The vulnerability of the modular library for simplifying the development of JavaScript or AJAX-based applications and websites allows attackers to compromise the confidentiality, integrity, and accessibility of protected information due to improper coding or the concealment of output data.

🗓️ 10 Jun 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Dojo Toolkit modular library flaw in JavaScript applications from improper coding or output concealment, risking data confidentiality.

Reporter	Title	Published	Views	Family All 63
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by an unescaped string injection in Dojo Toolkit	8 Dec 202021:03	–	ibm
IBM Security Bulletins	Security Bulletin: A Security vulnerability found in Dojo Toolkit which is shipped with IBM Security Identity Management product (CVE-2018-15494)	11 Oct 202218:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM WebSphere eXtreme Scale Liberty Deployment.	21 Mar 202318:07	–	ibm
IBM Security Bulletins	Security Bulletin:Due to use of Dojo Toolkit before 1.14 in IBM Tivoli Network Manager is vulnerable to unescaped string injection in dojox/Grid/DataGrid(CVE-2018-15494)	4 Jul 202212:52	–	ibm
IBM Security Bulletins	Security Bulletin: XSS vulerability in Dojo affects IBM Tivoli Business Service Manager (CVE-2018-15494)	5 Nov 202121:06	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Dojo may affect IBM Cúram Social Program Management (CVE-2018-15494)	25 Nov 202117:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Open Source software used by Cloud Pak System	31 Mar 202314:10	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in Dojo and jQuery might affect IBM Business Automation Workflow and IBM Business Process Manager (BPM)	14 Sep 202215:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos TM1 is affected by multiple vulnerabilities (CVE-2018-15494, CVE-2019-4245)	29 Jun 201902:10	–	ibm
IBM Security Bulletins	Security Bulletin: Financial Transaction Manager for ACH Services is affected by a potential cross-site scripting (XSS) vulnerability (CVE-2018-15494)	12 Sep 201913:42	–	ibm

Vulners

Node

dojo dojo_toolkitRange<1.14

OR

ibm ibm_security_guardium_key_lifecycle_managerRange<4.1.1-iss-sklm-fp0006

Source	Link
ibm	www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-analytics-has-addressed-multiple-vulnerabilities-3/
dojotoolkit	www.dojotoolkit.org/blog/dojo-1-14-released
github	www.github.com/dojo/dojox/pull/283
lists	www.lists.debian.org/debian-lts-announce/2018/09/msg00002.html
ibm	www.ibm.com/support/pages/node/6614509
web	www.web.nvd.nist.gov/view/vuln/detail

23 Mar 2023 00:00Current

7.7High risk

Vulners AI Score7.7

CVSS 27.5

CVSS 39.8

EPSS0.02611

Dojo Toolkit modular library JavaScript applications asynchronous JavaScript improper coding output concealment data confidentiality