Filtered by vendor Antisamy Project
Subscribe
Search
Total
5 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-29577 | 1 Antisamy Project | 1 Antisamy | 2022-07-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367. | |||||
| CVE-2021-35043 | 3 Antisamy Project, Netapp, Oracle | 9 Antisamy, Active Iq Unified Manager, Banking Enterprise Default Managment and 6 more | 2022-07-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character. | |||||
| CVE-2022-28367 | 1 Antisamy Project | 1 Antisamy | 2022-05-03 | 4.3 MEDIUM | 6.1 MEDIUM |
| OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. | |||||
| CVE-2017-14735 | 1 Antisamy Project | 1 Antisamy | 2021-07-20 | 4.3 MEDIUM | 6.1 MEDIUM |
| OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL. | |||||
| CVE-2016-10006 | 1 Antisamy Project | 1 Antisamy | 2019-11-14 | 4.3 MEDIUM | 6.1 MEDIUM |
| In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS. | |||||