lxml lxml vulnerabilities and exploits

(subscribe to this query)

TAXII libtaxii up to and including 1.1.117, as used in EclecticIQ OpenTAXII up to and including 0.2.0 and other products, allows SSRF via an initial http:// substring to the parse method, even when the no_network setting is used for the XML parser. NOTE: the vendor points out tha...

Libtaxii Project Libtaxii Eclecticiq Opentaxii

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to a...

NULL Pointer Dereference allows malicious users to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 up to and including 2.9.14. libxml2 2.9.9 and previous versions are not affected. It allows triggering crashes thr...

Lxml Lxml Fedoraproject Fedora 36 Fedoraproject Fedora 37

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a s...

Lxml Lxml Fedoraproject Fedora 34 Fedoraproject Fedora 35 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0 Netapp Solidfire -Netapp Solidfire Enterprise Sds -Netapp Hci Storage Node Firmware -Oracle Http Server 12.2.1.3.0 Oracle Http Server 12.2.1.4.0 Oracle Zfs Storage Appliance Kit 8.8 Oracle Communications Cloud Native Core Binding Support Function 22.1.3 Oracle Communications Cloud Native Core Policy 22.2.0 Oracle Communications Cloud Native Core Network Exposure Function 22.1.1

An XSS vulnerability exists in python-lxml's clean module versions prior to 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this...

Lxml Lxml Debian Debian Linux 9.0 Debian Debian Linux 10.0 Fedoraproject Fedora 33 Fedoraproject Fedora 34 Netapp Snapcenter -Oracle Zfs Storage Appliance Kit 8.8

A XSS vulnerability exists in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.

Lxml Lxml Redhat Enterprise Linux 8.0 Redhat Software Collections -Debian Debian Linux 9.0 Debian Debian Linux 10.0 Fedoraproject Fedora 32 Fedoraproject Fedora 33 Netapp Snapcenter -Oracle Communications Offline Mediation Controller 12.0.0.3.0 Oracle Zfs Storage Appliance Kit 8.8

1 Github repository

An issue exists in lxml prior to 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote malicious user to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is ...

Lxml Lxml Debian Debian Linux 8.0 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 12.04

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook