Most recent entries from all

Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 18:24:34 +0000 CVE-2018-19787 https://vulnerability.circl.lu/vuln/cve-2018-19787 <p>An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.</p> <p>An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.</p> https://vulnerability.circl.lu/vuln/cve-2018-19787 GHSA-xp26-p53h-6h2p — Improper Neutralization of Input During Web Page Generation in LXML https://vulnerability.circl.lu/vuln/ghsa-xp26-p53h-6h2p <p><strong>Affected:</strong> PyPI: lxml</p> <p>An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.</p> <p><strong>Affected:</strong> PyPI: lxml</p> <p>An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.</p> https://vulnerability.circl.lu/vuln/ghsa-xp26-p53h-6h2p PYSEC-2018-12 https://vulnerability.circl.lu/vuln/pysec-2018-12 <p><strong>Affected:</strong> PyPI: lxml</p> <p>An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.</p> <p><strong>Affected:</strong> PyPI: lxml</p> <p>An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.</p> https://vulnerability.circl.lu/vuln/pysec-2018-12