python-lxml vulnerabilities (Red Hat)
182 vulnerabilities.
-
python-lxmlRed Hat Rubygem-katello: improper authorization logic allows resource enumeration 4.3 Medium -
python-lxmlRed Hat Rubygem-katello: sql injection in registry proxy via labels 6.5 Medium -
python-lxmlRed Hat Rubygem-hammer_cli: command injection via insecure editor invocation 6.7 Medium -
python-lxmlRed Hat Foreman: command injection in foreman-tail 5.3 Medium -
python-lxmlRed Hat Foreman: excessive permissions for viewer role on preview 9.1 Critical -
python-lxmlRed Hat Foreman: foreman: arbitrary code execution via safemode sandbox bypass 8.8 High -
python-lxmlRed Hat Foreman: ssti and insecure deserialization in foreman-rake configuration 7.7 High -
python-lxmlRed Hat Foreman: command injection in foreman-rake database tasks 8.2 High -
python-lxmlRed Hat Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter 8.2 High -
python-lxmlRed Hat Foreman: unauthenticated information disclosure via provisioning token validation flaw 7.5 High -
python-lxmlRed Hat Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter 8.8 High -
python-lxmlRed Hat GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation 8.7 High -
python-lxmlRed Hat Ketello: katello content view history api cross-organization authorization bypass 4.3 Medium -
python-lxmlRed Hat GitPython before 3.1.59 Arbitrary File Read via TagReference.create 7.1 High -
python-lxmlRed Hat sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger 8.7 High -
python-lxmlRed Hat sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service) 7.5 High -
python-lxmlRed Hat sqlparse: Quadratic O(n²) DoS in group_comments 8.7 High -
python-lxmlRed Hat Limit handshake messages we are willing to accept post-handshake in crypto/tls 7.5 High -
python-lxmlRed Hat Avoid quadratic complexity in resolvePath in net/url 5.9 Medium -
python-lxmlRed Hat Fix Javascript regexp context tracking in html/template 6.1 Medium -
python-lxmlRed Hat Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http 7.5 High -
python-lxmlRed Hat Enforce maximum recursion depth in encoding/asn1 7.5 High -
python-lxmlRed Hat GitPython before 3.1.57 Arbitrary File Overwrite and Read 7.2 High -
python-lxmlRed Hat GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() 8.7 High -
python-lxmlRed Hat GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling 8.7 High -
python-lxmlRed Hat GitPython before 3.1.54 Remote Code Execution via --template 7.7 High -
python-lxmlRed Hat GitPython before 3.1.54 Arbitrary File Overwrite via diff 7.2 High -
python-lxmlRed Hat lxml: javascript: URL bypass in Cleaner via xlink:href 8.2 High -
python-lxmlRed Hat Quadratic complexity in WordDecoder.DecodeHeader in mime 7.5 High -
python-lxmlRed Hat GitPython: Command injection via Git options bypass 8.8 High -
python-lxmlRed Hat GitPython: Unsafe option check validates multi_options before shlex.split transforms it 8.1 High -
python-lxmlRed Hat dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver 7.5 High -
python-lxmlRed Hat Quadratic complexity in os.path.expandvars() with user-controlled template 1.8 Low -
python-lxmlRed Hat ZIP64 End of Central Directory (EOCD) Locator record offset not checked 4.3 Medium -
python-lxmlRed Hat Tarfile infinite loop during parsing with negative member offset 7.5 High -
python-lxmlRed Hat HTMLParser quadratic complexity when processing malformed inputs 4.3 Medium -
python-lxmlRed Hat Tarfile extracts filtered members when errorlevel=0 7.5 High -
python-lxmlRed Hat Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory 7.5 High -
python-lxmlRed Hat Extraction filter bypass for linking outside extraction directory 7.5 High -
python-lxmlRed Hat Arbitrary writes via tarfile realpath overflow 9.4 Critical -
python-lxmlRed Hat setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write 7.7 High -
python-lxmlRed Hat Use-after-free in "unicode_escape" decoder with error handler 5.9 Medium -
python-lxmlRed Hat URL parser allowed square brackets in domain names 6.3 Medium -
python-lxmlRed Hat Improper validation of IPv6 and IPvFuture addresses 6.3 Medium -
python-lxmlRed Hat Foreman: read-only access to entire db from templates 6.3 Medium -
python-lxmlRed Hat Virtual environment (venv) activation scripts don't quote paths 5.3 Medium -
python-lxmlRed Hat Memory leak 7.2 High -
python-lxmlRed Hat Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore 9.8 Critical -
python-lxmlRed Hat Puppet-foreman: an authentication bypass vulnerability exists in foreman 9.8 Critical -
python-lxmlRed Hat Regular-expression DoS when parsing TarFile headers 7.5 High - Show olderLoading…