CVEvulnerability

CVE-2019-10219

6.1 MEDIUM Published 2019-11-08 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2019-11-08
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.0 ([email protected])
6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Affected configurations

• redhat hibernate validator (< 6.0.18) • redhat hibernate validator 6.1.0 • redhat fuse 1.0 • redhat jboss data grid • redhat jboss enterprise application platform • redhat openshift application runtimes • redhat single sign-on • redhat jboss enterprise application platform 7.2 • redhat jboss enterprise application platform 7.3 • netapp active iq unified manager • netapp management services for element software and netapp hci • netapp snapcenter plug-in • netapp element • oracle access manager 11.1.2.3.0 • oracle access manager 12.2.1.3.0 • oracle access manager 12.2.1.4.0 • oracle agile engineering data management 6.2.1.0 • oracle agile product lifecycle analytics 3.6.1 • oracle agile product lifecycle management 9.3.3 • oracle agile product lifecycle management 9.3.6 • oracle agile product lifecycle management integration pack 3.6 • oracle airlines data model 12.1.1.0.0 • oracle airlines data model 12.2.0.1.0 • oracle application express 21.1.4 • oracle application performance management 13.4.1.0 • oracle application performance management 13.5.1.0 • oracle application testing suite 13.3.0.1 • oracle argus analytics 8.2.1 • oracle argus analytics 8.2.2 • oracle argus analytics 8.2.3 • oracle argus analytics 8.21 • oracle argus insight 8.2.1 • oracle argus insight 8.2.2 • oracle argus insight 8.2.3 • oracle argus safety 8.2.1 • oracle argus safety 8.2.2 • oracle argus safety 8.2.3 • oracle banking apis 18.1 • oracle banking apis 18.2 • oracle banking apis 18.3 • oracle banking apis 19.1 • oracle banking apis 19.2 • oracle banking apis 20.1 • oracle banking apis 21.1 • oracle banking deposits and lines of credit servicing 2.12.0 • oracle banking digital experience 17.2 • oracle banking digital experience 18.1 • oracle banking digital experience 18.3 • oracle banking digital experience 19.1 • oracle banking digital experience 19.2 • oracle banking digital experience 20.1 • oracle banking digital experience 21.1 • oracle banking enterprise default management 2.6.2 • oracle banking enterprise default management 2.7.0 • oracle banking enterprise default management 2.7.1 • oracle banking enterprise default management 2.10.0 • oracle banking enterprise default management 2.12.0 • oracle banking enterprise default managment (>= 2.3.0 <= 2.4.0) • oracle banking loans servicing 2.12.0 • oracle banking party management 2.7.0 … and 352 more

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References