Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Lxml 跨站脚本漏洞
Vulnerability Description
Lxml是Lxml个人开发者的一个可与Python交互用于定位Html中元素的软件。 lxml 4.2.5之前版本中存在跨站脚本漏洞，该漏洞源于lxml.html.clean模块的lxml/html/clean.py文件没有移除使用转义的javascript: URLs。远程攻击者可利用该漏洞实施跨站脚本攻击。
CVSS Information
N/A
Vulnerability Type
N/A