[SECURITY] [DLA 2620-1] python-bleach security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2620-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb April 06, 2021 https://wiki.debian.org/LTS -...

DLA-2620-1 python-bleach - security update

Bulletin has no description...

Python Bleach 跨站脚本漏洞

Python Bleach is a Python based HTML cleanup library. Python Bleach suffers from a cross-site scripting vulnerability that can be exploited by an attacker to trigger cross-site scripting in order to run JavaScript code in the context of a website...

Cross-site Scripting

bleach is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute malicious script by calling bleach.clean with all of 1 svg or math in the allowed tags 2 p or br in allowed tags 3style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags 4the...

python-bleach: Mutation cross-site scripting in bleach.clean

A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument stripcomments=False Note: none of the above tags are in the default allowe...

Cross-Site Scripting (XSS)

bleach is vulnerable to cross-site scripting XSS. Invocation of bleach.clean method with all of the allowed tags svg or math, p or br, style, title, noscript, script, textarea, noframes, iframe, or xmp and the keyword argument stripcomments=False will allow. the browser to mutate a harmless conte...

GHSA-VV2X-VRPJ-QQPQ Cross-site scripting in Bleach

Impact A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument stripcomments=False Note: none of the above tags are in the default...

Cross-site scripting in Bleach

Impact A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument stripcomments=False Note: none of the above tags are in the default...

PYSEC-2021-865

In Mozilla Bleach before 3.3.0, a mutation XSS affects users calling bleach.clean with math or svg; p or br; and style, title, noscript, script, textarea, noframes, iframe, or xmp tags with stripcomments=False...

PYSEC-2021-865

In Mozilla Bleach before 3.3.0, a mutation XSS affects users calling bleach.clean with math or svg; p or br; and style, title, noscript, script, textarea, noframes, iframe, or xmp tags with stripcomments=False...

Fedora: Security Advisory for python-bleach (FEDORA-2020-e0f35d634c)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 33 Update: python-bleach-3.2.1-1.fc33

Bleach is an HTML sanitizing library that escapes or strips markup and attributes based on a white list...

docpad-plugin-posteditor (>=2.0.0, <=2.1.2) potentially affected by unknown CVE via bleach (0.3.0)

bleach NPM version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - docpad-plugin-posteditor =2.0.0, =2.1.2 Source cves: unknown CVE Source advisory: OSV:GHSA-5634-RV46-48JF...

Cross-Site Scripting in bleach

All versions of bleach are vulnerable to Cross-Site Scripting. It is possible to bypass the package's HTML sanitization with payloads such as "scriptalert'xss';script" regardless of the passed options. This may allow attackers to execute arbitrary JavaScript in the victim's browser. Recommendatio...

GHSA-5634-RV46-48JF Cross-Site Scripting in bleach

All versions of bleach are vulnerable to Cross-Site Scripting. It is possible to bypass the package's HTML sanitization with payloads such as "scriptalert'xss';script" regardless of the passed options. This may allow attackers to execute arbitrary JavaScript in the victim's browser. Recommendatio...

docpad-plugin-posteditor (>=2.0.0, <=2.1.2) potentially affected by CVE-2014-8881 via bleach (0.3.0)

bleach NPM version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - docpad-plugin-posteditor =2.0.0, =2.1.2 Source cves: CVE-2014-8881 Source advisory: OSV:GHSA-MVMF-CVFX-QG55...

Regular Expression Denial of Service in bleach

All versions of the bleach package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. Recommendation The bleach package is not currently maintained, and has not seen an update since 2014. To mitigate this issue, it is...

GHSA-MVMF-CVFX-QG55 Regular Expression Denial of Service in bleach

All versions of the bleach package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. Recommendation The bleach package is not currently maintained, and has not seen an update since 2014. To mitigate this issue, it is...

Security Bulletin: A security vulnerability has been identified in Bleach shipped with IBM Watson Machine Learning Community Edition (WMLCE)

Summary Multiple vulnerabilities have been found in the Bleach package, which is either built in to or distributed with IBM WMLCE. Vulnerability Details CVEID: CVE-2020-6816 DESCRIPTION: Mozilla Bleach is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by...

The vulnerability of the library for cleaning HTML-based text using python-bleach allows a attacker to compromise data integrity.

The vulnerability of the Python-bleach library for cleaning HTML blacklists is related to an error in adding the same word to a blacklist. Exploiting this vulnerability could allow an attacker to compromise data integrity...