VYPR
Medium severity6.1NVD Advisory· Published Jul 19, 2021· Updated Jun 17, 2026

CVE-2021-35043

CVE-2021-35043

Description

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.owasp.antisamy:antisamyMaven
>= 1.5.7, < 1.6.41.6.4

Affected products

30
  • cpe:2.3:a:antisamy_project:antisamy:*:*:*:*:*:*:*:*
    Range: <1.6.4
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*+ 2 more
    • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
    • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
    • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
  • cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_enterprise_default_managment:*:*:*:*:*:*:*:*
    Range: >=2.3.0,<=2.4.0
  • cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*range: >=2.3.0,<=2.4.1
    • cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:insurance_policy_administration:11.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:insurance_policy_administration:11.2.8:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:insurance_policy_administration:11.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:insurance_policy_administration:11.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*
  • OWASP/AntiSamydescription
  • ghsa-coords
    Range: >= 1.5.7, < 1.6.4

Patches

Vulnerability mechanics

References

8

News mentions

0

No linked articles in our index yet.