Most recent entries from all

bdu:2026-10872

certfr-2026-avi-0917 — De multiples vulnérabilités ont été découvertes dans Oracle PeopleSoft. Elles permettent à un attaquant de provoquer un…

certfr-2026-avi-0917

Withdrawn: CLEANSTART-2026-FR63847 — yawkat LZ4 Java provides LZ4 compression for Java

Withdrawn by the publisher.

Affected: CleanStart: elasticsearch

Multiple security vulnerabilities affect the elasticsearch package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.

EUVD-2026-261937

fkie_cve-2025-66021

OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy. At time of publication no known patch is available.

GHSA-g9gq-3pfx-2gw2 — OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

Affected: Maven: com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer

### Summary It is observed that OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows `noscript` and `style` tags with `allowTextIn` inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy.

### Details

The OWASP java HTML sanitizer is vulnerable to XSS. This only happens when HtmlPolicyBuilder allows `noscript` & `style` tag with `allowTextIn` inside style tags.

The following condition is very edge case but if users combine a HtmlPolicyBuilder with any other tags except `noscript` and allow `style` tag with `allowTextIn` inside the style tag then In this case sanitizer would be safe from XSS. This happens because how the browser also perceives `noscript` tags post sanitization.

### PoC

1. Lets create a `HtmlPolicyBuilder` which allows `p, noscript, style` html tags and allows `.allowTextIn("style")`. 2. There are two XSS payloads which very identical and only difference is one has p tag and other has noscript tag. These payload have script tags that could be vulnerable to XSS and should be stripped out after sanitisation.

```HTML 1. <noscript><style></noscript><script>alert(1)</script> 2. <p><style></p><script>alert(1)</script> ```

3. Run the following piece of code which sanitizes the payload.

```java public class main { private static final String ALLOWED_HTML_TAGS = "p, noscript, style";

/** * Description of vulnerabil…

WID-SEC-W-2026-0438 — Atlassian Bamboo und Confluence (Data Center und Server): Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Atlassian Bamboo und Atlassian Confluence ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und Cross-Site-Scripting-Angriffe durchzuführen.