CVE-2024-10001: Improper Control of Generation of Code

A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the identity property in the message handling function. This enabled the exfiltration of sensitive data by manipulating the DOM, including...

CISA Adds Five-Year-Old jQuery XSS Flaw to Exploited Vulnerabilities List

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday placed a now-patched security flaw impacting the popular jQuery JavaScript library to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The medium-severity vulnerability is...

CVE-2024-43733

Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting XSS vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user inpu...

CVE-2024-43719

CVE-2024-43719 affects Adobe Experience Manager (AEM) versions 6.5.21 and earlier. The vulnerability is a DOM-based Cross-Site Scripting (XSS) issue where an attacker can inject malicious scripts by manipulating a DOM element through a crafted URL or user input, with execution occurring in the vi...

CVE-2024-52839 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting XSS vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user inpu...

CVE-2024-43723

CVE-2024-43723 affects Adobe Experience Manager (AEM) 6.5.21 and earlier with a DOM-based Cross-Site Scripting (XSS) flaw. The vulnerability arises when a DOM element is manipulated via crafted URLs or user input, allowing injection of scripts that run in the victim’s browser context after render...

CVE-2024-52840 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting XSS vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user inpu...

CVE-2024-52837

Adobe Experience Manager (AEM) versions 6.5.21 and earlier are affected by a DOM-based XSS vulnerability caused by unsanitized DOM manipulation via crafted URLs or user input. Exploitation can lead to arbitrary code execution in the victim’s browser session and requires user interaction. Remediat...

PT-2024-9733 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.21 and earlier Description: The issue is related to a DOM-based Cross-Site Scripting XSS vulnerability in Adobe Experience Manager. This vulnerability could be exploited by an attacker to execute arbitrar...

CVE-2021-3988 Cross-site Scripting (XSS) in janeczku/calibre-web

A Cross-site Scripting XSS vulnerability exists in janeczku/calibre-web, specifically in the file editbooks.js. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization,...

CentOS 7 : ipa (RHSA-2021:0860)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0860 advisory. - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to on...

Cross Site Scripting(XSS)

Vite is vulnerable to Cross Site ScriptingXSS. The vulnerability is due to improper handling of the document.currentScript lookup in Vite's script imports for cjs, iife, or umd output formats. It allows attackers to manipulate DOM elements, such as using unsanitized attributes in HTML tags, to...

Cross-site Scripting (XSS)

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via manipulation of the document object model DOM. An admin attacker can execute arbitrary JavaScript code in the context of another user's browser...

GHSA-JMH9-6RJQ-GJH9 Vulnerable embedded jQuery Version

Summary PIMCore uses the JavaScript library jQuery in version 3.4.1. This version is vulnerable to cross-site-scripting XSS. Details In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it to one of...

RHEL 7 : ipa (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods CVE-2020-11023 - jQue...

RHEL 6 : jquery (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jquery: Cross-site scripting XSS via HTML tags containing whitespaces CVE-2020-7656 - In jQuery versions...

RHEL 8 : jquery (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods CVE-2020-11023 - jQue...

RHEL 6 / 7 / 8 : Red Hat AMQ Interconnect 1.9.0 (RHSA-2020:4211)

The remote Redhat Enterprise Linux 6 / 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4211 advisory. Red Hat AMQ Interconnect is a component of the AMQ 7 product family. AMQ Interconnect provides flexible routing of messages between...

BIT-DRUPAL-2020-11022 jQuery has a potential XSS vulnerability

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. This problem is patched in jQuery 3.5.0...

Rocky Linux 8 : idm:DL1 and idm:client (RLSA-2021:1846)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:1846 advisory. - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one...