nahsra__antisamy_CVE-2017-14735_1-5-6

AntiSamy 用于快速、可配置地清理来自不可信来源的HTML的库。支持Java 8+。 另一种说法可能是：这是一个API，帮助您确保客户端在其个人资料、评论等中提供的HTML中不包含恶意代码，这些代码会被持久化在服务器上。对于Web应用程序而言，“恶意代码”通常指“JavaScript”。大多数情况下，层叠样式表仅在调用JavaScript时才被视为恶意。然而，在很多情况下，“正常”的HTML和CSS也可能被恶意使用。 重要！- 1.7.0版本中的API破坏性变更...

Linux Distros Unpatched Vulnerability : CVE-2017-14735

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL. CVE-2017-14735 Note that Nessus relies on...

Oracle Application Testing Suite Multiple Vulnerabilities (Jan 2020 CPU)

The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities : - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager component: Oracle Flow Builder Jython. Supported versions that are affected are...

Update the bundled version of OWASP AntiSamy to address issues

The bundled version of OWASP AntiSamy in Crucible before version 4.7.1 was vulnerable to CVE-2017-14735 https://nvd.nist.gov/vuln/detail/CVE-2017-14735 and CVE-2016-10006 https://nvd.nist.gov/vuln/detail/CVE-2016-10006...

Update the bundled version of OWASP AntiSamy to address issues

The bundled version of OWASP AntiSamy in Fisheye before version 4.7.1 was vulnerable to CVE-2017-14735 https://nvd.nist.gov/vuln/detail/CVE-2017-14735 and CVE-2016-10006 https://nvd.nist.gov/vuln/detail/CVE-2016-10006...

CVE-2017-14735

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of to construct a javascript: URL...

CVE-2017-14735

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of to construct a javascript: URL...

CVE-2017-14735

CVE-2017-14735 affects OWASP AntiSamy prior to version 1.5.7, enabling XSS via HTML5 entities (e.g., using : to construct a javascript: URL). The connected data show affected bundles in Crucible prior to 4.7.1 and other Atlassian integrations, indicating the vulnerability can exist in embedded An...