The vulnerability of the tooltip and popover components in Bootstrap’s website and web application creation tools allows attackers to execute cross-site scripting attacks.

🗓️ 21 May 2020 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Bootstrap tooltip and popover vulnerabilities enable cross-site scripting from weak site protections.

Reporter	Title	Published	Views	Family All 176
IBM Security Bulletins	Security Bulletin: There are several vulnerabilities in Bootstrap used by IBM Maximo Asset Management	4 Apr 202316:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found on thirdparty libraries used by IBM® MobileFirst Platform	26 Mar 202503:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in bootstrap.js may affect IBM Business Automation Workflow	5 Jun 202320:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Governance	11 Jan 202416:41	–	ibm
IBM Security Bulletins	Security Bulletin: User Behavior Analytics application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	20 Nov 202413:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	6 Jul 202318:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Workflow Management (EWM) vulnerabilities CVE-2020-28500, CVE-2021-23337, CVE-2020-8203	24 Apr 202314:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA - Vulnerabilities addressed in IBM® License Key Server	16 Oct 202407:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Information Queue uses components with known vulnerabilities (CVE-2019-8331, CVE-2019-11358)	7 Apr 202016:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Cross-site Scripting in Ceph (CVE-2018-20677, CVE-2018-20676, CVE-2019-8331, CVE-2018-14042, CVE-2018-14040, CVE-2016-10735)	5 Aug 202420:00	–	ibm

Vulners

Node

red_hat red_hat_single_sign-onMatch7.3

OR

red_hat red_hat_virtualization_engineMatch4.3

OR

getbootstrap bootstrapRange<3.4.1

OR

getbootstrap bootstrapRange4.3.0–4.3.1

OR

broadcom vmware_tanzu_operations_managerRange2.4–2.4.5

OR

broadcom vmware_tanzu_operations_managerRange2.3–2.3.11

OR

broadcom vmware_tanzu_operations_managerRange2.2–2.2.19

Source	Link
access	www.access.redhat.com/security/cve/cve-2019-8331
lists	www.lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@%3Cdev.flink.apache.org%3E
lists	www.lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3Cuser.flink.apache.org%3E
lists	www.lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
lists	www.lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@%3Cuser.flink.apache.org%3E
lists	www.lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@%3Cdev.superset.apache.org%3E
lists	www.lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@%3Cuser.flink.apache.org%3E
lists	www.lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
lists	www.lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
blog	www.blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/

21 May 2020 00:00Current

6.2Medium risk

Vulners AI Score6.2

CVSS 25.8

CVSS 36.1

EPSS0.1686

Bootstrap tooltip Bootstrap popover cross site scripting weak site protections