OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
Affected Platforms
Oracle Banking Party ManagementOracle Banking PlatformOracle Middleware Common Libraries And ToolsAntisamy Project AntisamyOracle Retail Back OfficeOracle Insurance Policy AdministrationOracle Retail Central OfficeOracle Banking Enterprise Default ManagementNetapp Active Iq Unified ManagerOracle Retail Returns Management