El Alto MultiCloud Security/Vulnerability Report

This table represents the known exploitable and non-exploitable vulnerabilities in third party packages used in the project.

Repository	Group	Problem Code	Effective/Ineffective	Resolvable by Project	Impact Analysis
multicloud-azure	Django	CVE-2016-9013	Ineffective	False Positive, Oracle DB is not used	Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary. The `Django` package is vulnerable to Improper Authentication due to a hard-coded password. The `_test_database_passwd()` method in `creation.py` assigns a password to a test user which is hard-coded as a default password when no password is specified in the database settings under `test` dictionary. A remote attacker who has access to the local network can exploit this vulnerability by connecting to a database server with the username and password created as part of running the test suite and perform unauthorized operations such as read or delete data. Note: This vulnerability only occurs if the tests are run on an Oracle server.The application is vulnerable by using this component with test –keepdb option enabled in the Oracle server only. Reference: https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
multicloud-azure	Django	CVE-2019-14234	Ineffective	False Positive, No API exposes SQL queries	Django - SQL Injection
multicloud-azure	Django	N/A	Ineffective	False positive, JQuery package is not used since no UI	The `jquery` package is vulnerable to Prototype Pollution. The `jQuery.extend` and `jQuery.fn.extend` functions defined in many files allow an untrusted object to extend `Object.prototype`. An attacker can modify and add prototype properties to JavaScript objects and can potentially leverage those changes to crash the application or execute remote code.
multicloud-azure	Django	CVE-2016-9014	Ineffecitve	False Positive, settings.DEBUG should be set to False	Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS. The `Django` package is vulnerable to a DNS rebinding attack. The `get_host()` method in `request.py` allows the Host header without validating against `settings.ALLOWED_HOSTS` when `settings.DEBUG` is set to `True`. An attacker could exploit this vulnerability to execute Cross-Site Scripting (XSS), “which could be quite serious if developers load a copy of the production database in development or connect to some production services for which there's no development instance”.
multicloud-azure	Django	CVE-2016-7401	Ineffective	False Positive, Consumer of this service is ONAP components, hence cookie is not involved	The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies. Django's cookie parsing code, when used on a site with Google Analytics, is vulnerable to Cross-Site Request Forgery (CSRF). The `def parse_cookie(cookie)()` method of `cookie.py` allows arbitrary cookies without properly parsing them. A remote unauthenticated attacker can exploit this vulnerability by crafting a malformed HTTP request to set arbitrary cookies. The attacker entices the unsuspecting victim to click the malicious URI thus bypassing CSRF protection mechanism.
multicloud-azure	Django	CVE-2019-14232	Ineffective	False Positive, django.utils.text.Truncator's chars() and words() methods are not used	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
multicloud-azure	Django	CVE-2019-14233	Ineffective	False Positive, django.utils.html.strip_tags is not used	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
multicloud-azure	Django	CVE-2019-14235	Ineffective	False Positive, django.utils.encoding.uri_to_iri is not used	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
multicloud-azure	Django	CVE-2019-6975	Ineffective	False Positive, django.utils.numberformat.format() is not used	Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function. The `Django` package is vulnerable to Denial of Service (DoS) due to Uncontrolled Memory Consumption. The `format()` function in the `numberformat.py` file formats user-supplied number without properly handing a number with many decimal digits. This leads to Uncontrolled Memory Consumption. An attacker can exploit this vulnerability by sending a decimal number with a large number of decimal digits which would eventually cause a Denial of Service condition.
multicloud-azure	Django	CVE-2016-6186	Ineffective	False Positive, contrib/admin/static/admin/js/ admin/RelatedObjectLookups.js is not used	Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML. `Django` is vulnerable to Cross-Site Scripting (XSS) as it allows unsafe content via `Element.innerHTML`. The `dismissChangeRelatedObjectPopup()` of `RelatedObjectLookups.js` and `varToggle()`, `switchPastebinFriendly()` of `debug.py` allows user input text to be rendered as HTML using the `innerHTML` DOM property. A remote attacker can exploit this vulnerability by crafting a malicious JavaScript payload and placing it inside the name element, which allows script to be stored in the database. This leads to Cross-Site Scripting when it gets executed by the browser. A proof of concept attack is available at : https://www.vulnerability-lab.com/get_content.php?id=1869
multicloud-azure	Django	CVE-2017-12794	Ineffective	False Positive, DEBUG should be set False	In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings. `Django` is vulnerable to Cross-Site Scripting (XSS). The `debug.py` file allows arbitrary JavaScript execution when DEBUG mode is enabled. A remote attacker could exploit this vulnerability using a specially-crafted url to execute a script in a victim's web browser within the security context of the hosting site. The application is vulnerable by using this component with DEBUG enabled.
multicloud-azure	Django	CVE-2017-7233	Ineffective	False Positive, django.utils.http.is_safe_url() is not used	Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack. `Django` is vulnerable to Improper Input Validation. The `is_safe_url()` function in the `http.py` file does not properly validate URLs passed to it, as it marks invalid numeric URLs incorrectly. A malicious user could potentially execute an open redirect or XSS attack against functionality that relies on this function to validate user input.
multicloud-azure	Django	CVE-2017-7234	Ineffective	False Positive, django.views.static.serve() is not used.	A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.
multicloud-azure	Django	CVE-2018-14574	Ineffective	`False Positive,` `get_full_path_with_slash` `and _reverse_with_prefix is not used.`	django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect. Django CommonMiddleware is vulnerable to an Open Redirect attack. The `get_full_path_with_slash()` function in `common.py` and `_reverse_with_prefix()` function in `resolvers.py` create URLs to redirect visitors to other locations, but do not properly ensure that the redirection does not take the visitor to another domain. An attacker can exploit this vulnerability by creating a link that appears to be to the targeted application, but actually redirects any visitors to a malicious attacker-controlled domain.
multicloud-azure	Django	CVE-2019-3498	Ineffective	False Positive, `page_not_found is not used.`	In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content. The Django package is vulnerable to a Content Spoofing attack. The `page_not_found()` function in the `defaults.py` file, when displaying a 404 response, renders the URL (`request_path`) without performing proper sanitization. A remote attacker can exploit this vulnerability by crafting a URL containing malicious HTML. The attacker can then entice a victim into navigating to the malicious URL. The attacker can leverage this vulnerability to spoof the contents of the seemingly legitimate 404 page, which they can then use to perform various other attacks.
multicloud-azure	Django	N/A	Ineffective	`False Positive,` `parseHTML.js is not used.`	The `jQuery` package is vulnerable to Cross-Site Scripting (XSS). The `parseHTML()` function in the `parseHTML.js`, `jquery.js` files allow JavaScript to be executed immediately when it's embedded within the event attributes. An attacker can exploit this vulnerability by injecting malicious JavaScript containing events handlers which, when rendered, results in the execution of arbitrary script.
multicloud-azure	Django	N/A	Ineffective	False Positive, JQuery is not used.	The `jQuery` library is vulnerable to Cross-Site Scripting (XSS) when no explicit data type is provided within an AJAX request. The `ajaxSetup()` method in `script.js` allows execution of responses from third-party origins by default. A remote attacker can exploit this vulnerability by sending a malicious response to an AJAX request, resulting in the execution of the Cross Origin response.
multicloud-azure	Django	N/A	Ineffective	False Positive	Django - Permissions, Privileges and Access Controls
multicloud-azure	Django	CVE-2018-7536	Ineffective	False Positive, django.utils.html.urlize is not used.	An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable. The `Django` package is vulnerable to Regular Expression Denial of Service (ReDoS) attacks. The `trim_punctuation()` function in the `html.py` file uses vulnerable regular expressions to parse email addresses. A remote attacker can exploit this vulnerability by crafting an input with an email address containing a very long sequence of repetitive characters to be parsed into a URI by Django. This can potentially consume available CPU resources, leading to a DoS situation.
multicloud-azure	Django	CVE-2018-7537	Ineffective	False Positive, django.utils.text.Truncator's chars() and words() methods are not used.	An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. The `Django` package is vulnerable to Regular Expression Denial of Service (ReDoS) attacks. The `_truncate_html()` method in the `text.py` file uses a vulnerable regular expression while parsing text given to it by the `django.utils.text.chars()` and `django.utils.text.words()` methods. A remote attacker can exploit this vulnerability by crafting an input string containing a very long sequence of repetitive tab space ( ) characters. This can potentially consume available CPU resources, leading to a DoS situation.
multicloud-azure	Django	CVE-2019-12781	Ineffective	False Positive,	An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP. Django is vulnerable to Improperly Implemented Security Check for Standard. The `scheme` function in `request.py` does not redirect HTTP requests to go over HTTPS when `SECURE_PROXY_SSL_HEADER` and `SECURE_SSL_REDIRECT` settings are being used in some cases. An attacker can exploit this flaw to compromise the application security by causing, for example, Man-in-the-Middle (MitM) attacks.
multicloud-azure	Django	N/A	Ineffective	False Positive, django.utils.http.is_safe_url() is not used.	Django - django.utils.http.is_safe_url() crash on invalid IPv6 URLs
multicloud-azure	Django	N/A	Ineffective	False Positive, `paginate_queryset is not used.`	`Django` is vulnerable to Improper Error Handling. The `paginate_queryset()` function in the `list.py` file throws an uncaught `UnicodeDecodeError` if an `InvalidPage` error contains non-ASCII characters. A malicious user who is able to configure the `InvalidPage` message can exploit this vulnerability by setting it to contain a non-ASCII character.
multicloud-azure	Django	CVE-2016-9013	Ineffective	False Positive, `_test_database_passwd is not used.`	Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary. The `Django` package is vulnerable to Improper Authentication due to a hard-coded password. The `_test_database_passwd()` method in `creation.py` assigns a password to a test user which is hard-coded as a default password when no password is specified in the database settings under `test` dictionary. A remote attacker who has access to the local network can exploit this vulnerability by connecting to a database server with the username and password created as part of running the test suite and perform unauthorized operations such as read or delete data. Note: This vulnerability only occurs if the tests are run on an Oracle server.The application is vulnerable by using this component with test –keepdb option enabled in the Oracle server only. Reference: https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
multicloud-azure	Django	CVE-2019-14234	Ineffective	False Positive, Expose no sql queries	Django - SQL Injection
multicloud-azure	Django	N/A	Ineffective	False Positive, jquery is not used.	The `jquery` package is vulnerable to Prototype Pollution. The `jQuery.extend` and `jQuery.fn.extend` functions defined in many files allow an untrusted object to extend `Object.prototype`. An attacker can modify and add prototype properties to JavaScript objects and can potentially leverage those changes to crash the application or execute remote code.
multicloud-azure	Django	CVE-2016-9014	Ineffective	False Positive, `get_host is not used`	Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS. The `Django` package is vulnerable to a DNS rebinding attack. The `get_host()` method in `request.py` allows the Host header without validating against `settings.ALLOWED_HOSTS` when `settings.DEBUG` is set to `True`. An attacker could exploit this vulnerability to execute Cross-Site Scripting (XSS), “which could be quite serious if developers load a copy of the production database in development or connect to some production services for which there's no development instance”.
multicloud-azure	Django	CVE-2016-7401	ineffective	`False Positive`	The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies. Django's cookie parsing code, when used on a site with Google Analytics, is vulnerable to Cross-Site Request Forgery (CSRF). The `def parse_cookie(cookie)()` method of `cookie.py` allows arbitrary cookies without properly parsing them. A remote unauthenticated attacker can exploit this vulnerability by crafting a malformed HTTP request to set arbitrary cookies. The attacker entices the unsuspecting victim to click the malicious URI thus bypassing CSRF protection mechanism.
multicloud-azure	Django	CVE-2019-14232	Ineffective	False Positive, django.utils.text.Truncator's chars() and words() methods are not used.	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
multicloud-azure	Django	CVE-2019-14233	Ineffective	False positive. HTMLParser is not used.	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
multicloud-azure	Django	CVE-2019-14235	Ineffective	False positive.	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
multicloud-azure	Django	CVE-2019-6975	Ineffective	False positive.	Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function. The `Django` package is vulnerable to Denial of Service (DoS) due to Uncontrolled Memory Consumption. The `format()` function in the `numberformat.py` file formats user-supplied number without properly handing a number with many decimal digits. This leads to Uncontrolled Memory Consumption. An attacker can exploit this vulnerability by sending a decimal number with a large number of decimal digits which would eventually cause a Denial of Service condition.
multicloud-azure	Django	CVE-2016-6186	Ineffective	False positive.	Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML. `Django` is vulnerable to Cross-Site Scripting (XSS) as it allows unsafe content via `Element.innerHTML`. The `dismissChangeRelatedObjectPopup()` of `RelatedObjectLookups.js` and `varToggle()`, `switchPastebinFriendly()` of `debug.py` allows user input text to be rendered as HTML using the `innerHTML` DOM property. A remote attacker can exploit this vulnerability by crafting a malicious JavaScript payload and placing it inside the name element, which allows script to be stored in the database. This leads to Cross-Site Scripting when it gets executed by the browser. A proof of concept attack is available at : https://www.vulnerability-lab.com/get_content.php?id=1869
multicloud-azure	Django	CVE-2017-12794	Ineffective	False positive.	In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings. `Django` is vulnerable to Cross-Site Scripting (XSS). The `debug.py` file allows arbitrary JavaScript execution when DEBUG mode is enabled. A remote attacker could exploit this vulnerability using a specially-crafted url to execute a script in a victim's web browser within the security context of the hosting site. The application is vulnerable by using this component with DEBUG enabled.
multicloud-azure	Django	CVE-2017-7233	Ineffective	False positive.	Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack. `Django` is vulnerable to Improper Input Validation. The `is_safe_url()` function in the `http.py` file does not properly validate URLs passed to it, as it marks invalid numeric URLs incorrectly. A malicious user could potentially execute an open redirect or XSS attack against functionality that relies on this function to validate user input.
multicloud-azure	Django	CVE-2017-7234	Ineffective	False positive.	A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.
multicloud-azure	Django	CVE-2018-14574	Ineffective	False positive.	django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect. Django CommonMiddleware is vulnerable to an Open Redirect attack. The `get_full_path_with_slash()` function in `common.py` and `_reverse_with_prefix()` function in `resolvers.py` create URLs to redirect visitors to other locations, but do not properly ensure that the redirection does not take the visitor to another domain. An attacker can exploit this vulnerability by creating a link that appears to be to the targeted application, but actually redirects any visitors to a malicious attacker-controlled domain.
multicloud-azure	Django	CVE-2019-3498	Ineffective	False positive.	In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content. The Django package is vulnerable to a Content Spoofing attack. The `page_not_found()` function in the `defaults.py` file, when displaying a 404 response, renders the URL (`request_path`) without performing proper sanitization. A remote attacker can exploit this vulnerability by crafting a URL containing malicious HTML. The attacker can then entice a victim into navigating to the malicious URL. The attacker can leverage this vulnerability to spoof the contents of the seemingly legitimate 404 page, which they can then use to perform various other attacks.
multicloud-azure	Django	N/A	Ineffective	False positive.	The `jQuery` package is vulnerable to Cross-Site Scripting (XSS). The `parseHTML()` function in the `parseHTML.js`, `jquery.js` files allow JavaScript to be executed immediately when it's embedded within the event attributes. An attacker can exploit this vulnerability by injecting malicious JavaScript containing events handlers which, when rendered, results in the execution of arbitrary script.
multicloud-azure	Django	N/A	Ineffective	False positive.	The `jQuery` library is vulnerable to Cross-Site Scripting (XSS) when no explicit data type is provided within an AJAX request. The `ajaxSetup()` method in `script.js` allows execution of responses from third-party origins by default. A remote attacker can exploit this vulnerability by sending a malicious response to an AJAX request, resulting in the execution of the Cross Origin response.
multicloud-azure	Django	N/A	Ineffective	False positive.	Django - Permissions, Privileges and Access Controls
multicloud-azure	Django	CVE-2018-7536	Ineffective	False positive.	An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable. The `Django` package is vulnerable to Regular Expression Denial of Service (ReDoS) attacks. The `trim_punctuation()` function in the `html.py` file uses vulnerable regular expressions to parse email addresses. A remote attacker can exploit this vulnerability by crafting an input with an email address containing a very long sequence of repetitive characters to be parsed into a URI by Django. This can potentially consume available CPU resources, leading to a DoS situation.
multicloud-azure	Django	CVE-2018-7537	Ineffective	False positive.	An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. The `Django` package is vulnerable to Regular Expression Denial of Service (ReDoS) attacks. The `_truncate_html()` method in the `text.py` file uses a vulnerable regular expression while parsing text given to it by the `django.utils.text.chars()` and `django.utils.text.words()` methods. A remote attacker can exploit this vulnerability by crafting an input string containing a very long sequence of repetitive tab space ( ) characters. This can potentially consume available CPU resources, leading to a DoS situation.
multicloud-azure	Django	CVE-2019-12781	Ineffective	False positive.	An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP. Django is vulnerable to Improperly Implemented Security Check for Standard. The `scheme` function in `request.py` does not redirect HTTP requests to go over HTTPS when `SECURE_PROXY_SSL_HEADER` and `SECURE_SSL_REDIRECT` settings are being used in some cases. An attacker can exploit this flaw to compromise the application security by causing, for example, Man-in-the-Middle (MitM) attacks.
multicloud-azure	Django	N/A	Ineffective	False positive.	Django - django.utils.http.is_safe_url() crash on invalid IPv6 URLs
multicloud-azure	Django	N/A	Ineffective	False positive.	`Django` is vulnerable to Improper Error Handling. The `paginate_queryset()` function in the `list.py` file throws an uncaught `UnicodeDecodeError` if an `InvalidPage` error contains non-ASCII characters. A malicious user who is able to configure the `InvalidPage` message can exploit this vulnerability by setting it to contain a non-ASCII character.
multicloud-azure	requests	CVE-2018-18074	Ineffective	False positive.	The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. The `requests` package is vulnerable to Information Disclosure. The `resolve_redirects()` function in the `session.py` file fails to strip the `Authorization` header from requests that redirect from https to http on the same host. A remote attacker can exploit this vulnerability by performing a Man-in-the-Middle (MitM) attack to capture this redirect request and exfiltrate plaintext credential information from an unsuspecting victim.
multicloud-azure	requests	CVE-2018-20060	Ineffective	False positive.	urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext. The urllib3 package is vulnerable to Information Exposure. The `urlopen` function in `poolmanager.py` redirects a request from the current host to another host if necessary. The function does not remove the Authorization HTTP header before redirecting the request. The Authorization header may contain credentials that should not be exposed to an untrusted host. The redirect may also be unencrypted, exposing a user's credentials to an attacker listening for the request.
multicloud-azure	requests	CVE-2019-11324	Ineffective	False positive.	The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument. The `urllib3` package is vulnerable to Improper Certificate Validation. The `ssl_wrap_socket` function in `ssl_.py` loads system CA certificates even if a different set of CA certificates has been specified. This vulnerability results in connections succeeding when they should have been denied.
multicloud-azure	requests	CVE-2019-11236	Ineffective	False positive.	In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. The `urllib3` package is vulnerable to CRLF Injection. The `parse_url()` function in the `url.py` file does not properly escape Carriage Return and Line Feed (CRLF) characters when parsing URLs. A remote attacker with control of the requesting address parameter (`request`) can exploit this vulnerability with a maliciously crafted request containing CRLF characters within the query string. This will effectively give the attacker control of the response body, which may then be used to perform various other attacks.
multicloud-azure	requests	CVE-2019-9740	Ineffective	False positive.	An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. The `urllib3` package is vulnerable to Response Splitting attacks. The `parse_url()` function in `url.py` fails to sanitize URL paths containing carriage return and linefeed (CRLF) characters. A remote attacker can exploit this behavior by submitting a crafted request containing CRLF characters that are propagated to the `path` parameter of the `Url` constructor which later forms a malformed HTTP response sent to a user. Attackers may leverage Response Splitting to inject HTTP response headers and control the body of the response.
multicloud-azure	requests	CVE-2018-18074	Ineffective	False positive.	The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. The `requests` package is vulnerable to Information Disclosure. The `resolve_redirects()` function in the `session.py` file fails to strip the `Authorization` header from requests that redirect from https to http on the same host. A remote attacker can exploit this vulnerability by performing a Man-in-the-Middle (MitM) attack to capture this redirect request and exfiltrate plaintext credential information from an unsuspecting victim.
multicloud-azure	requests	CVE-2018-20060	Ineffective	False positive.	urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext. The urllib3 package is vulnerable to Information Exposure. The `urlopen` function in `poolmanager.py` redirects a request from the current host to another host if necessary. The function does not remove the Authorization HTTP header before redirecting the request. The Authorization header may contain credentials that should not be exposed to an untrusted host. The redirect may also be unencrypted, exposing a user's credentials to an attacker listening for the request.
multicloud-azure	requests	CVE-2019-11324	Ineffective	False positive.	The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument. The `urllib3` package is vulnerable to Improper Certificate Validation. The `ssl_wrap_socket` function in `ssl_.py` loads system CA certificates even if a different set of CA certificates has been specified. This vulnerability results in connections succeeding when they should have been denied.
multicloud-azure	requests	CVE-2019-11236	Ineffective	False positive.	In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. The `urllib3` package is vulnerable to CRLF Injection. The `parse_url()` function in the `url.py` file does not properly escape Carriage Return and Line Feed (CRLF) characters when parsing URLs. A remote attacker with control of the requesting address parameter (`request`) can exploit this vulnerability with a maliciously crafted request containing CRLF characters within the query string. This will effectively give the attacker control of the response body, which may then be used to perform various other attacks.
multicloud-azure	requests	CVE-2019-9740	Ineffective	False positive.	An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. The `urllib3` package is vulnerable to Response Splitting attacks. The `parse_url()` function in `url.py` fails to sanitize URL paths containing carriage return and linefeed (CRLF) characters. A remote attacker can exploit this behavior by submitting a crafted request containing CRLF characters that are propagated to the `path` parameter of the `Url` constructor which later forms a malformed HTTP response sent to a user. Attackers may leverage Response Splitting to inject HTTP response headers and control the body of the response.
multicloud-azure	djangorestframework	CVE-2018-14042	Ineffective	False positive.	In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip. The `bootstrap` package is vulnerable to Cross-Site Scripting (XSS). The `show()` function in the `tooltip.js` file allows HTML and scripts in the `data-container` tooltip attribute values in the DOM elements without proper sanitization. This can be misused to cause XSS.
multicloud-azure	djangorestframework	CVE-2018-20676	Ineffective	False positive.	In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute. The `bootstrap` package is vulnerable to Cross-Site Scripting (XSS). The `Tooltip.prototype.init()` function in the `tooltip.js' file does not properly sanitize values for the`data-viewport`attribute, allowing for scripts/HTML. A remote attacker can exploit this by injecting malicious HTML/JavaScript in the`data-viewport` attribute of a tooltip that would then be executed upon hovering the mouse over the tooltip.
multicloud-azure	djangorestframework	CVE-2018-20677	Ineffective	False positive.	In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property. The `bootstrap` package is vulnerable to Cross-Site Scripting (XSS). The `Affix()` function in the `affix.js` file allows scripts/HTML data via the `target` attribute that is stored in DOM elements without properly being sanitized. A remote attacker can exploit this by injecting malicious HTML/JavaScript code in the `target` attribute of `affix` and entice a victim to click on it, triggering the XSS.
multicloud-azure	djangorestframework	CVE-2019-8331	Ineffective	False positive.	In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. The `bootstrap` package is vulnerable to Cross-Site Scripting (XSS). The `setElementContent` method in the `tooltip.js` file accepts JavaScript within the input parameters without properly sanitizing the data in the elements that are being rendered on the webpage. This could lead to Cross-Site Scripting (XSS).
multicloud-azure	djangorestframework	N/A	Ineffective	False positive.	NO INFORMATION
multicloud-azure	djangorestframework	N/A	Ineffective	False positive.	The `bootstrap` package is vulnerable to Cross-Site Scripting (XSS). The `data-target` attribute in `bootstrap.js` interprets encoded HTML entities as standard HTML entities when `data-target` is based on user supplied input. A remote attacker can exploit this vulnerability by crafting input containing malicious JavaScript, and injecting it into a `data-target` attribute, which results in Cross-Site Scripting (XSS).
multicloud-azure	djangorestframework	CVE-2018-14042	Ineffective	False positive.	In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip. The `bootstrap` package is vulnerable to Cross-Site Scripting (XSS). The `show()` function in the `tooltip.js` file allows HTML and scripts in the `data-container` tooltip attribute values in the DOM elements without proper sanitization. This can be misused to cause XSS.
multicloud-azure	djangorestframework	CVE-2018-20676	Ineffective	False positive.	In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute. The `bootstrap` package is vulnerable to Cross-Site Scripting (XSS). The `Tooltip.prototype.init()` function in the `tooltip.js' file does not properly sanitize values for the`data-viewport`attribute, allowing for scripts/HTML. A remote attacker can exploit this by injecting malicious HTML/JavaScript in the`data-viewport` attribute of a tooltip that would then be executed upon hovering the mouse over the tooltip.
multicloud-azure	djangorestframework	CVE-2018-20677	Ineffective	False positive.	In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property. The `bootstrap` package is vulnerable to Cross-Site Scripting (XSS). The `Affix()` function in the `affix.js` file allows scripts/HTML data via the `target` attribute that is stored in DOM elements without properly being sanitized. A remote attacker can exploit this by injecting malicious HTML/JavaScript code in the `target` attribute of `affix` and entice a victim to click on it, triggering the XSS.
multicloud-azure	djangorestframework	CVE-2019-8331	Ineffective	False positive.	In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. The `bootstrap` package is vulnerable to Cross-Site Scripting (XSS). The `setElementContent` method in the `tooltip.js` file accepts JavaScript within the input parameters without properly sanitizing the data in the elements that are being rendered on the webpage. This could lead to Cross-Site Scripting (XSS).
multicloud-azure	djangorestframework	N/A	Ineffective	False positive.	NO INFORMATION
multicloud-azure	djangorestframework	N/A	Ineffective	False positive.	The `bootstrap` package is vulnerable to Cross-Site Scripting (XSS). The `data-target` attribute in `bootstrap.js` interprets encoded HTML entities as standard HTML entities when `data-target` is based on user supplied input. A remote attacker can exploit this vulnerability by crafting input containing malicious JavaScript, and injecting it into a `data-target` attribute, which results in Cross-Site Scripting (XSS).
multicloud-azure	httplib2	N/A	Ineffective	False positive.	The `httplib2` package is vulnerable to Improper Validation of Certificate with Host Mismatch. The `connect()` function in the `_init_.py` file fails to properly validate hostnames of SSL certificates. An attacker can exploit this vulnerability by executing a Man-in-the-Middle (MitM) attack in order to intercept requests and provide a valid attacker-controlled certificate to the client. This allows the attacker to decrypt, read, and modify data in transit, thus effectively spoofing the vulnerable server.
multicloud-azure	httplib2	N/A	Ineffective	False positive.	The `httplib2` package is vulnerable to Improper Validation of Certificate with Host Mismatch. The `connect()` function in the `_init_.py` file fails to properly validate hostnames of SSL certificates. An attacker can exploit this vulnerability by executing a Man-in-the-Middle (MitM) attack in order to intercept requests and provide a valid attacker-controlled certificate to the client. This allows the attacker to decrypt, read, and modify data in transit, thus effectively spoofing the vulnerable server.

Repository	Group	Problem Code	Effective/Ineffective	Resolvable by Project	Impact Analysis	Action
multicloud-framework-artifactbroker	com.fasterxml.jackson.core	N/A	Ineffective	False positive the lib is part of the sdcTosca parser which is used as a library. the parser only runs on predefined objects and will not attempt to run on an object that was not validated. the parser is protected by the application using it and the information supplied is coming from the using application. There is no non vulnerable version of this component.	`jackson-databind` is vulnerable to Remote Code Execution (RCE). The `createBeanDeserializer()` function in the `BeanDeserializerFactory` class allows untrusted Java objects to be deserialized. A remote attacker can exploit this by uploading a malicious serialized object that will result in RCE if the application attempts to deserialize it. Note: This vulnerability exists due to the incomplete fix for CVE-2017-7525, CVE-2017-15095, CVE-2017-17485, CVE-2018-5968, CVE-2018-7489, CVE-2018-11307, CVE-2018-12022, CVE-2018-12023, CVE-2018-14718, CVE-2018-14719, CVE-2018-14720, and CVE-2018-14721. Evidence of this can be found at https://pivotal.io/security/cve-2017-4995. The application is vulnerable by using this component, when default typing is enabled and passing in untrusted data to be deserialization.	N/A
multicloud-framework-artifactbroker	com.fasterxml.jackson.core	CVE-2019-12086	Ineffective	False Positive - we are not using any DurationDeserializer or InstantDeserializer.	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation. The `jackson-databind` component contains an Insecure Deserialization Vulnerability. The `validateSubType()` function in the `SubTypeValidator` class allows untrusted input to be deserialized as a `com.mysql.cj.jdbc.admin.MiniAdmin` instance. A remote attacker can exploit this behavior by submitting a crafted JSON payload to a deserializing endpoint that uses `jackson-databind`. The attacker's deserialized Java object may then create a connection with an attacker controlled MySql server. When running a `mysql-connector-java` jar versioned 8.0.14 and earlier, the attacker's MySql server may read arbitrary files accessible by the vulnerable application when the connection is established. The application is vulnerable by using this component if a `mysql-connector-java` jar versioned 8.0.14 or lower is in the classpath while Default Typing is enabled.
multicloud-framework-artifactbroker	commons-codec	N/A	Ineffective	False Positive Its not direct dependency and is caused via 3rd party lib dependency. And it does not harm anyway to atifactbtoker.	The Apache `commons-codec` package contains an Improper Input Validation vulnerability. The `decode()` method in the `Base32`, `Base64`, and `BCodec` classes fails to reject malformed Base32 and Base64 encoded strings and consequently decodes them into arbitrary values. A remote attacker can leverage this vulnerability to potentially tunnel additional information via seemingly legitimate Base32 or Base64 encoded strings.
multicloud-framework-artifactbroker	commons-codec	N/A	Ineffective	False Positive Its not direct dependency and is caused via 3rd party lib dependency. And it does not harm anyway to atifactbtoker.	The Apache `commons-codec` package contains an Improper Input Validation vulnerability. The `decode()` method in the `Base32`, `Base64`, and `BCodec` classes fails to reject malformed Base32 and Base64 encoded strings and consequently decodes them into arbitrary values. A remote attacker can leverage this vulnerability to potentially tunnel additional information via seemingly legitimate Base32 or Base64 encoded strings.
multicloud-framework-artifactbroker	org.eclipse.jetty	CVE-2019-10241	Ineffective	False Positive, Jetty is merely a runtime container for artifactbroker, and it's not a direct dependency for artifactbroke. Thus, Jetty will not harm anyway to atifactbtoker.	In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents. The `jetty` package is vulnerable to Cross-Site Scripting (XSS). The `sendDirectory()` function in `ResourceService.class` and `DefaultServlet.class` files and the `doDirectory()` function in the `ResourceHandler.class` file use the `getListHTML()` function in the `Resource.class` file to fetch resource list as an HTML directory listing. This allows any JavaScript present in the list items to get fetched and rendered without proper sanitization of user-supplied input, leading to XSS.
multicloud-framework-artifactbroker	org.eclipse.jetty	CVE-2019-10247 CVE-2019-8331	Ineffective	False Positive, Jetty is merely a runtime container for artifactbroker, and it's not a direct dependency for artifactbroke. Thus, Jetty will not harm anyway to atifactbtoker.	In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context. The `jetty` package is vulnerable to sensitive Information Exposure. The `handle()` method of the `DefaultHandler.class` file discloses sensitive information via the `context` object. The method outputs the value of `context.toString()` within the error responses which will reveal the base resource path of each `context`.
multicloud-framework-artifactbroker	org.eclipse.jetty	CVE-2019-10241	Ineffective	False Positive, Jetty is merely a runtime container for artifactbroker, and it's not a direct dependency for artifactbroke. Thus, Jetty will not harm anyway to atifactbtoker.	In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents. The `jetty` package is vulnerable to Cross-Site Scripting (XSS). The `sendDirectory()` function in `ResourceService.class` and `DefaultServlet.class` files and the `doDirectory()` function in the `ResourceHandler.class` file use the `getListHTML()` function in the `Resource.class` file to fetch resource list as an HTML directory listing. This allows any JavaScript present in the list items to get fetched and rendered without proper sanitization of user-supplied input, leading to XSS.
multicloud-framework-artifactbroker	org.eclipse.jetty	CVE-2019-10246	Ineffective	False Positive, Jetty is merely a runtime container for artifactbroker, and it's not a direct dependency for artifactbroke. Thus, Jetty will not harm anyway to atifactbtoker.	In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories. The `jetty-util` package running on Windows is vulnerable to sensitive Information Exposure. The `getListHTML()` method of the `Resource.class` file reveals the resource base path as it does not properly generate HTML content and includes the base path in the result.

Repository	Group	Problem Code	Effective/Ineffective	Resolvable by Project	Impact Analysis
multicloud-framework-multivimbroker	Django	CVE-2019-1423 4	Ineffective	postgres (django.contrib.postgres.fields.JSONField) is not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
multicloud-framework-multivimbroker	Django	N/A	Ineffective	multicloud services exposes API response, MIME is not used at all	The `Django` package is vulnerable to Cross-Site Scripting (XSS). The `global_settings.py` file sets the `SECURE_CONTENT_TYPE_NOSNIFF` security header to `False` by default, allowing browsers to sniff the content types of assets being fetched from a server. A remote attacker who can place input in a non-executable MIME type can exploit this behavior to trick a victim's browser into rendering the response as an executable MIME type with arbitrary content.
multicloud-framework-multivimbroker	Django	N/A	Ineffective	multicloud services exposes API response, MIME is not used at all	The `Django` package is vulnerable to Cross-Site Scripting (XSS). The `global_settings.py` file sets the `SECURE_CONTENT_TYPE_NOSNIFF` security header to `False` by default, allowing browsers to sniff the content types of assets being fetched from a server. A remote attacker who can place input in a non-executable MIME type can exploit this behavior to trick a victim's browser into rendering the response as an executable MIME type with arbitrary content.
multicloud-framework-multivimbroker	Django	N/A	Ineffective	MultiCloud services have been designed to be a mediation layer , hence does not authenticate clients which should be the responsibility of consumers of multicloud services.	Django - Cross-Site Request Forgery (CSRF) Project: https://docs.djangoproject.com/en/dev/releases/3.0/#security
multicloud-framework-multivimbroker	Django	N/A	Ineffective	MultiCloud services have been designed to be a mediation layer , hence does not authenticate clients which should be the responsibility of consumers of multicloud services.	Django - Cross-Site Request Forgery (CSRF) Project: https://docs.djangoproject.com/en/dev/releases/3.0/#security
multicloud-framework-multivimbroker	Django	N/A	Ineffective	MultiCloud services have been designed to be a mediation layer , hence does not authenticate clients which should be the responsibility of consumers of multicloud services.	The `Django` package is vulnerable to Clickjacking. The `global_settings.py` file and the `get_xframe_options_value` function in `clickjacking.py` by default allowed the site to be framed by the same origin. An attacker who is able to generate content on the same origin as the vulnerable site could use this to social engineer users into interacting with functionality unintentionally.
multicloud-framework-multivimbroker	Django	N/A	Ineffective	MultiCloud services have been designed to be a mediation layer , hence does not authenticate clients which should be the responsibility of consumers of multicloud services.	The `Django` package is vulnerable to Clickjacking. The `global_settings.py` file and the `get_xframe_options_value` function in `clickjacking.py` by default allowed the site to be framed by the same origin. An attacker who is able to generate content on the same origin as the vulnerable site could use this to social engineer users into interacting with functionality unintentionally.
multicloud-framework-multivimbroker	Django	CVE-2019-1423 4	Ineffective	postgres (django.contrib.postgres.fields.JSONField) is not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
multicloud-framework-multivimbroker	Django	CVE-2019-1423 2	Ineffective	django.utils.text.Truncator is not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
multicloud-framework-multivimbroker	Django	CVE-2019-1423 2	Ineffective	django.utils.text.Truncator is not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
multicloud-framework-multivimbroker	Django	CVE-2019-1423 3	Ineffective	HTMLParser, django.utils.html.strip_tags are not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
multicloud-framework-multivimbroker	Django	CVE-2019-1423 3	Ineffective	HTMLParser, django.utils.html.strip_tags are not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
multicloud-framework-multivimbroker	Django	CVE-2019-1423 5	Ineffective	django.utils.encoding.uri_to_iri is not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
multicloud-framework-multivimbroker	Django	CVE-2019-1423 5	Ineffective	django.utils.encoding.uri_to_iri is not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
multicloud-framework-multivimbroker	djangorestframework	CVE-2019-8331	Ineffective	bootstrap is not used, hence false positive	In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
multicloud-framework-multivimbroker	djangorestframework	CVE-2019-11358	Ineffective	`jquery` is not used, hence false positive	The `jquery` package is vulnerable to Prototype Pollution. The `jQuery.extend` and `jQuery.fn.extend` functions defined in many files allow an untrusted object to extend `Object.prototype`. An attacker can modify and add prototype properties to JavaScript objects and can potentially leverage those changes to crash the application or execute remote code.
multicloud-framework-multivimbroker	djangorestframework	CVE-2019-8331	Ineffective	bootstrap is not used, hence false positive	In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
multicloud-framework-multivimbroker	djangorestframework	CVE-2019-11358	Ineffective	`jquery` is not used, hence false positive	The `jquery` package is vulnerable to Prototype Pollution. The `jQuery.extend` and `jQuery.fn.extend` functions defined in many files allow an untrusted object to extend `Object.prototype`. An attacker can modify and add prototype properties to JavaScript objects and can potentially leverage those changes to crash the application or execute remote code.
multicloud-framework-multivimbroker	Django	N/A	Ineffective	`qunit.js` is not used, hence false positive	The qunit package is vulnerable to Cross-Site Scripting (XSS). The `testDone` function in `qunit.js` shows the source of tests in HTML. An attacker is able to provide a malicious unit test could exploit this behavior to execute arbitrary JavaScript in the browser of a victim who views the results of that unit test.

Repository	Group	Problem Code	Effective/Ineffective	Resolvable by Project	Impact Analysis
multicloud-openstack	Django	CVE-2019-1423 4	Ineffective	postgres (django.contrib.postgres.fields.JSONField) is not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
multicloud-openstack	Django	CVE-2019-1423 4	Ineffective	postgres (django.contrib.postgres.fields.JSONField) is not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
multicloud-openstack	Django	N/A	Ineffective	`jquery` is not used, hence false positive	The `jquery` package is vulnerable to Prototype Pollution. The `jQuery.extend` and `jQuery.fn.extend` functions defined in many files allow an untrusted object to extend `Object.prototype`. An attacker can modify and add prototype properties to JavaScript objects and can potentially leverage those changes to crash the application or execute remote code.
multicloud-openstack	Django	N/A	Ineffective	`jquery` is not used, hence false positive	The `jquery` package is vulnerable to Prototype Pollution. The `jQuery.extend` and `jQuery.fn.extend` functions defined in many files allow an untrusted object to extend `Object.prototype`. An attacker can modify and add prototype properties to JavaScript objects and can potentially leverage those changes to crash the application or execute remote code.
multicloud-openstack	Django	CVE-2019-1423 2	Ineffective	django.utils.text.Truncator is not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
multicloud-openstack	Django	CVE-2019-1423 2	Ineffective	django.utils.text.Truncator is not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
multicloud-openstack	Django	CVE-2019-1423 3	Ineffective	HTMLParser, django.utils.html.strip_tags are not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
multicloud-openstack	Django	CVE-2019-1423 3	Ineffective	HTMLParser, django.utils.html.strip_tags are not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
multicloud-openstack	Django	CVE-2019-1423 5	Ineffective	django.utils.encoding.uri_to_iri is not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
multicloud-openstack	Django	CVE-2019-1423 5	Ineffective	django.utils.encoding.uri_to_iri is not used, hence false positive	An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
multicloud-openstack	djangorestframework	CVE-2019-8331	Ineffective	bootstrap is not used, hence false positive	In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
multicloud-openstack	djangorestframework	CVE-2019-8331	Ineffective	bootstrap is not used, hence false positive	In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
multicloud-openstack	httplib2	N/A	Ineffective	`httplib2.connect is not used, hence false positive`	The `httplib2` package is vulnerable to Improper Validation of Certificate with Host Mismatch. The `connect()` function in the `_init_.py` file fails to properly validate hostnames of SSL certificates. An attacker can exploit this vulnerability by executing a Man-in-the-Middle (MitM) attack in order to intercept requests and provide a valid attacker-controlled certificate to the client. This allows the attacker to decrypt, read, and modify data in transit, thus effectively spoofing the vulnerable server.
multicloud-openstack	httplib2	N/A	Ineffective	`httplib2.connect is not used, hence false positive`	The `httplib2` package is vulnerable to Improper Validation of Certificate with Host Mismatch. The `connect()` function in the `_init_.py` file fails to properly validate hostnames of SSL certificates. An attacker can exploit this vulnerability by executing a Man-in-the-Middle (MitM) attack in order to intercept requests and provide a valid attacker-controlled certificate to the client. This allows the attacker to decrypt, read, and modify data in transit, thus effectively spoofing the vulnerable server.
multicloud-openstack	Django	N/A	Ineffective	`qunit.js` is not used, hence false positive	The qunit package is vulnerable to Cross-Site Scripting (XSS). The `testDone` function in `qunit.js` shows the source of tests in HTML. An attacker is able to provide a malicious unit test could exploit this behavior to execute arbitrary JavaScript in the browser of a victim who views the results of that unit test.

Repository	Group	Problem Code	Effective/Ineffective	Resolvable by Project	Impact Analysis
multicloud-openstack-vmware	Django	N/A	Ineffective	multicloud services exposes API response, MIME is not used at all	The `Django` package is vulnerable to Cross-Site Scripting (XSS). The `global_settings.py` file sets the `SECURE_CONTENT_TYPE_NOSNIFF` security header to `False` by default, allowing browsers to sniff the content types of assets being fetched from a server. A remote attacker who can place input in a non-executable MIME type can exploit this behavior to trick a victim's browser into rendering the response as an executable MIME type with arbitrary content.
multicloud-openstack-vmware	Django	N/A	Ineffective	MultiCloud services have been designed to be a mediation layer , hence does not authenticate clients which should be the responsibility of consumers of multicloud services.	Django - Cross-Site Request Forgery (CSRF) Project: https://docs.djangoproject.com/en/dev/releases/3.0/#security
multicloud-openstack-vmware	Django	N/A	Ineffective	MultiCloud services have been designed to be a mediation layer , hence does not authenticate clients which should be the responsibility of consumers of multicloud services.	The `Django` package is vulnerable to Clickjacking. The `global_settings.py` file and the `get_xframe_options_value` function in `clickjacking.py` by default allowed the site to be framed by the same origin. An attacker who is able to generate content on the same origin as the vulnerable site could use this to social engineer users into interacting with functionality unintentionally.
multicloud-openstack-vmware	Django	N/A	Ineffective	multicloud services exposes API response, MIME is not used at all	The `Django` package is vulnerable to Cross-Site Scripting (XSS). The `global_settings.py` file sets the `SECURE_CONTENT_TYPE_NOSNIFF` security header to `False` by default, allowing browsers to sniff the content types of assets being fetched from a server. A remote attacker who can place input in a non-executable MIME type can exploit this behavior to trick a victim's browser into rendering the response as an executable MIME type with arbitrary content.
multicloud-openstack-vmware	Django	N/A	Ineffective	MultiCloud services have been designed to be a mediation layer , hence does not authenticate clients which should be the responsibility of consumers of multicloud services.	Django - Cross-Site Request Forgery (CSRF) Project: https://docs.djangoproject.com/en/dev/releases/3.0/#security
multicloud-openstack-vmware	Django	N/A	Ineffective	`qunit.js` is not used, hence false positive	The qunit package is vulnerable to Cross-Site Scripting (XSS). The `testDone` function in `qunit.js` shows the source of tests in HTML. An attacker is able to provide a malicious unit test could exploit this behavior to execute arbitrary JavaScript in the browser of a victim who views the results of that unit test.
multicloud-openstack-vmware	Django	N/A	Ineffective	MultiCloud services have been designed to be a mediation layer , hence does not authenticate clients which should be the responsibility of consumers of multicloud services.	The `Django` package is vulnerable to Clickjacking. The `global_settings.py` file and the `get_xframe_options_value` function in `clickjacking.py` by default allowed the site to be framed by the same origin. An attacker who is able to generate content on the same origin as the vulnerable site could use this to social engineer users into interacting with functionality unintentionally.