beu (>=0.1.0, <=0.1.1), c2cwsgiutils (>=0.2.0, <=0.3.2) +3 more potentially affected by CVE-2021-28957 via lxml (3.7.2)

lxml PYPI version 3.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - beu =0.1.0, =0.2.0, =0.1.0, =0.1.1, =0.1.3 Source cves: CVE-2021-28957 Source advisory: OSV:PYSEC-2021-19...

no-cloud (0.0.8), okami (0.1.0) potentially affected by CVE-2021-28957 via lxml (3.7.1)

lxml PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - no-cloud 0.0.8 - okami 0.1.0 Source cves: CVE-2021-28957 Source advisory: OSV:PYSEC-2021-19...

bioc (>=1.1.0.dev1, <=1.1.0.dev2), biweeklybudget (>=0.1.0, <=0.7.0) +13 more potentially affected by CVE-2021-28957 via lxml (3.7.3)

lxml PYPI version 3.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - bioc =1.1.0.dev1, =0.1.0, =0.3.3, =1.1.3.0, =0.6.14, =1.0.0, =0.1.4, =0.1.5 - pyodata 1.1.1 - readembedability 1.6.0 - sfmc 0.1.2 - sirbot-plugins 0.1.2...

django-transcribe (>=0.3.5, <=0.5.17), odooku-odoo-account-invoicing (>=11.0.0, <=11.0.6) +35 more potentially affected by CVE-2021-28957 via lxml (3.5.0)

lxml PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - django-transcribe =0.3.5, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0,...

adamalib (0.1.0), bormeparser (>=0.1.1, <=0.2.3) +23 more potentially affected by CVE-2021-28957 via lxml (3.4.4)

lxml PYPI version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - adamalib 0.1.0 - bormeparser =0.1.1, =2.0.1.16012810, =2.0.1.16012810, =2.0.1.16012810, =1.0.1, =2.0.2.16012810, =2.0.1.15101417, =2.0.1.15101417,...

PYSEC-2021-19

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

bormeparser (0.2.4), bsxprinter (>=0.2.0, <=0.4.0) +16 more potentially affected by CVE-2021-28957 via lxml (3.6.4)

lxml PYPI version 3.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - bormeparser 0.2.4 - bsxprinter =0.2.0, =0.1.0, =0.1.1, =0.6.12a2, =1.5.9, =0.1.1, =0.1.3 and more Source cves: CVE-2021-28957 Source advisory:...

eemeter (>=0.4.9, <=0.5.11), nginxauthdaemon (>=1.0.0a1, <=1.1.0) +1 more potentially affected by CVE-2021-28957 via lxml (3.6.1)

lxml PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - eemeter =0.4.9, =1.0.0a1, =1.1.0 - rrtop100 0.1.0 Source cves: CVE-2021-28957 Source advisory: OSV:PYSEC-2021-19...

epcpyyes (>=1.0.13, <=1.2.0) potentially affected by CVE-2021-28957 via lxml (3.7.0)

lxml PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - epcpyyes =1.0.13, =1.2.0 Source cves: CVE-2021-28957 Source advisory: OSV:PYSEC-2021-19...

CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

a3m (0.1.0), acdh-collatex-utils (>=0.2.0, <=1.3.0) +585 more potentially affected by CVE-2021-28957 via lxml (>=3.2.3, <=4.6.2)

lxml PYPI version =3.2.3, =0.2.0, =1.0.0rc1, =3.0.0, =0.1.0, =1.0.0a1.post0, =1.10.0, =0.1.16, =0.7.2, =1.0.1, =1.0.3 and more Source cves: CVE-2021-28957 Source advisory: MEND:CVE-2021-28957...

CVE-2021-28957

CVE-2021-28957 affects python-lxml’s Cleaner in the clean module, where disabling safe_attrs_only and forms allows the formaction attribute to bypass sanitization, enabling remote XSS. Versions before 4.6.3 are vulnerable; fixed in lxml 4.6.3. Affected: python-lxml; Issue caused by missing input ...

CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

Lxml cross-site scripting vulnerabilities

Lxml is a software from the individual developers of Lxml that can interact with Python for locating elements in Html. A cross-site scripting vulnerability exists in lxml 4.6.2, which stems from the HTML5 formaction attribute...

CVE-2021-28957: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

EulerOS Virtualization 3.0.2.6 : python-lxml (EulerOS-SA-2021-1420)

According to the version of the python-lxml package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which...

EulerOS Virtualization for ARM 64 3.0.2.0 : python-lxml (EulerOS-SA-2021-1402)

According to the version of the python-lxml package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browser...