CVE-2020-6816

In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False...

CVE-2020-6816

In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False...

CVE-2020-6802

In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option...

CVE-2020-6802

In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option...

CVE-2020-6802

Mozilla Bleach prior to 3.11 is vulnerable to mutation XSS via bleach.clean when noscript and a raw tag are allowed/whitelisted. A remote attacker could inject script into a page viewed in a browser (impact: carry out client-side script execution). Remediation observed in multiple sources shows u...

CVE-2020-6802

In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option...

adversarial-labeller (=0.1.8), alo7-airflow (>=1.10.0 <=1.10.0.7) +122 more potentially affected by CVE-2020-6816 via bleach (>=1.2.2 <=3.1.1)

bleach PYPI version =1.2.2, =1.10.0, =0.1.0, =0.0.6, =0.3.0, =0.0.9, =0.3.4, =0.0.5, =0.1.0rc1, =0.1.3, =0.0.1, =0.2.1, =0.4.3 - dbx-deploy =0.6.1 and more Source cves: CVE-2020-6816 Source advisory: OSV:GHSA-M6XF-FQ7Q-8743...

GHSA-M6XF-FQ7Q-8743 Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag

Impact A mutation XSS affects users calling bleach.clean with all of: the svg or math in the allowed/whitelisted tags an RCDATA tag see below in the allowed/whitelisted tags the keyword argument strip=False Patches Users are encouraged to upgrade to bleach v3.1.2 or greater. Workarounds modify...

Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag

Impact A mutation XSS affects users calling bleach.clean with all of: the svg or math in the allowed/whitelisted tags an RCDATA tag see below in the allowed/whitelisted tags the keyword argument strip=False Patches Users are encouraged to upgrade to bleach v3.1.2 or greater. Workarounds modify...

Debian DSA-4643-1 : python-bleach - security update

It was reported that python-bleach, a whitelist-based HTML-sanitizing library, is prone to a mutation XSS vulnerability in bleach.clean when strip=False and 'math' or 'svg' tags and one or more of the RCDATA tags were whitelisted. C Tenable Network Security, Inc. The descriptive text and package...

Debian: Security Advisory (DSA-4643-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4643-1] python-bleach security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4643-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 20, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4643-1] python-bleach security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4643-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 20, 2020 https://www.debian.org/security/faq -...

Cross-Site Scripting (XSS)

bleach is vulnerable to cross-site scripting XSS. The bleach.clean behavior when parsing embedded MathML and SVG content with RCDATA tags did not match the browser behavior and can result in a mutation XSS...

PT-2020-2103

Name of the Vulnerable Software and Affected Versions Mozilla Bleach versions prior to 3.12 Description A mutation XSS issue affects users calling bleach.clean with specific settings, including whitelisting svg or math tags, allowing RCDATA tags, and setting the strip keyword argument to False...

DSA-4643-1 python-bleach - security update

Bulletin has no description...

FreeBSD : www/py-bleach -- multiple vulnerabilities (3d19c776-68e7-11ea-91db-0050562a4d7b)

bleach.clean behavior parsing embedded MathML and SVG content with RCDATA tags did not match browser behavior and could result in a mutation XSS. Calls to bleach.clean with strip=False and math or svg tags and one or more of the RCDATA tags script, noscript, style, noframes, iframe, noembed, or x...

OPENSUSE-SU-2020:0325-1 Security update for python-bleach

This update for python-bleach to version 3.1.1 fixes the following issue: - Python-bleach was updated to 3.1.1 - CVE-2020-6802: Fixed mutation XSS vulnerabilities boo1165303. This update was imported from the openSUSE:Leap:15.1:Update update project...

Security update for python-bleach (important)

openSUSE Security Update: Security update for python-bleach Announcement ID: openSUSE-SU-2020:0325-1 Rating: important References: 1165303 Cross-References: CVE-2020-6802 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes one vulnerability is now available. Description: This...

openSUSE Security Update : python-bleach (openSUSE-2020-308)

This update for python-bleach to version 3.1.1 fixes the following issue : - Python-bleach was updated to 3.1.1 - CVE-2020-6802: Fixed mutation XSS vulnerabilities boo1165303. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...