Debian: Security Advisory (DSA-4880-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-4880-1 : lxml - security update

Kevin Chung discovered that lxml, a Python binding for the libxml2 and libxslt libraries, did not properly sanitize its input. This would allow a malicious user to mount a cross-site scripting attack. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

[SECURITY] [DSA 4880-1] lxml security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4880-1 [email protected] https://www.debian.org/security/ Sebastien Delafond March 29, 2021 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4880-1] lxml security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4880-1 [email protected] https://www.debian.org/security/ Sebastien Delafond March 29, 2021 https://www.debian.org/security/faq -...

DSA-4880-1 lxml - security update

Bulletin has no description...

Debian: Security Advisory (DLA-2606-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2606-1] lxml security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2606-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz March 24, 2021 https://wiki.debian.org/LTS -...

EulerOS 2.0 SP5 : python-lxml (EulerOS-SA-2021-1701)

According to the version of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different...

DLA-2606-1 lxml - security update

Bulletin has no description...

Huawei EulerOS: Security Advisory for python-lxml (EulerOS-SA-2021-1701)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

a3m (=0.1.0), acdh-collatex-utils (>=0.2.0 <=1.3.0) +589 more potentially affected by CVE-2021-28957 via lxml (>=3.2.3 <=4.6.2)

lxml PYPI version =3.2.3, =0.2.0, =1.0.0, =3.0.0, =0.1.0, =1.0.3, =1.0.0a1.post0, =1.10.0, =0.1.16, =0.7.2, =0.11.0 - apkcli =0.1.2 and more Source cves: CVE-2021-28957 Source advisory: OSV:GHSA-JQ4V-F5Q6-MJQQ...

lxml vulnerable to Cross-Site Scripting

An XSS vulnerability was discovered in the python lxml clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

GHSA-JQ4V-F5Q6-MJQQ lxml vulnerable to Cross-Site Scripting

An XSS vulnerability was discovered in the python lxml clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

CVE-2021-28957

A flaw was found in python-lxml. The HTML5 formaction attribute is not input sanitized like the HTML action attribute is which can lead to a Cross-Site Scripting attack XSS when an application uses python-lxml to sanitize user inputs. The highest threat from this vulnerability is to data...

Cross-site Scripting (XSS)

lxml is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary script via HTML action attribute into defs.linkattrs in html/defs.py...

CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

AZL-6808 CVE-2021-28957 affecting package python-lxml for versions less than 4.8.0-1

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

ALPINE-CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

DEBIAN-CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...