VRT 391,810 CVEs tracked · 15,472 in RASP scope · data as of 46 minutes ago
Reset
More filters (1)
Columns
Oracle product: Oracle Fusion Middleware / Third Party (jsoup)✕
Overview 1 match, all in RASP scope, all protected, all CISA SSVC · 0 KEV · 0 public PoC · 0 EPSS ≥ 0.5 · 0 disputed
1match, all in RASP scope, all protected, all CISA SSVC 0KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0% 0disputed0.0%
Critical 0 0.0% High 0 0.0% Medium 1 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
Protected by RASP 1 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% No fix identified 0 0.0% Mitigated by environment configuration 0 0.0% Queued for review 0 0.0% Not applicable 0 0.0% Out of RASP scope 0 0.0% Rejected 0 0.0%
blocked by ARMR today 1 100.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited in the wild 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 100.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / month
Unknown: 0None: 0Low: 0Medium: 1High: 0Critical: 0 Rejected: 0Out of RASP scope: 0Not applicable: 0Queued for review: 0Mitigated by environment configuration: 0No fix identified: 0No exploit published: 0Mitigation candidate: 0Rule in development: 0Protected by RASP: 1 unrecorded: 0not established: 0not blocked: 0blocked by ARMR today: 1 No public exploit: 0Forecast only: 0Proof of concept only: 1Working exploit published: 0Exploited in the wild: 0 August 2022: 1 CVE
Aug 22
1 match CSV JSON
CVE Severity Published▾ Status Exploitation Description
CVE-2022-36033 Medium 2022-08-29 Protected by RASP Proof of concept only jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible. This issue is patched in jsoup 1.15.3. Users should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version. To remediate this issue without immediately upgrading: - disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs - ensure an appropriate [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.)