CVE-2021-35043

Published: Jul 19, 2021Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

Affected (28)

Products: Antisamy Project: Antisamy · Oracle: Retail Back Office, Retail Central Office, Retail Returns Management, Banking Enterprise Default Management, Banking Enterprise Default Managment, Banking Party Management, Banking Platform, Insurance Policy Administration, Middleware Common Libraries And Tools · Netapp: Active Iq Unified Manager

1 product

9 products

Retail Central Office

Retail Returns Management

Banking Enterprise Default Management

Banking Enterprise Default Managment

Banking Party Management

Banking Platform

Insurance Policy Administration

Middleware Common Libraries And Tools

Netapp

1 product

Active Iq Unified Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Antisamy Project Antisamy	Before 1.6.4

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Oracle Retail Back Office	Version 14.0
Oracle Retail Back Office	Version 14.1
Oracle Retail Central Office	Version 14.0
Oracle Retail Central Office	Version 14.1
Oracle Retail Returns Management	Version 14.0
Oracle Retail Returns Management	Version 14.1

Configuration C

18 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Enterprise Default Management	Version 2.10.0
Oracle Banking Enterprise Default Management	Version 2.12.0
Oracle Banking Enterprise Default Management	Version 2.6.2
Oracle Banking Enterprise Default Management	Version 2.7.0
Oracle Banking Enterprise Default Management	Version 2.7.1
Oracle Banking Enterprise Default Managment	From 2.3.0 to 2.4.0
Oracle Banking Party Management	Version 2.7.0
Oracle Banking Platform	From 2.3.0 to 2.4.1
Oracle Banking Platform	Version 2.6.2
Oracle Banking Platform	Version 2.7.0
Oracle Banking Platform	Version 2.7.1
Oracle Insurance Policy Administration	Version 11.0.2
Oracle Insurance Policy Administration	Version 11.1.0
Oracle Insurance Policy Administration	Version 11.2.8
Oracle Insurance Policy Administration	Version 11.3.0
Oracle Insurance Policy Administration	Version 11.3.1
Oracle Middleware Common Libraries And Tools	Version 12.2.1.3.0
Oracle Middleware Common Libraries And Tools	Version 12.2.1.4.0