nahsra__antisamy_CVE-2016-10006_1-5-3

antisamy 一个用于对来自不可信来源的 HTML 进行快速、可配置净化的库。 换一种说法就是：它是一个 API，可帮助你确保客户端不会在其个人资料、评论等提交的 HTML 中提供恶意代码， 这些 HTML 会被持久化存储在服务器上。在 Web 应用中，“恶意代码”通常指“JavaScript”。大多数情况下，层叠样式表只有在调用 JavaScript 时才会被视为恶意。 然而，在很多情况下，“正常”的 HTML 和 CSS 也可能被以恶意方式利用。 使用方法 首先，从 Maven 添加依赖： root@kitploit: org.owasp.antisamy antisamy...

Linux Distros Unpatched Vulnerability : CVE-2016-10006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input a tag that supports style with active content, you could bypass the library protections...

Update the bundled version of OWASP AntiSamy to address issues

The bundled version of OWASP AntiSamy in Crucible before version 4.7.1 was vulnerable to CVE-2017-14735 https://nvd.nist.gov/vuln/detail/CVE-2017-14735 and CVE-2016-10006 https://nvd.nist.gov/vuln/detail/CVE-2016-10006...

Update the bundled version of OWASP AntiSamy to address issues

The bundled version of OWASP AntiSamy in Fisheye before version 4.7.1 was vulnerable to CVE-2017-14735 https://nvd.nist.gov/vuln/detail/CVE-2017-14735 and CVE-2016-10006 https://nvd.nist.gov/vuln/detail/CVE-2016-10006...

CVE-2016-10006

In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input a tag that supports style with active content, you could bypass the library protections and supply executable code. The impact is XSS...

CVE-2016-10006

CVE-2016-10006 affects the HTML/CSS sanitizer library in OWASP AntiSamy prior to version 1.5.5. A specially crafted input (a tag that supports style with active content) could bypass protections and cause executable code to be executed in the context of affected applications, yielding a Cross‑Sit...