Sarah Boyce

Server-side request forgery via crs member of GeoJSON geometries

Potential exposure of private data via empty and missing Vary headers

Server-side request forgery via SpatialReference string input

Potential denial-of-service vulnerability in get_supported_language_variant()

Potential denial-of-service vulnerability in HTTP header parsing

Potential request forgery via spatial lookup byte values

Privilege abuse in model formsets with editable primary keys

Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass

Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware

Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST