Inconsistent input sanitisation leads to XSS vectors

Background A variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of jQuery.html, there are a whole host of XSS possibilities with specially crafted input to a variety of fields. Impact OMERO.web before 5.11.0 and OMERO.figure befo...

GHSA-G67G-HVC3-XMVF Inconsistent input sanitisation leads to XSS vectors

Background A variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of jQuery.html, there are a whole host of XSS possibilities with specially crafted input to a variety of fields. Impact OMERO.web before 5.11.0 and OMERO.figure befo...

PT-2021-23116

Name of the Vulnerable Software and Affected Versions OMERO.web versions prior to 5.11.0 OMERO.figure versions prior to 4.4.1 Description The issue arises from a lack of proper sanitization through HTML escaping in various templates, combined with the use of jQuery.html. This leads to potential...