Policies not properly enforced in bluemonday
The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-42576US | critical9.8 | — | ||
The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION eleme… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50WEB
- https://github.com/advisories/GHSA-x95h-979x-cf3jADVISORY
- https://github.com/microcosm-cc/bluemondayPACKAGE
- https://github.com/microcosm-cc/bluemonday/commit/c788a2a4d42e081ad54a31368478820bb4a42fb4WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/pybluemonday/PYSEC-2021-849.yamlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-42576ADVISORY
- https://pkg.go.dev/vuln/GO-2022-0588WEB
- https://pypi.org/project/pybluemondayWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan