Most recent entries from all

bdu:2024-00589

certfr-2024-avi-0049 — De multiples vulnérabilités ont été découvertes dans Oracle Weblogic Server. Certaines d'entre elles permettent à un at…

certfr-2024-avi-0049

EUVD-2026-186618

fkie_cve-2023-43643

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. This issue has been patched in AntiSamy 1.7.4 and later.

GHSA-pcf2-gh6g-h5r2 — mXSS in AntiSamy

Affected: Maven: org.owasp.antisamy:antisamy

# Impact

There is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output.

# Patches

Patched in AntiSamy 1.7.4 and later. See important remediation details in the reference given below.

# Workarounds

If you cannot upgrade to a fixed version of the library, the following mitigation can be applied until you can upgrade: Manually edit your AntiSamy policy file (e.g., antisamy.xml) by deleting the `preserveComments` directive or setting its value to `false`, if present. Also it would be useful to make AntiSamy remove the `noscript` tag by adding this in your tag definitions under the `<tagrules>` node (or deleting it entirely if present): ```xml <tag name="noscript" action="remove"/> ```

As the previously mentioned policy settings are preconditions for the mXSS attack to work, changing them as recommended should be sufficient to protect you against this vulnerability when using a vulnerable version of this library. However, the existing bug would still be present in AntiSamy or its parser dependency (neko-htmlunit). The safety of this workaround relies on configurations that may change in the future and don't address…

gsd-2023-43643

UBUNTU-CVE-2023-43643

Affected: Ubuntu:16.04:LTS: libowasp-antisamy-java, Ubuntu:18.04:LTS: libowasp-antisamy-java, Ubuntu:20.04:LTS: libowasp-antisamy-java, Ubuntu:22.04:LTS: libowasp-antisamy-java, Ubuntu:24.04:LTS: libowasp-antisamy-java, Ubuntu:25.10: libowasp-antisamy-java, Ubuntu:26.04:LTS: libowasp-antisamy-java

WID-SEC-W-2024-0123 — Oracle Fusion Middleware: Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.