{
    "django": [
        {
            "advisory": "The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \\x08javascript: URL.",
            "cve": "CVE-2015-2317",
            "id": "pyup.io-25713",
            "specs": [
                ">=1.8,<1.8.2",
                "<1.4.20",
                ">=1.5,<1.6",
                ">=1.6,<1.6.11",
                ">=1.7,<1.7.7"
            ],
            "v": ">=1.8,<1.8.2,<1.4.20,>=1.5,<1.6,>=1.6,<1.6.11,>=1.7,<1.7.7"
        },
        {
            "advisory": "Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.",
            "cve": "CVE-2016-6186",
            "id": "pyup.io-25721",
            "specs": [
                ">=1.9,<1.9.8",
                "==1.8.14",
                ">=1.10,<1.10.2"
            ],
            "v": ">=1.9,<1.9.8,==1.8.14,>=1.10,<1.10.2"
        }
    ]
}
