TI-2024-15654 CVE-2024-23635 · GHSA-2mrq-w8pv-5pvq
AntiSamy malicious input can provoke XSS when preserving comments
Priority LOW 27
AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources.
Vulnerabilities
8 records
TI-2023-23369 CVE-2023-43643 · GHSA-pcf2-gh6g-h5r2
mXSS in AntiSamy
Priority LOW 28
AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources.
TI-2022-12015 CVE-2022-29577 · GHSA-vp37-2f9p-3vr3
OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with…
Priority LOW 30
OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input.
TI-2022-11121 CVE-2022-28367 · GHSA-3pqg-4rqg-pg9g
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with…
Priority LOW 29
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input.
TI-2022-11120 CVE-2022-28366 · GHSA-g9hh-vvx3-v37v
Certain Neko-related HTML parsers allow a denial of service via crafted Processing…
Priority LOW 37
Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption.
TI-2021-14007 CVE-2021-35043 · GHSA-9c8w-jrw3-q2c3
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output…
Priority LOW 30
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected).
TI-2017-10799 CVE-2017-14735 · GHSA-q44v-xc3g-v7jq
OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of…
Priority LOW 31
OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.
TI-2016-08102 CVE-2016-10006 · GHSA-683w-6h9j-57wq
In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that…
Priority LOW 32
In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code.