CVE-2014-0474

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting."

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-399

Affected software

No affected versions have been published.

Timeline

Published: Apr 23, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-04756.8Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass F CVE-2014-04763.7The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a CVE-2014-04775.0The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to c CVE-2014-04784.0APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse p CVE-2014-04796.8reportbug before 6.4.4+deb7u1 and 6.5.x before 6.5.0+nmu1 allows remote attackers to execute arbitrary commands via vectors related to compa CVE-2014-04805.8The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 d CVE-2014-04814.3The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 befor CVE-2014-04826.0The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before CVE-2014-04833.5The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candida CVE-2014-04847.2The Debian acpi-support package before 0.140-5+deb7u3 allows local users to gain privileges via vectors related to the "user's environment."CVE-2014-04857.5S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serial CVE-2014-04867.5Knot DNS before 1.5.2 allows remote attackers to cause a denial of service (application crash) via a crafted DNS message.