libowasp-antisamy-java

8 results · Feed

• Medium 6.1
  CVE-2024-23635

  AntiSamy malicious input can provoke XSS when preserving comments

  AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subje…

  nahsra antisamy libowasp-antisamy-java libowasp-antisamy-java Debian Ubuntu Maven
  Feb 2, 2024
• Medium 6.1
  CVE-2023-43643

  mXSS in AntiSamy

  AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To …

  nahsra antisamy libowasp-antisamy-java org.owasp.antisamy:antisamy Debian Ubuntu Maven
  Oct 9, 2023
• Medium 6.1
  CVE-2022-29577 Public exploit

  Cross-site Scripting in OWASP AntiSamy

  OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2…

  libowasp-antisamy-java org.owasp.antisamy:antisamy Ubuntu Maven
  Apr 21, 2022
• Medium 6.1
  CVE-2022-28367

  Cross-site Scripting in OWASP AntiSamy

  OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.

  libowasp-antisamy-java libowasp-antisamy-java org.owasp.antisamy:antisamy Debian Ubuntu Maven
  Apr 21, 2022
• High 7.5
  CVE-2022-28366

  Denial of service in HtmlUnit-Neko

  Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exis…

  libowasp-antisamy-java libowasp-antisamy-java net.sourceforge.htmlunit:neko-htmlunit Debian Ubuntu Maven
  Apr 21, 2022
• Medium 6.1
  CVE-2021-35043

  Cross-site Scripting in OWASP AntiSamy

  OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

  libowasp-antisamy-java org.owasp.antisamy:antisamy libowasp-antisamy-java Debian Ubuntu Maven
  Jul 19, 2021
• Medium 6.1
  CVE-2017-14735 Public exploit

  OWASP AntiSamy Cross-site Scripting vulnerability

  OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.

  libowasp-antisamy-java org.owasp.antisamy:antisamy libowasp-antisamy-java Debian Ubuntu Maven
  Sep 25, 2017
• Medium 6.1
  CVE-2016-10006 Public exploit

  OWASP AntiSamy vulnerable to Cross-site Scripting

  In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.

  libowasp-antisamy-java org.owasp.antisamy:antisamy libowasp-antisamy-java Debian Ubuntu Maven
  Dec 24, 2016