Fedora 31 : drupal7 (2020-fbb94073a1)

https://www.drupal.org/project/drupal/releases/7.72 - Drupal core - Critical - Cross Site Request Forgery - SA-CORE-2020-004 / CVE-2020-13663 - https://www.drupal.org/project/drupal/releases/7.71 - https://www.drupal.org/project/drupal/releases/7.70 - Drupal core - Moderately critical - Cross...

Security Bulletin: IBM Kenexa LCMS Premier On Premise - [All] jQuery (Publicly disclosed vulnerability) CVE-2020-11023, CVE-2020-11022

Summary We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. These have been addressed in LCMS Premier 14.0 version. Vulnerability Details CVEID: CVE-2020-11023 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper...

Security Bulletin: Multiple vulnerabilities in jQuery affect IBM WIoTP MessageGateway (CVE-2020-11023, CVE-2020-11022)

Summary There are multiple vulnerabilities in jQuery that affect IBM WIoTP MessageGateway. Vulnerability Details CVEID: CVE-2020-11023 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the option elements. A remote attacker could...

Security Bulletin: JQuery as used by IBM QRadar Network Packet Capture is vulnerable to Cross Site Scripting (XSS) (CVE-2020-11023, CVE-2020-11022)

Summary JQuery as used by IBM QRadar Network Packet Capture is vulnerable to Cross Site Scripting XSS Vulnerability Details CVEID: CVE-2020-11023 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the option elements. A remote attack...

FreeBSD : Cacti -- multiple vulnerabilities (cd2dc126-cfe4-11ea-9172-4c72b94353b5)

Cacti developers reports : Multiple fixes for bundled jQuery to prevent code exec CVE-2020-11022, CVE-2020-11023. PHPMail contains a escaping bug CVE-2020-13625. SQL Injection via color.php in Cacti CVE-2020-14295. C Tenable Network Security, Inc. The descriptive text and package checks in this...

GLSA-202007-03 : Cacti: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202007-03 Cacti: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for details...

openSUSE Security Update : cacti / cacti-spine (openSUSE-2020-1060)

This update for cacti, cacti-spine fixes the following issues : - cacti 1.2.13 : - Query XSS vulnerabilities require vendor package update CVE-2020-11022 / CVE-2020-11023 - Lack of escaping on some pages can lead to XSS exposure - Update PHPMailer to 6.1.6 CVE-2020-13625 - SQL Injection...

Cacti -- multiple vulnerabilities

Cacti developers reports: Multiple fixes for bundled jQuery to prevent code exec CVE-2020-11022, CVE-2020-11023. PHPMail contains a escaping bug CVE-2020-13625. SQL Injection via color.php in Cacti CVE-2020-14295...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.5 container image security update

An update is now available for Red Hat OpenShift Container Platform 4.5. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.1 security update

A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Security Bulletin: IBM Tivoli Netcool Impact is affected by jQuery vulnerabilities (CVE-2020-11022, CVE-2020-11023)

Summary IBM Tivoli Netcool Impact has addressed the following jQuery vulnerabilities. Vulnerability Details CVEID: CVE-2020-11022 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the jQuery.htmlPrefilter method. A remote attacker...

Security Bulletin: IBM API Connect is impacted by vulnerabilities in Drupal (CVE-2020-11022 CVE-2020-11023)

Summary IBM API Connect has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2020-11022 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the jQuery.htmlPrefilter method. A remote attacker could exploit this...

Fedora: Security Advisory for drupal8 (FEDORA-2020-36d2db5f51)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cacti <= 1.2.12 Multiple Vulnerabilities - Linux

Cacti is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 32 : drupal8 (2020-36d2db5f51)

https://www.drupal.org/project/drupal/releases/8.9.0 - https://www.drupal.org/project/drupal/releases/8.8.7 - https://www.drupal.org/project/drupal/releases/8.8.6 - SA-CORE-2020-002 / CVE-2020-11022 / CVE-2020-11023 - https://www.drupal.org/project/drupal/releases/8.8.5 Note that Tenable Network...

Drupal 7.x < 7.70 Multiple Vulnerabilities

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.70, 8.7.x prior to 8.7.14 or 8.8.x prior to 8.8.6. It is, therefore, affected by multilple vulnerabilities : - Two Cross-Site Scripting XSS vulnerabilities in jQuery CVE-2020-11022 ...

Drupal 8.7.x < 8.7.14 Multiple Vulnerabilities

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.70, 8.7.x prior to 8.7.14 or 8.8.x prior to 8.8.6. It is, therefore, affected by multilple vulnerabilities : - Two Cross-Site Scripting XSS vulnerabilities in jQuery CVE-2020-11022 ...

Drupal 8.8.x < 8.8.6 Multiple Vulnerabilities

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.70, 8.7.x prior to 8.7.14 or 8.8.x prior to 8.8.6. It is, therefore, affected by multilple vulnerabilities : - Two Cross-Site Scripting XSS vulnerabilities in jQuery CVE-2020-11022 ...

Use of insecure jQuery version in OctoberCMS

Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. Patches Issue has been patched in Build 466 v1.0.466 by applying the recommended patch from @jquery. Workarounds Apply...

Update jQuery to avoid CVE-2020-11022 and CVE-2020-11023

h3. Issue Summary Currently, Jira runs with jQuery version 2.2.4, which is susceptible to the following vulnerabilities: https://nvd.nist.gov/vuln/detail/CVE-2020-11023 https://nvd.nist.gov/vuln/detail/CVE-2020-11022 h3. Steps to Reproduce - h3. Expected Results We should update the version of...