DEBIAN-CVE-2014-3146

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting XSS attacks via control characters in the link scheme to the cleanhtml function...

CVE-2014-3146

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting XSS attacks via control characters in the link scheme to the cleanhtml function...

PYSEC-2014-9

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting XSS attacks via control characters in the link scheme to the cleanhtml function...

Cross site scripting

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting XSS attacks via control characters in the link scheme to the cleanhtml function...

CVE-2014-3146

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting XSS attacks via control characters in the link scheme to the cleanhtml function...

CVE-2014-3146

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting XSS attacks via control characters in the link scheme to the cleanhtml function...

CVE-2014-3146

CVE-2014-3146 affects the lxml project, specifically the lxml.html.clean module. The vulnerability is an incomplete blacklist in clean_html that allows cross-site scripting (XSS) via control characters in link schemes. Public advisories detail that lxml before 3.3.5 is vulnerable, with a noted wo...

CVE-2014-3146: Improper Neutralization of Input During Web Page Generation

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting XSS attacks via control characters in the link scheme to the cleanhtml function...

UBUNTU-CVE-2014-3146

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting XSS attacks via control characters in the link scheme to the cleanhtml function...

PT-2014-1801

Name of the Vulnerable Software and Affected Versions lxml versions prior to 3.3.5 Description The issue is related to an incomplete blacklist vulnerability in the lxml.html.clean module, which allows remote attackers to conduct cross-site scripting XSS attacks via control characters in the link...

Fedora Update for python-lxml FEDORA-2014-5801

Check for the Version of python-lxml OpenVAS Vulnerability Test Fedora Update for python-lxml FEDORA-2014-5801 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Fedora Update for python-lxml FEDORA-2014-5801

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[oss-security] CVE request: python-lxml clean_html() input sanitization flaw

Hi, can a CVE be assigned to the following issue? The lxml.html.clean module cleans up HTML by removing embedded or script content, special tags, CSS style annotations and much more. It was found 1 that the cleanhtml function, provided by the lxml.html.clean module, did not properly clean HTML...

Fedora 19 : python-lxml-3.3.5-1.fc19 (2014-5801)

3.3.5 2014-04-18 ================== Bugs fixed Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

[SECURITY] Fedora 19 Update: python-lxml-3.3.5-1.fc19

lxml provides a Python binding to the libxslt and libxml2 libraries. It follows the ElementTree API as much as possible in order to provide a more Pythonic interface to libxml2 and libxslt than the default bindings. In particular, lxml deals with Python Unicode strings rather than encoded UTF-8 a...

Fedora Update for python-lxml FEDORA-2014-5773

Check for the Version of python-lxml OpenVAS Vulnerability Test Fedora Update for python-lxml FEDORA-2014-5773 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Fedora Update for python-lxml FEDORA-2014-5773

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 20 : python-lxml-3.3.5-1.fc20 (2014-5773)

3.3.5 2014-04-18 ================== Bugs fixed Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

lxml Filter Bypass

Hi, all I've accidentally found vulnerability in cleanhtml function of lxml python library. User can break schema of url with nonprinted chars \x01-\x08. Seems like all versions including the latest 3.3.4 are vulnerable. Here is PoC. from lxml.html.clean import cleanhtml html = '''\ aaa bbb bbb b...

lxml - clean_html Security Bypass

lxml - cleanhtml Security Bypass source: https://www.securityfocus.com/bid/67159/info lxml is prone to a security-bypass vulnerability. An attacker can leverage this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks. Versions prior to lxml 3.3...