Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveMitreCVE-2018-19787
HistoryDec 02, 2018 - 10:29 a.m.

CVE-2018-19787

2018-12-0210:29:00
CWE-79
mitre
web.nvd.nist.gov
230
lxml
security
vulnerability
xss
cve-2018-19787
nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.013

Percentile

86.0%

JSON

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by “j a v a s c r i p t:” in Internet Explorer. This is a similar issue to CVE-2014-3146.

Affected configurations

Nvd
Node
lxmllxmlRange<4.2.5
Node
debiandebian_linuxMatch8.0
Node
canonicalubuntu_linuxMatch12.04esm
OR
canonicalubuntu_linuxMatch14.04lts
OR
canonicalubuntu_linuxMatch16.04lts
OR
canonicalubuntu_linuxMatch18.04lts
VendorProductVersionCPE
lxmllxml*cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:*
debiandebian_linux8.0cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
canonicalubuntu_linux12.04cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
canonicalubuntu_linux14.04cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
canonicalubuntu_linux16.04cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
canonicalubuntu_linux18.04cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Related

redhatcve 1
nessus 31
osv 8
openvas 26
nvd 2
debian 5
ubuntucve 2
prion 2
debiancve 2
cvelist 2
github 2
veracode 1
ubuntu 3
cbl_mariner 2
fedora 2
mageia 2
suse 1
cve 1
exploitdb 1
photon 2
securityvulns 1
ibm 1
redhatcve
redhatcve
CVE-2018-19787
2018-12-17 23:08:11
nessus
nessus
RHEL 5 : python-lxml (Unpatched Vulnerability)
2024-06-03 00:00:00
RHEL 6 : python-lxml (Unpatched Vulnerability)
2024-06-03 00:00:00
Debian DLA-1604-1 : lxml security update
2018-12-11 00:00:00
osv
osv
CVE-2018-19787
2018-12-02 10:29:00
PYSEC-2018-12
2018-12-02 10:29:00
Improper Neutralization of Input During Web Page Generation in LXML
2022-05-13 01:13:21
openvas
openvas
Huawei EulerOS: Security Advisory for python-lxml (EulerOS-SA-2020-2235)
2020-10-21 00:00:00
Huawei EulerOS: Security Advisory for python-lxml (EulerOS-SA-2020-2529)
2020-12-15 00:00:00
Huawei EulerOS: Security Advisory for python-lxml (EulerOS-SA-2021-1352)
2021-02-22 00:00:00
nvd
nvd
CVE-2018-19787
2018-12-02 10:29:00
CVE-2014-3146
2014-05-14 19:55:11
debian
debian
[SECURITY] [DLA 1604-1] lxml security update
2018-12-10 08:47:41
[SECURITY] [DLA 2467-1] lxml security update
2020-11-26 18:32:53
lxml security update
2014-06-26 17:10:22
ubuntucve
ubuntucve
CVE-2018-19787
2018-12-02 00:00:00
CVE-2014-3146
2014-05-14 00:00:00
prion
prion
Design/Logic Flaw
2018-12-02 10:29:00
Cross site scripting
2014-05-14 19:55:00
debiancve
debiancve
CVE-2018-19787
2018-12-02 10:29:00
CVE-2014-3146
2014-05-14 19:55:11
cvelist
cvelist
CVE-2018-19787
2018-12-02 10:00:00
CVE-2014-3146
2014-05-14 19:00:00
github
github
Improper Neutralization of Input During Web Page Generation in LXML
2022-05-13 01:13:21
lxml Cross-site Scripting Via Control Characters
2022-05-14 04:01:59
veracode
veracode
Cross-Site Scripting (XSS)
2018-09-19 01:17:20
ubuntu
ubuntu
lxml vulnerability
2018-12-10 00:00:00
lxml vulnerability
2018-12-10 00:00:00
lxml vulnerability
2014-05-21 00:00:00
cbl_mariner
cbl_mariner
CVE-2018-19787 affecting package python-lxml 4.2.4-7
2021-08-11 06:39:25
CVE-2018-19787 affecting package python-lxml for versions less than 4.8.0-1
2022-04-26 19:57:36
fedora
fedora
[SECURITY] Fedora 28 Update: python-lxml-4.2.5-1.fc28
2019-01-03 02:27:09
[SECURITY] Fedora 29 Update: python-lxml-4.2.5-1.fc29
2018-12-21 19:42:19
mageia
mageia
Updated python-lxml packages fix security vulnerability
2019-01-01 01:42:09
Updated python-lxml package fix CVE-2014-3146
2014-05-15 02:10:47
suse
suse
Security update for python-lxml (important)
2022-03-10 00:00:00
cve
cve
CVE-2014-3146
2014-05-14 19:55:11
exploitdb
exploitdb
lxml - &#039;clean_html&#039; Security Bypass
2014-04-15 00:00:00
photon
photon
Critical Photon OS Security Update - PHSA-2022-0406
2022-06-17 00:00:00
Important Photon OS Security Update - PHSA-2022-3.0-0406
2022-06-17 00:00:00
securityvulns
securityvulns
Web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;
2014-05-10 00:00:00
ibm
ibm
Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities
2024-05-09 12:31:16

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.013

Percentile

86.0%

JSON
Related for CVE-2018-19787
redhatcve1nessus31osv8openvas26nvd2debian5ubuntucve2prion2debiancve2cvelist2github2veracode1ubuntu3cbl_mariner2fedora2mageia2suse1cve1exploitdb1photon2securityvulns1ibm1