jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods

A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...

jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods

A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...

Joomla 2.5.x < 3.9.19 Multiple Vulnerabilities (5812-joomla-3-9-19)

According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.19. It is, therefore, affected by multiple vulnerabilities. - In Joomla! before 3.9.19, lack of input validation in the heading tag option of the Articles - Newsflash and Article...

Use of insecure jQuery version in OctoberCMS

Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. Patches Issue has been patched in Build 466 v1.0.466 by applying the recommended patch from @jquery. Workarounds Apply...

FreeBSD : drupal -- Multiple Vulnerabilities (c5ec57a9-9c2b-11ea-82b8-4c72b94353b5)

Drupal Security Team reports : The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are: ... Security issues in jQuerys DOM manipulation methods, as in .html, .append, and the...

Drupal 7.0.x < 7.70 / 7.0.x < 7.70 / 8.7.x < 8.7.14 / 8.8.x < 8.8.6 Multiple Vulnerabilities (drupal-2020-05-20)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.70, 7.0.x prior to 7.70, 8.7.x prior to 8.7.14, or 8.8.x prior to 8.8.6. It is, therefore, affected by multiple vulnerabilities. - In jQuery versions greater than or equal to 1.2 an...

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002

The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are ... security issues in jQuery’s DOM manipulation methods, as in .html, .append, and the others. Security advisories for...

jQuery 1.2 < 3.5.0 XSS Vulnerability

jQuery is prone to a cross-site scripting XSS vulnerability in jQuery.htmlPrefilter and related methods. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Cross-Site Scripting

Overview Versions of jquery prior to 3.5.0 are vulnerable to Cross-Site Scripting. Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute arbitrary JavaScript in a victim's browser. Recommendation...

Cross-Site Scripting (XSS)

jquery is vulnerable to cross-site scripting XSS. When passing a HTML containing elements to one of jQuery's DOM manipulation methods i.e. .html, .append, and others, untrusted code may potentially be executed...

Cross-Site Scripting (XSS)

jquery is vulnerable to cross-site scripting XSS. When passing a HTML from untrusted sources to one of jQuery's DOM manipulation methods i.e. .html, .append, and others, untrusted code may potentially be executed...

Cross-site Scripting (XSS)

Overview components/jquery is a jQuery JavaScript Library Affected versions of this package are vulnerable to Cross-site Scripting XSS. Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untruste...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS. Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. Remediation Upgrade maximebf/debugbar to...

000demo (>=1.0.0, <=1.1.0), 03-npm-abc (>=1.0.0, <=1.1.0) +6502 more potentially affected by CVE-2020-11023 via jquery (>=1.5.1, <=3.4.1)

jquery NPM version =1.5.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.2.1, =0.1.75, =0.2.0 - 4.yarntest 1.0.3 - 4design 0.0.1 and more Source cves: CVE-2020-11023 Source advisory: OSV:GHSA-JPCQ-CGW6-V4J6...

Potential XSS vulnerability in jQuery

Impact Passing HTML containing elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. Patches This problem is patched in jQuery 3.5.0. Workarounds To workaround this issue without...

Potential XSS vulnerability in jQuery

Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. Patches This problem is patched in jQuery 3.5.0. Workarounds To workaround the issue without upgrading, adding the...

GHSA-GXR4-XJJ5-5PX2 Potential XSS vulnerability in jQuery

Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. Patches This problem is patched in jQuery 3.5.0. Workarounds To workaround the issue without upgrading, adding the...

CVE-2020-11022

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. This problem is patched in jQuery 3.5.0...

UBUNTU-CVE-2020-11022

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. This problem is patched in jQuery 3.5.0...

Code injection

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. This problem is patched in jQuery 3.5.0...