Safety CI > geokrety/geokrety-api-models

pyup-update-sqlalchemy-1.2.17-to-1.4.23

4 years, 2 months ago

Update sqlalchemy from 1.2.17 to 1.4.23

bleach 3.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

pyup-update-responses-0.10.5-to-0.13.4

4 years, 2 months ago

1232f422

Update responses from 0.10.5 to 0.13.4

bleach 3.1.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
SQLAlchemy	1.2.17	<=1.2.17 , >=1.3.0b1,<=1.3.0b2	show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481
SQLAlchemy	1.2.17	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563
SQLAlchemy	1.2.17	<1.3.0	show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

pyup-update-bleach-3.1.0-to-4.0.0

4 years, 3 months ago

4281de8c

Update bleach from 3.1.0 to 4.0.0

SQLAlchemy 1.2.17 has known security vulnerabilities.

Package	Installed	Affected	Info
SQLAlchemy	1.2.17	<=1.2.17 , >=1.3.0b1,<=1.3.0b2	show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481
SQLAlchemy	1.2.17	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563
SQLAlchemy	1.2.17	<1.3.0	show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

Package

Installed

Affected

Info

SQLAlchemy

1.2.17

<=1.2.17 , >=1.3.0b1,<=1.3.0b2

show

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
https://github.com/sqlalchemy/sqlalchemy/issues/4481

SQLAlchemy

1.2.17

<2.0.0b1

show

Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints.
https://github.com/sqlalchemy/sqlalchemy/pull/8563

SQLAlchemy

1.2.17

<1.3.0

show

SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

pyup-update-sqlalchemy-1.2.17-to-1.4.22

4 years, 3 months ago

97116619

Update sqlalchemy from 1.2.17 to 1.4.22

bleach 3.1.0 and coverage 4.5.2 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

pyup-update-bleach-3.1.0-to-3.3.1

4 years, 3 months ago

3b1ac527

Update bleach from 3.1.0 to 3.3.1

SQLAlchemy 1.2.17 has known security vulnerabilities.

Package	Installed	Affected	Info
SQLAlchemy	1.2.17	<=1.2.17 , >=1.3.0b1,<=1.3.0b2	show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481
SQLAlchemy	1.2.17	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563
SQLAlchemy	1.2.17	<1.3.0	show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

Package

Installed

Affected

Info

SQLAlchemy

1.2.17

<=1.2.17 , >=1.3.0b1,<=1.3.0b2

show

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
https://github.com/sqlalchemy/sqlalchemy/issues/4481

SQLAlchemy

1.2.17

<2.0.0b1

show

Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints.
https://github.com/sqlalchemy/sqlalchemy/pull/8563

SQLAlchemy

1.2.17

<1.3.0

show

SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

pyup-update-sqlalchemy-1.2.17-to-1.4.21

4 years, 3 months ago

89478767

Update sqlalchemy from 1.2.17 to 1.4.21

bleach 3.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

pyup-update-requests-2.21.0-to-2.26.0

4 years, 3 months ago

0fc49aed

Update requests from 2.21.0 to 2.26.0

bleach 3.1.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
SQLAlchemy	1.2.17	<=1.2.17 , >=1.3.0b1,<=1.3.0b2	show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481
SQLAlchemy	1.2.17	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563
SQLAlchemy	1.2.17	<1.3.0	show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

pyup-update-geopy-1.18.1-to-2.2.0

4 years, 3 months ago

c9e89aae

Update geopy from 1.18.1 to 2.2.0

bleach 3.1.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
SQLAlchemy	1.2.17	<=1.2.17 , >=1.3.0b1,<=1.3.0b2	show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481
SQLAlchemy	1.2.17	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563
SQLAlchemy	1.2.17	<1.3.0	show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

pyup-update-sqlalchemy-1.2.17-to-1.4.20

4 years, 4 months ago

36abae14

Update sqlalchemy from 1.2.17 to 1.4.20

bleach 3.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

pyup-update-sqlalchemy-1.2.17-to-1.4.19

4 years, 4 months ago

fcec9390

Update sqlalchemy from 1.2.17 to 1.4.19

bleach 3.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

pyup-update-sqlalchemy-1.2.17-to-1.4.18

4 years, 4 months ago

6a14d19e

Update sqlalchemy from 1.2.17 to 1.4.18

bleach 3.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

pyup-update-sqlalchemy-1.2.17-to-1.4.17

4 years, 5 months ago

9f290438

Update sqlalchemy from 1.2.17 to 1.4.17

bleach 3.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

pyup-update-sqlalchemy-1.2.17-to-1.4.16

4 years, 5 months ago

aebb4221

Update sqlalchemy from 1.2.17 to 1.4.16

bleach 3.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

pyup-update-sqlalchemy-1.2.17-to-1.4.15

4 years, 5 months ago

cf42fe1a

Update sqlalchemy from 1.2.17 to 1.4.15

bleach 3.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

pyup-update-sqlalchemy-1.2.17-to-1.4.14

4 years, 5 months ago

02d1598c

Update sqlalchemy from 1.2.17 to 1.4.14

bleach 3.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).