CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

UBUNTU-CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

PT-2018-2954

Name of the Vulnerable Software and Affected Versions lxml versions prior to 4.2.5 Description The issue is related to the lxml.html.clean module in the lxml library, which fails to remove javascript: URLs that use escaping. This allows a remote attacker to conduct cross-site scripting XSS attack...

Cross-Site Scripting (XSS)

lxml is vulnerable to cross-site scripting. This is due to the way whitespaces are parsed in html/clean.py which would cause links with values such as javascrip%0at:alert to be executed...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the integrity of protected information

The multiple vulnerabilities in the lxml package of the Debian GNU/Linux operating system may lead to a breach of the integrity of protected information. These vulnerabilities can be exploited remotely...

Mandriva Linux Security Advisory : python-lxml (MDVSA-2015:112)

Updated python-lxml packages fix security vulnerability : The cleanhtml function, provided by the lxml.html.clean module, did not properly clean HTML input if it included non-printed characters \x01-\x08. A remote attacker could use this flaw to serve malicious content to an application using the...

SuSE 11.3 Security Update : python-lxml (SAT Patch Number 9821)

This security update for python-lxml fixes a input sanitization flaw in cleanhtml. CVE-2014-3146 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C Novell, Inc. ...

lxml security update

Package : lxml Version : 2.2.8-2+deb6u1 CVE ID : CVE-2014-3146 Debian Bug : 746812 It was discovered that cleanhtml function of lxml pythonic bindings for the libxml2 and libxslt libraries performed insufficient sanitisation for some non-printable characters. This could lead to cross-site scripti...

lxml security update

Package : lxml Version : 2.2.8-2+deb6u1 CVE ID : CVE-2014-3146 Debian Bug : 746812 It was discovered that cleanhtml function of lxml pythonic bindings for the libxml2 and libxslt libraries performed insufficient sanitisation for some non-printable characters. This could lead to cross-site scripti...

DLA-0009-1 lxml - security update

Bulletin has no description...

openSUSE Security Update : python-lxml (openSUSE-SU-2014:0735-1)

python-lxml was fixed to ensure proper input sanitization in cleanhtml CVE-2014-3146. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2014-402. The text description of this plugin is ...

Debian DSA-2941-1 : lxml - security update

It was discovered that cleanhtml function of lxml pythonic bindings for the libxml2 and libxslt libraries performed insufficient sanitisation for some non-printable characters. This could lead to cross-site scripting. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

[SECURITY] [DSA 2941-1] lxml security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2941-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff Jun 01, 2014 http://www.debian.org/security/faq -...

DSA-2941-1 lxml - security update

Bulletin has no description...

Debian Security Advisory DSA 2941-1 (lxml - security update)

It was discovered that cleanhtml function of lxml pythonic bindings for the libxml2 and libxslt libraries performed insufficient sanitisation for some non-printable characters. This could lead to cross-site scripting. OpenVAS Vulnerability Test $Id: deb2941.nasl 6735 2017-07-17 09:56:49Z teissa $...

Debian: Security Advisory (DSA-2941-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-2217-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...