alo7-airflow (>=1.10.0, <=1.10.0.7), cateye (>=0.3.4, <=0.3.6) +1 more potentially affected by CVE-2018-7753 via bleach (>=2.1.0, <=2.1.2)

bleach PYPI version =2.1.0, =1.10.0, =0.3.4, =0.3.6 - protobuf-compiler 1.0.20 Source cves: CVE-2018-7753 Source advisory: MEND:CVE-2018-7753...

CVE-2018-7753

Bleach 2.1.x before 2.1.3 contains a URI sanitization flaw: attributes with URI values that include character entities could bypass the allowed-scheme check, allowing a disallowed scheme to pass through unsanitized. Affected: Bleach 2.1.x (prior to 2.1.3). Impact noted across multiple advisories ...

CVE-2018-7753

An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized...

PT-2018-18257

Name of the Vulnerable Software and Affected Versions: Bleach versions 2.1.x before 2.1.3 Description: An issue was discovered where attributes with URI values were not properly sanitized if the values contained character entities. This allowed for the construction of a URI value with a scheme th...

CVE-2018-7753: Improper Input Validation

An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized...

py-bleach -- unsanitized character entities

bleach developer reports: Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized. This security issue was...

asc (>=0.1.0, <=0.3.1), bleach (1.5.0) +49 more potentially affected by CVE-2016-9909 via html5lib (>=0.95.0, <=0.9999999.0)

html5lib PYPI version =0.95.0, =0.1.0, =0.1.3, =0.2.1, =2.0.0b7, =3.0.14, =0.9.0, =2.5.0b1, =2.1.13, =0.0.1, =0.2.0, =0.36.0 - glamkit-sponsors 0.5.0 and more Source cves: CVE-2016-9909 Source advisory: MEND:CVE-2016-9909...

asc (>=0.1.0, <=0.3.1), bleach (1.5.0) +49 more potentially affected by CVE-2016-9910 via html5lib (>=0.95.0, <=0.9999999.0)

html5lib PYPI version =0.95.0, =0.1.0, =0.1.3, =0.2.1, =2.0.0b7, =3.0.14, =0.9.0, =2.5.0b1, =2.1.13, =0.0.1, =0.2.0, =0.36.0 - glamkit-sponsors 0.5.0 and more Source cves: CVE-2016-9910 Source advisory: MEND:CVE-2016-9910...

BLEACH Brave Souls - Dynamic Code Loading, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application BLEACH Brave Souls published at the 'play' market has multiple vulnerabilities...

Regular Expression Denial of Service

Overview All versions of the bleach package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. Recommendation The bleach package is not currently maintained, and has not seen an update since 2014. To mitigate this...