CVE-2021-35043: Antisamy Project Antisamy

Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days.

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

Affected products

• Antisamy Project Antisamy: before 1.6.4 (fixed in 1.6.4)
• Netapp Active Iq Unified Manager: affected versions not specified
• Oracle Banking Enterprise Default Management: version 2.6.2 only; version 2.7.0 only; version 2.7.1 only; version 2.10.0 only; version 2.12.0 only
• Oracle Banking Enterprise Default Managment: from 2.3.0, up to and including 2.4.0
• Oracle Banking Party Management: version 2.7.0 only
• Oracle Banking Platform: from 2.3.0, up to and including 2.4.1; version 2.6.2 only; version 2.7.0 only; version 2.7.1 only
• Oracle Insurance Policy Administration: version 11.0.2 only; version 11.1.0 only; version 11.2.8 only; version 11.3.0 only; version 11.3.1 only
• Oracle Middleware Common Libraries And Tools: version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Oracle Retail Back Office: version 14.0 only; version 14.1 only
• Oracle Retail Central Office: version 14.0 only; version 14.1 only
• Oracle Retail Returns Management: version 14.0 only; version 14.1 only

Published 2021-07-19. Last modified 2026-06-17.