CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

DEBIAN-CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

epcpyyes (>=1.0.13, <=1.2.0) potentially affected by CVE-2014-3146 +1 more via lxml (3.7.0)

lxml PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - epcpyyes =1.0.13, =1.2.0 Source cves: CVE-2014-3146, CVE-2018-19787 Source advisory: OSV:PYSEC-2018-12...

document-clipper (>=0.9.0, <=0.13.6) potentially affected by CVE-2014-3146 +1 more via lxml (3.3.2)

lxml PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - document-clipper =0.9.0, =0.13.6 Source cves: CVE-2014-3146, CVE-2018-19787 Source advisory: OSV:PYSEC-2018-12...

bormeparser (0.2.4), bsxprinter (>=0.2.0, <=0.4.0) +16 more potentially affected by CVE-2014-3146 +1 more via lxml (3.6.4)

lxml PYPI version 3.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - bormeparser 0.2.4 - bsxprinter =0.2.0, =0.1.0, =0.1.1, =0.6.12a2, =1.5.9, =0.1.1, =0.1.3 and more Source cves: CVE-2014-3146, CVE-2018-19787 Source...

aeat-web-services (>=1.0.0rc1, <=2.0.2), ansible-playbook-grapher (>=0.7.2, <=0.7.3) +80 more potentially affected by CVE-2014-3146 +1 more via lxml (>=4.0.0, <=4.2.4)

lxml PYPI version =4.0.0, =1.0.0rc1, =0.7.2, =1.2.0, =0.7.1, =1.2018.7.26, =0.3.0, =0.28.0, =0.1.5, =0.0.14, =1.0.1, =0.2.1, =0.0.5.1, =2.2.0.17112621, =2.2.0.17112818, =2.2.7.18062908 and more Source cves: CVE-2014-3146, CVE-2018-19787 Source advisory: OSV:PYSEC-2018-12...

eemeter (>=0.4.9, <=0.5.11), nginxauthdaemon (>=1.0.0a1, <=1.1.0) +1 more potentially affected by CVE-2014-3146 +1 more via lxml (3.6.1)

lxml PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - eemeter =0.4.9, =1.0.0a1, =1.1.0 - rrtop100 0.1.0 Source cves: CVE-2014-3146, CVE-2018-19787 Source advisory: OSV:PYSEC-2018-12...

bioc (>=1.1.0.dev1, <=1.1.0.dev2), biweeklybudget (>=0.1.0, <=0.7.0) +13 more potentially affected by CVE-2014-3146 +1 more via lxml (3.7.3)

lxml PYPI version 3.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - bioc =1.1.0.dev1, =0.1.0, =0.3.3, =1.1.3.0, =0.6.14, =1.0.0, =0.1.4, =0.1.5 - pyodata 1.1.1 - readembedability 1.6.0 - sfmc 0.1.2 - sirbot-plugins 0.1.2...

adamalib (0.1.0), aeat-web-services (>=1.0.0rc1, <=2.0.2) +221 more potentially affected by CVE-2018-19787 via lxml (>=3.2.3, <=4.2.4)

lxml PYPI version =3.2.3, =1.0.0rc1, =1.0.0a1.post0, =1.10.0, =0.7.2, =1.14.1, =0.1.0, =1.1.0.dev1, =0.1.0, =1.2018.7.26, =0.1.1, =0.2.0, =0.2.0, =0.0.1, =0.1.0 and more Source cves: CVE-2018-19787 Source advisory: MEND:CVE-2018-19787...

CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

CVE-2018-19787

lxml.html.clean in lxml

PT-2018-2954

Name of the Vulnerable Software and Affected Versions lxml versions prior to 4.2.5 Description The issue is related to the lxml.html.clean module in the lxml library, which fails to remove javascript: URLs that use escaping. This allows a remote attacker to conduct cross-site scripting XSS attack...

UBUNTU-CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

CVE-2018-19787: Improper Neutralization of Input During Web Page Generation

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

Cross-Site Scripting (XSS)

lxml is vulnerable to cross-site scripting. This is due to the way whitespaces are parsed in html/clean.py which would cause links with values such as javascrip%0at:alert to be executed...

Debian GNU/Linux Data Compromise

The multiple vulnerabilities in the lxml package of the Debian GNU/Linux operating system may lead to a breach of the integrity of protected information. These vulnerabilities can be exploited remotely...