VDB-107122 · CVE-2017-14735 · BID 105656

OWASP AntiSamy up to 1.5.7 HTML5 Entities javascript: URL cross site scripting

A vulnerability has been found in OWASP AntiSamy up to 1.5.7 and classified as problematic. This vulnerability affects an unknown functionality of the component HTML5 Entities Handler. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

Field

Commit Conf

Approve Conf

ID	Commited	User	Field	Change	Remarks	Moderated	Reason	C
10820004	01/14/2021	VulD...	cvss2_nvd_basescore	4.3	nist.gov	01/14/2021	accepted	90
10820003	01/14/2021	VulD...	person_name	Raj Veerappan	securityfocus.com	01/14/2021	accepted	70
7138756	11/19/2019	VulD...	securityfocus_class	Input Validation Error	securityfocus.com	11/19/2019	accepted	100
7138755	11/19/2019	VulD...	securityfocus_date	1506297600 (09/25/2017)	securityfocus.com	11/19/2019	accepted	100
7138754	11/19/2019	VulD...	securityfocus	105656	securityfocus.com	11/19/2019	accepted	100
7138748	11/19/2019	VulD...	confirm_url	http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	oracle.com	11/19/2019	accepted	100
7138708	11/19/2019	VulD...	discoverydate	1499299200		11/19/2019	accepted	100
7138766	09/26/2017	VulD...	cvss3_nvd_basescore	6.1	nist.gov	09/26/2017	accepted	90
7138765	09/26/2017	VulD...	0day_days	81		09/26/2017	accepted	90
7138764	09/26/2017	VulD...	cvss3_vuldb_rc	U		09/26/2017	accepted	90
7138763	09/26/2017	VulD...	cvss3_vuldb_rl	X		09/26/2017	accepted	90
7138762	09/26/2017	VulD...	cvss3_vuldb_e	X		09/26/2017	accepted	90
7138761	09/26/2017	VulD...	cvss2_vuldb_rc	UC		09/26/2017	accepted	90
7138760	09/26/2017	VulD...	cvss2_vuldb_rl	ND		09/26/2017	accepted	90
7138759	09/26/2017	VulD...	cvss2_vuldb_e	ND		09/26/2017	accepted	90
7138758	09/26/2017	VulD...	seealso	90449 91385 91680 91681 91682 91683 93098 93251 93252 93253 93254 93255 93256 93257 93258 93259 93260 94364 94366 94365 94367 94368 94370 94369 94371 94372 94374 94373 94375 94376		09/26/2017	accepted	100
7138757	09/26/2017	VulD...	securityfocus_title	OWASP AntiSamy CVE-2017-14735 Cross Site Scripting Vulnerability	securityfocus.com	09/26/2017	accepted	100
7138753	09/26/2017	VulD...	cve_nvd_summary	OWASP AntiSamy through 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of &colon; to construct a javascript: URL.	mitre.org	09/26/2017	accepted	100
7138752	09/26/2017	VulD...	cve_nvd_published	1506297600	mitre.org	09/26/2017	accepted	100
7138751	09/26/2017	VulD...	cve_assigned	1506297600	mitre.org	09/26/2017	accepted	100