WID-SEC-2023-0757 — IBM Maximo Asset Management: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Maximo Asset Management ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

Maximo Asset Management ist ein Enterprise-Asset-Management-System, das umfassenden Support für Assets, Maintenance, Ressourcen und Supply-Chain-Management-Anforderungen bietet.

Vulnerabilities 2

Medium 6.1

CVE-2022-28367

Cross-site Scripting in OWASP AntiSamy

OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.

libowasp-antisamy-java libowasp-antisamy-java org.owasp.antisamy:antisamy Debian Ubuntu Maven

Apr 21, 2022
Medium 6.1

CVE-2022-29577 Public exploit

Cross-site Scripting in OWASP AntiSamy

OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2…

libowasp-antisamy-java org.owasp.antisamy:antisamy Ubuntu Maven

Apr 21, 2022

Revision history

2023-03-26 #1
Initiale Fassung

References

IBM Security Bulletin: 6838559 vom 2023-03-26
https://www.ibm.com/support/pages/node/6966080