CVE-2021-35043

MEDIUM

6.1

CVSS Score

Published: July 19, 2021 at 02:53 PM UTC

Updated: June 17, 2026 at 03:57 AM UTC

11 products affected across 3 vendorsActive IQ Unified ManagerBanking PlatformInsurance Policy Administration

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.1

Exploit prediction

EPSS 2%

Description

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Antisamy · Antisamy Project

95%

v < 1.6.4

Affected range stops below 1.6.4, so it looks safe — our inference, not a vendor statement

Active IQ Unified Manager · NetAppnpm

95%

All versions

Banking Enterprise Default Management · Oracle

95%

2.10.0 2.12.0 2.6.2 2.7.0 2.7.1

Banking Enterprise Default Managment · Oracle

95%

2.3.0 ≤ v ≤ 2.4.0

Banking Party Management · Oracle

95%

2.7.0

Banking Platform · Oracledrupal

95%

2.3.0 ≤ v ≤ 2.4.12.6.2 2.7.0 2.7.1

Insurance Policy Administration · Oracle

95%

11.0.2 11.1.0 11.2.8 11.3.0 11.3.1

Middleware Common Libraries and Tools · Oracle

95%

12.2.1.3.0 12.2.1.4.0

Retail Back Office · Oracledrupal

95%

14.0 14.1

Retail Central Office · Oracle

95%

14.0 14.1

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references