55 matches found
Fedora 30 : python-bleach (2020-827b677e15)
Update to version 3.1.4, an upstream security release. See the upstream changelog for details. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as...
Fedora: Security Advisory for python-bleach (FEDORA-2020-827b677e15)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
DEBIAN-CVE-2020-6802
In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option...
CVE-2020-6802
Mozilla Bleach prior to 3.11 is vulnerable to mutation XSS via bleach.clean when noscript and a raw tag are allowed/whitelisted. A remote attacker could inject script into a page viewed in a browser (impact: carry out client-side script execution). Remediation observed in multiple sources shows u...
openSUSE Security Update : python-bleach (openSUSE-2020-308)
This update for python-bleach to version 3.1.1 fixes the following issue : - Python-bleach was updated to 3.1.1 - CVE-2020-6802: Fixed mutation XSS vulnerabilities boo1165303. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...
Security update for python-bleach (important)
openSUSE Security Update: Security update for python-bleach Announcement ID: openSUSE-SU-2020:0325-1 Rating: important References: 1165303 Cross-References: CVE-2020-6802 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes one vulnerability is now available. Description: This...
openSUSE: Security Advisory for python-bleach (openSUSE-SU-2020:0308-1)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Security update for python-bleach (important)
openSUSE Security Update: Security update for python-bleach Announcement ID: openSUSE-SU-2020:0308-1 Rating: important References: 1165303 Cross-References: CVE-2020-6802 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for...
Updated python-bleach packages fix security vulnerability
The updated packages fix a security vulnerability: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. CVE-2020-6802...
Debian DSA-4636-1 : python-bleach - security update
It was reported that python-bleach, a whitelist-based HTML-sanitizing library, is prone to a mutation XSS vulnerability in bleach.clean when'noscript' and one or more raw text tags were whitelisted. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
adversarial-labeller (=0.1.8), alo7-airflow (>=1.10.0 <=1.10.0.7) +113 more potentially affected by CVE-2020-6802 via bleach (>=1.2.2 <=3.1.0)
bleach PYPI version =1.2.2, =1.10.0, =0.1.0, =0.0.6, =0.3.0, =0.3.4, =0.0.5, =0.1.3, =0.0.1, =0.2.1, =1.0.2, =0.1.2, =1.0.7 and more Source cves: CVE-2020-6802 Source advisory: OSV:GHSA-Q65M-PV3F-WR5R...
XSS in Bleach when noscript and raw tag whitelisted
Impact A mutation XSS affects users calling bleach.clean with noscript and a raw tag see below in the allowed/whitelisted tags option. Patches v3.1.1 Workarounds modify bleach.clean calls to not whitelist noscript and one or more of the following raw tags: title textarea script style noembed...
CVE-2019-6802
CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI...
CVE-2019-6802
CVE-2019-6802 affects pypiserver up to version 1.2.5, where an attacker can inject carriage return/line feed via a URI (%0d%0a) to set arbitrary HTTP headers and potentially trigger XSS. The root cause is CRLF injection in how certain inputs are handled, enabling header manipulation and possible ...
Debian: Security Advisory (DLA-878-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DLA-878-1 : libytnef security update
CVE-2017-6298 NULL pointer Deref / calloc return value not checked CVE-2017-6299 Infinite Loop / DoS in the TNEFFillMapi function in lib/ytnef.c CVE-2017-6300 Buffer Overflow in version field in lib/tnef-types.h CVE-2017-6301 Out of Bounds Reads CVE-2017-6302 Integer Overflow CVE-2017-6303 Invali...
CVE-2017-6802
CVE-2017-6802 applies to libytnef/ytnef (affecting ytnef prior to 1.9.2 and addressed in later releases). The issue is described as a heap-based over-read related to RTF stream decompression (DecompressRTF()) in libytnef, with related vulnerabilities in the same libytnef set (CVE-2017-6298..6306,...
UBUNTU-CVE-2017-6802
An issue was discovered in ytnef before 1.9.2. There is a potential heap-based buffer over-read on incoming Compressed RTF Streams, related to DecompressRTF in libytnef...
Fedora 25 : shiro (2016-2939d70cf4)
update to 1.3.2, security fix for CVE-2016-6802 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...
Fedora 24 : shiro (2016-744df45727)
update to 1.3.2, security fix for CVE-2016-6802 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...