CVE-2017-14735 in Hyperion Infrastructure Technologyinfo

Summary

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of &colon; to construct a javascript: URL.

Once again VulDB remains the best source for vulnerability data.

Reservation

09/25/2017

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
179133	Oracle Hyperion Infrastructure Technology AntiSamy cross site scripting	79	Not defined	Official fix	CVE-2017-14735
179053	Oracle Enterprise Manager Base Platform AntiSamy cross site scripting	79	Not defined	Official fix	CVE-2017-14735
173461	Oracle E-Business Suite Technology Stack Attachments/iRecruitment/Contracts (AntiSamy) cross site scripting	79	Not defined	Official fix	CVE-2017-14735
153559	Oracle Knowledge Web Applications cross site scripting	79	Not defined	Official fix	CVE-2017-14735
148765	Oracle Application Testing Suite Oracle Flow Builder cross site scripting	79	Not defined	Official fix	CVE-2017-14735
148764	Oracle Application Testing Suite Load Testing for Web Apps cross site scripting	79	Not defined	Official fix	CVE-2017-14735
138040	Oracle Insurance Calculation Engine AntiSamy cross site scripting	79	Not defined	Official fix	CVE-2017-14735
137976	Oracle FLEXCUBE Core Banking OpenSSL cross site scripting	79	Not defined	Official fix	CVE-2017-14735
129702	Oracle Agile PLM AntiSamy cross site scripting	79	Not defined	Official fix	CVE-2017-14735
129684	Oracle Retail Returns Management AntiSamy cross site scripting	79	Not defined	Official fix	CVE-2017-14735
129682	Oracle Retail Central Office AntiSamy cross site scripting	79	Not defined	Official fix	CVE-2017-14735
129681	Oracle Retail Back Office AntiSamy cross site scripting	79	Not defined	Official fix	CVE-2017-14735
129613	Oracle Insurance Policy Administration J2EE AntiSamy cross site scripting	79	Not defined	Official fix	CVE-2017-14735
129571	Oracle WebCenter Sites Jython cross site scripting	79	Not defined	Official fix	CVE-2017-14735
129526	Oracle Banking Platform Jasper Project cross site scripting	79	Not defined	Official fix	CVE-2017-14735
125478	Oracle Fusion Middleware MapViewer Install cross site scripting	79	Not defined	Official fix	CVE-2017-14735
107122	OWASP AntiSamy HTML5 Entities HTML injection	79	Not defined	Not defined	CVE-2017-14735

Description

CPE

CWE

CVSS

Exploits

History

Diff

Relate

Threat Intelligence

API JSON

API XML

API CSV

Sources

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!