CVE-2016-9013

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

• CWE-798

• http://www.debian.org/security/2017/dsa-3835
• http://www.securityfocus.com/bid/94069Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037159Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-3115-1Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
• https://www.djangoproject.com/weblog/2016/nov/01/security-releases/Release Notes, Vendor Advisory
• http://www.debian.org/security/2017/dsa-3835
• http://www.securityfocus.com/bid/94069Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037159Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-3115-1Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
• https://www.djangoproject.com/weblog/2016/nov/01/security-releases/Release Notes, Vendor Advisory

Published

Dec 9, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9006IBM UrbanCode Deploy 6.1 and 6.2 is vulnerable to cross-site…
• CVE-2016-9008IBM UrbanCode Deploy could allow a malicious user to access …
• CVE-2016-9009IBM WebSphere MQ 8.0 could allow an authenticated user with …
• CVE-2016-9010IBM WebSphere Message Broker 9.0 and 10.0 could allow a remo…
• CVE-2016-9011The wmf_malloc function in api.c in libwmf 0.2.8.4 allows re…
• CVE-2016-9012CloudVision Portal (CVP) before 2016.1.2.1 allows remote aut…
• CVE-2016-9014Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and …
• CVE-2016-9015Versions 1.17 and 1.18 of the Python urllib3 library suffer …
• CVE-2016-9016Firejail 0.9.38.4 allows local users to execute arbitrary co…
• CVE-2016-9017Artifex Software, Inc. MuJS before a5c747f1d40e8d6659a37a8d2…
• CVE-2016-9018Improper handling of a repeating VRAT chunk in qcpfformat.dl…
• CVE-2016-9019SQL injection vulnerability in the activate_address function…