CVE-2020-17495

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/celery/django-celery-results/issues/142Third Party Advisory
https://github.com/celery/django-celery-results/issues/142Third Party Advisory

Timeline

Published: Aug 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-174969.8vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel CVE-2020-174978.1eapol.c in iNet wireless daemon (IWD) through 1.8 allows attackers to trigger a PTK reinstallation by retransmitting EAPOL Msg4/4.CVE-2020-174986.5In Wireshark 3.2.0 to 3.2.5, the Kafka protocol dissector could crash. This was addressed in epan/dissectors/packet-kafka.c by avoiding a do CVE-2020-17506.5A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amoun CVE-2020-175009.8Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 of 4). The NDN-210 has CVE-2020-175027.2Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). The NDN-210 has a web administration panel which is made available ove CVE-2020-175037.2The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authentica CVE-2020-175047.2The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authentica CVE-2020-175058.8Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These c CVE-2020-175069.8Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQ CVE-2020-175075.3An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buff CVE-2020-175087.5The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic Server versions 7.0.0