{"cve":"CVE-2021-3529","nvd":{"published":"2021-06-02T17:15:08.660","modified":"2026-06-17T04:05:17.997","status":"Modified","description":"A flaw was found in noobaa-core in versions before 5.7.0. This flaw results in the name of an arbitrarily URL being copied into an HTML document as plain text between tags, including potentially a payload script. The input was echoed unmodified in the application response, resulting in arbitrary JavaScript being injected into an application's response. The highest threat to the system is for confidentiality, availability, and integrity.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","score":7.1},"cwes":["CWE-79"],"references":["https://bugzilla.redhat.com/show_bug.cgi?id=1950479","https://bugzilla.redhat.com/show_bug.cgi?id=1950479"],"products":["redhat:noobaa-operator","redhat:openshift_container_platform"],"source":"nvd","synced_at":"2026-10-19T21:18:09.669877188+00:00"},"epss":{"cve":"CVE-2021-3529","score":0.007,"percentile":0.53171,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}