ KEVPL ✓same product

Redis – ucieczka z Lua sandbox umożliwiająca zdalne wykonanie kodu (RCE)

CVE-2020-11651CRITICAL9.8⚠ KEVPL ✓same product

SaltStack Salt: nieautoryzowany dostęp do metod salt-master umożliwiający RCE

CVE-2020-7247CRITICAL9.8⚠ KEVPL ✓same product

RCE jako root w OpenSMTPD przez command injection w polu MAIL FROM

CVE-2019-16928CRITICAL9.8⚠ KEVPL ✓same product

RCE w Exim — heap-based buffer overflow w obsłudze komendy EHLO