Paul Mcmillan

An issue exists in the `get signed cookie()` function within `django.http.HttpRequest`. The function employs a non-injective salt derivation by concatenating the cookie name and the salt argument. This allows a remote attacker to use a cookie in a context different from its original signing context by utilizing distinct `name` and `salt` pairs that result in the same concatenated string.

The issue concerns a middleware memcache encryption bypass in the python-keystoneclient. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The issue concerns a middleware memcache signing bypass in the python-keystoneclient.

The issue concerns the transmission of a cookie in an https session. Specifically, the cookie does not have the secure flag set, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

The issue allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location.

The caching framework in Django reuses a cached CSRF token for all anonymous users. This allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.

The issue is related to the `verify exists` functionality in the `URLField` implementation, which relies on Python libraries that attempt to access an arbitrary URL with no timeout. This allows remote attackers to cause a denial of service by consuming resources via a URL associated with a slow response, a completed TCP connection with no application data sent, or a large amount of application data.

A directory traversal issue might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.