Natalia Bidart

Server-side file-write and request forgery via spatial lookups

Potential denial-of-service vulnerability in check_for_language()

Potential denial-of-service vulnerability via nested geometry collections

Potential cross-site scripting via URLField values in the admin

Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows

Potential exposure of private data via cached Set-Cookie response

Header injection possibility since DomainNameValidator accepted newlines in input

Potential exposure of private data via whitespace padding in Vary header

Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware

Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware