CVE-2021-35043

Fixed in a distro release EPSS 2%

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

Published 2021-07-19 · CVE record · OSV

Products: antisamy_project antisamy, oracle retail_back_office, oracle retail_central_office, oracle retail_returns_management, oracle banking_enterprise_default_management, oracle banking_enterprise_default_managment, oracle banking_party_management, oracle banking_platform, oracle insurance_policy_administration, oracle middleware_common_libraries_and_tools, netapp active_iq_unified_manager

Fixed upstream

Distro releases