CVE-2019-10219
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
- CVSS 3.1
- 6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS
- 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-25)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- netapp:active_iq_unified_manager
- netapp:element
- netapp:management_services_for_element_software_and_netapp_hci
- netapp:snapcenter_plug-in
- oracle:access_manager
- oracle:agile_engineering_data_management
- oracle:agile_product_lifecycle_analytics
- oracle:agile_product_lifecycle_management
- oracle:agile_product_lifecycle_management_integration_pack
- oracle:airlines_data_model
- oracle:application_express
- oracle:application_performance_management
- oracle:application_testing_suite
- oracle:argus_analytics
- oracle:argus_insight
- oracle:argus_safety
- oracle:banking_apis
- oracle:banking_deposits_and_lines_of_credit_servicing
- oracle:banking_digital_experience
- oracle:banking_enterprise_default_management
- oracle:banking_enterprise_default_managment
- oracle:banking_loans_servicing
- oracle:banking_party_management
- oracle:banking_platform
- oracle:bi_publisher
- oracle:big_data_spatial_and_graph
- oracle:business_activity_monitoring
- oracle:business_intelligence
- oracle:business_process_management_suite
- oracle:clinical
- oracle:commerce_guided_search
- oracle:commerce_platform
- oracle:communications_application_session_controller
- oracle:communications_billing_and_revenue_management
- oracle:communications_billing_and_revenue_management_elastic_charging_engine
- oracle:communications_calendar_server
- oracle:communications_cloud_native_core_automated_test_suite
- oracle:communications_cloud_native_core_binding_support_function
- oracle:communications_cloud_native_core_console
- oracle:communications_cloud_native_core_network_function_cloud_native_environment
- oracle:communications_cloud_native_core_network_repository_function
- oracle:communications_cloud_native_core_policy
- oracle:communications_cloud_native_core_security_edge_protection_proxy
- oracle:communications_cloud_native_core_service_communication_proxy
- oracle:communications_cloud_native_core_unified_data_repository
- oracle:communications_contacts_server
- oracle:communications_converged_application_server_-_service_controller
- oracle:communications_convergence
- oracle:communications_convergent_charging_controller
- oracle:communications_data_model
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m8p2-495h-ccmh | Maven | org.hibernate.validator:hibernate-validator | >=6.1.0.Alpha1 <6.1.0.Alpha6 | 6.1.0.Alpha6 |
| GHSA-m8p2-495h-ccmh | Maven | org.hibernate.validator:hibernate-validator | >=6.0.0.Alpha1 <6.0.18.Final | 6.0.18.Final |
| GHSA-m8p2-495h-ccmh | Maven | org.hibernate:hibernate-validator | >=6.1.0.Alpha1 <6.1.0.Alpha6 | 6.1.0.Alpha6 |
| GHSA-m8p2-495h-ccmh | Maven | org.hibernate:hibernate-validator | >=6.0.0.Alpha1 <6.0.18.Final | 6.0.18.Final |