CVE-2016-10006

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/95101Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037532Third Party Advisory, VDB Entry
https://github.com/nahsra/antisamy/issues/2Patch, Vendor Advisory
http://www.securityfocus.com/bid/95101Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037532Third Party Advisory, VDB Entry
https://github.com/nahsra/antisamy/issues/2Patch, Vendor Advisory

Timeline

Published: Dec 24, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-100077.2SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated admini CVE-2016-100087.2SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenti CVE-2016-100097.3Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKC CVE-2016-10018.8Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11 CVE-2016-100107.0sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local us CVE-2016-100116.2authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users CVE-2016-100127.8The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check CVE-2016-100137.8Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emula CVE-2016-10028.8Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR CVE-2016-100246.0Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the inst CVE-2016-100255.5VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to CVE-2016-100267.5ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges p