PYSEC-2021-865

In Mozilla Bleach before 3.3.0, a mutation XSS affects users calling bleach.clean with math or svg; p or br; and style, title, noscript, script, textarea, noframes, iframe, or xmp tags with stripcomments=False...

abracadabra (>=0.0.0, <=0.0.5), adversarial-labeller (0.1.8) +162 more potentially affected by CVE-2021-23980 via bleach (>=3.0.1, <=3.2.3)

bleach PYPI version =3.0.1, =0.0.0, =1.0.0, =0.0.1, =0.0.6, =0.3.0, =0.0.9, =0.0.5, =0.1.0rc1, =0.0.1, =0.0.19, =0.0.26 - coopgraph 0.2.0 and more Source cves: CVE-2021-23980 Source advisory: OSV:PYSEC-2021-865...

PT-2021-3336

Name of the Vulnerable Software and Affected Versions Bleach versions prior to 3.3.0 Description A mutation XSS affects users calling bleach.clean with specific allowed tags and the keyword argument strip comments=False. This issue may allow a remote attacker to impact the confidentiality and...

bleach:linkify_fuzzer: Uncaught exception in generateImpliedEndTags

Detailed Report: https://oss-fuzz.com/testcase?key=5014421988573184 Project: bleach Fuzzing Engine: libFuzzer Fuzz Target: linkifyfuzzer Job Type: libfuzzerasanbleach Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: generateImpliedEndTags generateImpliedEndTags...

bleach:sanitize_fuzzer: Uncaught exception in convert_entity

Project: https://github.com/mozilla/bleach.git Detailed Report: https://oss-fuzz.com/testcase?key=6267753038217216 Project: bleach Fuzzing Engine: libFuzzer Fuzz Target: sanitizefuzzer Job Type: libfuzzerasanbleach Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

bleach:linkify_fuzzer: Uncaught exception in convert_entity

Project: https://github.com/mozilla/bleach.git Detailed Report: https://oss-fuzz.com/testcase?key=5206680075894784 Project: bleach Fuzzing Engine: libFuzzer Fuzz Target: linkifyfuzzer Job Type: libfuzzerubsanbleach Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

bleach:linkify_fuzzer: Uncaught exception in convert_entity

Project: https://github.com/mozilla/bleach.git Detailed Report: https://oss-fuzz.com/testcase?key=5635626013687808 Project: bleach Fuzzing Engine: libFuzzer Fuzz Target: linkifyfuzzer Job Type: libfuzzerasanbleach Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

Fedora: Security Advisory for python-bleach (FEDORA-2020-e0f35d634c)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 33 Update: python-bleach-3.2.1-1.fc33

Bleach is an HTML sanitizing library that escapes or strips markup and attributes based on a white list...

Cross-Site Scripting in bleach

All versions of bleach are vulnerable to Cross-Site Scripting. It is possible to bypass the package's HTML sanitization with payloads such as "scriptalert'xss';script" regardless of the passed options. This may allow attackers to execute arbitrary JavaScript in the victim's browser. Recommendatio...

docpad-plugin-posteditor (>=2.0.0, <=2.1.2) potentially affected by unknown CVE via bleach (0.3.0)

bleach NPM version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - docpad-plugin-posteditor =2.0.0, =2.1.2 Source cves: unknown CVE Source advisory: OSV:GHSA-5634-RV46-48JF...

GHSA-5634-RV46-48JF Cross-Site Scripting in bleach

All versions of bleach are vulnerable to Cross-Site Scripting. It is possible to bypass the package's HTML sanitization with payloads such as "scriptalert'xss';script" regardless of the passed options. This may allow attackers to execute arbitrary JavaScript in the victim's browser. Recommendatio...

PT-2020-21047

Name of the Vulnerable Software and Affected Versions bleach versions affected versions not specified Description The issue allows attackers to bypass the package's HTML sanitization, potentially leading to Cross-Site Scripting XSS attacks. This can be achieved with specific payloads, such as...

Regular Expression Denial of Service in bleach

All versions of the bleach package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. Recommendation The bleach package is not currently maintained, and has not seen an update since 2014. To mitigate this issue, it is...

docpad-plugin-posteditor (>=2.0.0, <=2.1.2) potentially affected by CVE-2014-8881 via bleach (0.3.0)

bleach NPM version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - docpad-plugin-posteditor =2.0.0, =2.1.2 Source cves: CVE-2014-8881 Source advisory: OSV:GHSA-MVMF-CVFX-QG55...

GHSA-MVMF-CVFX-QG55 Regular Expression Denial of Service in bleach

All versions of the bleach package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. Recommendation The bleach package is not currently maintained, and has not seen an update since 2014. To mitigate this issue, it is...

PT-2020-7757

Name of the Vulnerable Software and Affected Versions bleach affected versions not specified Description The issue concerns a regular expression denial of service attack that can occur when certain types of input are passed into the sanitize function. Recommendations To mitigate this issue,...

Security Bulletin: A security vulnerability has been identified in Bleach shipped with IBM Watson Machine Learning Community Edition (WMLCE)

Summary Multiple vulnerabilities have been found in the Bleach package, which is either built in to or distributed with IBM WMLCE. Vulnerability Details CVEID: CVE-2020-6816 DESCRIPTION: Mozilla Bleach is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by...

python-bleach HTML Cleaning Data Compromise

The vulnerability of the Python-bleach library for cleaning HTML blacklists is related to an error in adding the same word to a blacklist. Exploiting this vulnerability could allow an attacker to compromise data integrity...

Fedora: Security Advisory for python-bleach (FEDORA-2020-e1fa96c506)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...