gitsafehub
github.com/itamarhaber/django-after-response ↗

itamarhaber/django-after-response

scanned 2026-08-11 · git d387599
1 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies✓Known OSS vulnerabilities42Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ none found ✓

Packages you depend on that have known security holes (CVEs).

Nothing found by this check. ✓

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 42 found · 6 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2014-1 The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Pytho
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2014-0472). Fix: Update that package to its patched version.
  • Serious PYSEC-2014-19 Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attacker
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2014-1418). Fix: Update that package to its patched version.
  • Serious PYSEC-2014-3 The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properl
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2014-0474). Fix: Update that package to its patched version.
  • Serious PYSEC-2019-16 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2019-19844). Fix: Update that package to its patched version.
  • Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious GHSA-hmr4-m2h5-33qx SQL injection in Django
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2020-7471). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2013-18 The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption)
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2013-1443). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2013-19 Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitr
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2013-4249). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2013-20 Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_R
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2013-4315). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2013-21 The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce c
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2013-6044). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2014-2 The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2014-0473). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2014-20 The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduc
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2014-3730). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2014-4 The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attacker
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2014-0480). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2014-5 The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2014-0481). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2014-6 The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.Re
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2014-0482). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2014-7 The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship bet
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2014-0483). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2015-10 Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP r
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2015-5144). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2015-20 The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multi
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2015-5143). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2015-8 Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a m
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2015-2241). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2015-9 The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to co
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2015-2317). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2016-15 The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cro
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2016-2512). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2016-2 Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2016-6186). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2016-3 The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting a
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2016-7401). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-98 Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the exist
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2021-33203). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1297 Django allows enumeration of user e-mail addresses
    /workdirs/scan-e1283e7f-cb79-447a-bc5c-f597348dfcd6/requirements.txt
    A package you depend on has a known security hole (CVE-2024-45231). Fix: Update that package to its patched version.
… 17 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.