SUSE CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

AZL-10059 CVE-2022-2309 affecting package python-lxml for versions less than 4.9.1-1

NULL Pointer Dereference allows attackers to cause a denial of service or application crash. This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code...

DEBIAN-CVE-2022-2309

NULL Pointer Dereference allows attackers to cause a denial of service or application crash. This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code...

a3m (=0.1.0), acdh-collatex-utils (>=0.2.0 <=1.3.0) +851 more potentially affected by CVE-2022-2309 via lxml (>=3.2.3 <=4.9.0)

lxml PYPI version =3.2.3, =0.2.0, =1.0.0, =3.0.0, =0.1.0, =1.0.3, =1.0.0, =1.0.0a1.post0, =1.10.0, =1.10.0.7 - alphapept =0.3.29 and more Source cves: CVE-2022-2309 Source advisory: OSV:PYSEC-2022-230...

DR-Web-Engine 安全漏洞

DR-Web-Engine is built on python based on the lxml package and uses JSON as the query structure. A security vulnerability exists in DR-Web-Engine. An attacker could exploit the vulnerability to access sensitive user information and digital currency keys, as well as elevate privileges...

Security update for python-lxml (important)

openSUSE Security Update: Security update for python-lxml Announcement ID: openSUSE-SU-2022:0803-1 Rating: important References: 1118088 1179534 1184177 1193752 Cross-References: CVE-2018-19787 CVE-2020-27783 CVE-2021-28957 CVE-2021-43818 CVSS scores: CVE-2018-19787 NVD : 6.1...

USN-5225-1 lxml vulnerability

It was discovered that lxml incorrectly handled certain XML and HTML files. An attacker could possibly use this issue to execute arbitrary code...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : lxml vulnerability (USN-5225-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5225-1 advisory. It was discovered that lxml incorrectly handled certain XML and HTML files. An attacker could possibly use this issue to execute arbitrary...

a3m (=0.1.0), acdh-collatex-utils (>=0.2.0 <=1.3.0) +701 more potentially affected by CVE-2021-43818 via lxml (>=3.2.3 <=4.6.4)

lxml PYPI version =3.2.3, =0.2.0, =1.0.0, =3.0.0, =0.1.0, =1.0.3, =1.0.0a1.post0, =1.10.0, =0.0.4, =0.0.14 and more Source cves: CVE-2021-43818 Source advisory: OSV:PYSEC-2021-852...

a3m (=0.1.0), acdh-collatex-utils (>=0.2.0 <=1.3.0) +701 more potentially affected by CVE-2021-43818 via lxml (>=3.2.3 <=4.6.4)

lxml PYPI version =3.2.3, =0.2.0, =1.0.0, =3.0.0, =0.1.0, =1.0.3, =1.0.0a1.post0, =1.10.0, =0.0.4, =0.0.14 and more Source cves: CVE-2021-43818 Source advisory: OSV:GHSA-55X5-FJ6C-H6M8...

a3m (=0.1.0), acdh-collatex-utils (>=0.2.0 <=1.3.0) +589 more potentially affected by CVE-2021-28957 via lxml (>=3.2.3 <=4.6.2)

lxml PYPI version =3.2.3, =0.2.0, =1.0.0, =3.0.0, =0.1.0, =1.0.3, =1.0.0a1.post0, =1.10.0, =0.1.16, =0.7.2, =0.11.0 - apkcli =0.1.2 and more Source cves: CVE-2021-28957 Source advisory: OSV:GHSA-JQ4V-F5Q6-MJQQ...

a3m (=0.1.0), acdh-collatex-utils (>=0.2.0 <=1.2.0) +542 more potentially affected by CVE-2020-27783 via lxml (>=3.2.3 <=4.6.1)

lxml PYPI version =3.2.3, =0.2.0, =1.0.0, =3.0.0, =0.1.0, =1.0.3, =1.0.0a1.post0, =1.10.0, =0.1.16, =0.7.2, =1.0.1, =1.0.3 and more Source cves: CVE-2020-27783 Source advisory: OSV:GHSA-PGWW-XF46-H92R...

GHSA-PGWW-XF46-H92R lxml vulnerable to Cross-site Scripting

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...

USN-4666-2: lxml vulnerability

USN-4666-1 partially fixed a vulnerability in lxml, but an additional patch was needed. This update provides the corresponding additional patch in order to properly fix the vulnerability. Original advisory details: It was discovered that lxml incorrectly handled certain HTML. An attacker could...

USN-4666-2 lxml vulnerability

USN-4666-1 partially fixed a vulnerability in lxml, but an additional patch was needed. This update provides the corresponding additional patch in order to properly fix the vulnerability. Original advisory details: It was discovered that lxml incorrectly handled certain HTML. An attacker could...

a3m (=0.1.0), acdh-collatex-utils (>=0.2.0 <=1.2.0) +542 more potentially affected by CVE-2020-27783 via lxml (>=3.2.3 <=4.6.1)

lxml PYPI version =3.2.3, =0.2.0, =1.0.0, =3.0.0, =0.1.0, =1.0.3, =1.0.0a1.post0, =1.10.0, =0.1.16, =0.7.2, =1.0.1, =1.0.3 and more Source cves: CVE-2020-27783 Source advisory: OSV:PYSEC-2020-62...

USN-3841-1 lxml vulnerability

It was discovered that lxml incorrectly handled certain HTML files. An attacker could possibly use this issue to conduct cross-site scripting XSS attacks...

adamalib (=0.1.0), aeat-web-services (>=1.0.0 <=2.0.2) +223 more potentially affected by CVE-2018-19787 via lxml (>=3.2.3 <=4.2.4)

lxml PYPI version =3.2.3, =1.0.0, =1.0.3, =1.0.0a1.post0, =1.10.0, =0.7.2, =1.14.1, =1.3.0, =0.1.0, =1.1.0.dev1, =0.1.0, =1.2018.7.26, =0.1.1, =0.2.0, =0.4.0 and more Source cves: CVE-2018-19787 Source advisory: OSV:PYSEC-2018-12...

AZL-6806 CVE-2018-19787 affecting package python-lxml for versions less than 4.8.0-1

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

DEBIAN-CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...