Jacob Walls

Potential denial-of-service vulnerability via nested geometry collections

Server-side file-write and request forgery via spatial lookups

Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware

Potential SQL injection via QuerySet.order_by and FilteredRelation

Potential SQL injection in column aliases via control characters

Potential SQL injection via raster lookups on PostGIS

Potential exposure of private data via cached Set-Cookie response

Heap buffer over-read in GDALRaster

Header injection possibility since DomainNameValidator accepted newlines in input

Privilege abuse in GenericInlineModelAdmin