CVE-2021-23445

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-234467.5The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Ser CVE-2021-234476.1This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content CVE-2021-234489.8All versions of package config-handler are vulnerable to Prototype Pollution when loading config files.CVE-2021-2344910.0This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host CVE-2021-23455.4Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Fra CVE-2021-234509.8All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.CVE-2021-234519.8The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which CVE-2021-234529.8This affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.CVE-2021-23465.4Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Fra CVE-2021-234607.5The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.CVE-2021-234639.1The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.Jdbc CVE-2021-23475.2Vulnerability in the Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management). The supported version