Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
laminasLaminas Project SecurityLP-2020-02
HistoryApr 01, 2020 - 9:30 p.m.

XSS and RCE vectors in laminas-api-tools/api-tools-documentation-swagger

2020-04-0121:30:00
Laminas Project Security
getlaminas.org
24

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

82.7%

JSON

The package laminas-api-tools/api-tools-documentation-swagger bundles a number of javascript assets for purposes of providing API documentation. Some of these assets had reported XSS (cross-site scripting) and RCE (remote code execution) vulnerabilities:

Affected versions

  • laminas-api-tools/api-tools-documentation-swagger versions prior to 1.3.1.

Action Taken

The bundled assets were updated to known-good versions.

The patch resolving the vulnerability is available in laminas-api-tools/api-tools-documentation-swagger 1.3.1.

We highly recommend all users of the package to update immediately.

Related

veracode 1
debiancve 2
prion 2
nodejs 1
redhatcve 1
osv 6
ubuntucve 2
github 2
cve 3
f5 1
ibm 48
ics 3
openvas 4
attackerkb 1
alpinelinux 1
cloudfoundry 1
nessus 42
freebsd 2
tenable 1
hackerone 1
atlassian 3
fortinet 1
archlinux 2
redhat 11
laminas 1
suse 1
amazon 2
oraclelinux 3
rocky 2
thn 1
almalinux 2
centos 1
oracle 9
veracode
veracode
Prototype Pollution
2019-09-25 02:59:31
debiancve
debiancve
CVE-2019-19919
2019-12-20 23:15:00
CVE-2015-9251
2018-01-18 23:29:00
prion
prion
Remote code execution
2019-12-20 23:15:00
Cross site scripting
2018-01-18 23:29:00
nodejs
nodejs
Prototype Pollution
2019-09-16 15:14:43
redhatcve
redhatcve
CVE-2019-19919
2020-01-10 20:38:59
osv
osv
Prototype Pollution in handlebars
2019-12-26 17:58:13
Cross-Site Scripting (XSS) in jquery
2018-01-22 13:32:06
CVE-2015-9251
2018-01-18 23:29:00
ubuntucve
ubuntucve
CVE-2019-19919
2019-12-20 00:00:00
CVE-2015-9251
2018-01-18 00:00:00
github
github
Prototype Pollution in handlebars
2019-12-26 17:58:13
Cross-Site Scripting (XSS) in jquery
2018-01-22 13:32:06
cve
cve
CVE-2019-19919
2019-12-20 23:15:00
CVE-2015-9251
2018-01-18 23:29:00
CVE-2017-16012
2018-06-04 19:29:00
f5
f5
K29562170 : jQuery vulnerability CVE-2015-9251
2020-02-19 00:00:00
ibm
ibm
Security Bulletin: A Security Vulnerability affects IBM® Cloud Private (CVE-2015-9251)
2018-11-19 15:40:01
Security Bulletin: A cross-site scripting vulnerability in JQuery affects IBM InfoSphere Information Server
2021-07-09 13:44:03
Security Bulletin: IBM API Connect V5 is vulnerable to cross-site scripting in jQuery (CVE-2015-9251)
2021-01-04 22:53:16
ics
ics
AVEVA InTouch Access Anywhere
2018-07-31 12:00:00
Philips Vue PACS (Update C)
2023-02-21 12:00:00
Pepperl+Fuchs WirelessHART-Gateway
2022-04-07 12:00:00
openvas
openvas
jQuery < 3.0.0 XSS Vulnerability
2018-11-01 00:00:00
Tenable Nessus Network Monitor < 5.11.0 Multiple Vulnerabilities (TNS-2019-08)
2022-12-20 00:00:00
openSUSE: Security Advisory for Recommended (openSUSE-SU-2020:0395-1)
2020-03-29 00:00:00
attackerkb
attackerkb
CVE-2015-9251
2018-01-18 00:00:00
alpinelinux
alpinelinux
CVE-2015-9251
2018-01-18 23:29:00
cloudfoundry
cloudfoundry
CVE-2015-9251: UAA contains vulnerable jQuery version | Cloud Foundry
2019-07-08 00:00:00
nessus
nessus
FreeBSD : rt -- XSS via jQuery (416ca0f4-3fe0-11e9-bbdd-6805ca0b3d42)
2019-03-07 00:00:00
JQuery < 3.0.0 XSS
2019-05-15 00:00:00
FreeBSD : RDoc -- multiple jQuery vulnerabilities (ed8d5535-ca78-11e9-980b-999ff59c22ea)
2019-08-30 00:00:00
freebsd
freebsd
rt -- XSS via jQuery
2019-03-05 00:00:00
RDoc -- multiple jQuery vulnerabilities
2019-08-28 00:00:00
tenable
tenable
[R2] Tenable.sc 5.19.0 Fixes Multiple Third-party Vulnerabilities
2021-07-22 18:11:52
hackerone
hackerone
Ruby: Ruby is shipping a vulnerable jQuery
2019-03-30 14:10:34
atlassian
atlassian
Jira uses vulnerable jQuery version CVE-2015-9251
2020-04-20 13:29:57
The jQuery version used in JIRA needs to be updated
2015-05-18 09:31:54
Update jQuery to avoid CVE-2020-11022, CVE-2020-11023, and CVE-2015-9251
2021-02-16 18:28:38
fortinet
fortinet
Protect
2019-04-10 00:00:00
archlinux
archlinux
[ASA-201910-4] ruby-rdoc: cross-site scripting
2019-10-02 00:00:00
[ASA-201910-5] ruby2.5: multiple issues
2019-10-02 00:00:00
redhat
redhat
(RHSA-2020:0481) Important: Red Hat JBoss Fuse/A-MQ 6.3 R15 security and bug fix update
2020-02-12 15:24:44
(RHSA-2020:0729) Important: Red Hat Data Grid 7.3.5 security update
2020-03-05 13:05:49
(RHSA-2023:1334) Critical: Red Hat Process Automation Manager 7.13.2 security update
2023-03-20 09:11:08
laminas
laminas
XSS vectors in laminas-api-tools/api-tools
2020-04-01 21:30:00
suse
suse
Recommended update for ruby2.5 (important)
2020-03-28 00:00:00
amazon
amazon
Important: ruby24
2020-08-26 23:09:00
Medium: ipa
2020-10-22 17:40:00
oraclelinux
oraclelinux
ipa security, bug fix, and enhancement update
2020-10-06 00:00:00
idm:DL1 and idm:client security, bug fix, and enhancement update
2020-11-10 00:00:00
pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
2020-11-10 00:00:00
rocky
rocky
idm:DL1 and idm:client security, bug fix, and enhancement update
2020-11-03 12:25:36
pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
2020-11-03 12:29:58
thn
thn
Critical Flaws Reported in Philips Vue PACS Medical Imaging Systems
2021-07-09 07:00:00
almalinux
almalinux
Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update
2020-11-03 12:25:36
Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
2020-11-03 12:29:58
centos
centos
ipa, python2 security update
2020-10-20 18:15:27
oracle
oracle
Oracle Critical Patch Update Advisory - October 2019
2020-01-22 00:00:00
Oracle Critical Patch Update Advisory - January 2019
2019-01-15 00:00:00
Oracle Critical Patch Update Advisory - July 2019
2019-07-16 00:00:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

82.7%

JSON
Related for LP-2020-02
veracode1debiancve2prion2nodejs1redhatcve1osv6ubuntucve2github2cve3f51ibm48ics3openvas4attackerkb1alpinelinux1cloudfoundry1nessus42freebsd2tenable1hackerone1atlassian3fortinet1archlinux2redhat11laminas1suse1amazon2oraclelinux3rocky2thn1almalinux2centos1oracle9