495 matches found
IBM WebSphere Application Server 8.0.0.x < 8.0.0.11 / 8.5.x < 8.5.5.6 XSS (CVE-2014-8917)
The IBM WebSphere Application Server running on the remote host is version 8.0.0.x prior to 8.0.0.11 or 8.5.0.x prior to 8.5.5.6. It is, therefore, affected by a cross-site scripting vulnerability in the Dojo Toolkits subcomponent due to improper sanitization of user-supplied input. An...
Security Bulletin: IBM QRadar Incident Forensics is vulnerable to using component with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2018-8009 DESCRIPTION: Apache Hadoop could could allow a remote attacker to traverse directories on the system. By persuading a...
@dojo/cli-build-app (>=8.0.0-alpha.1, <=8.0.1), hey-you (3.0.10) +2 more potentially affected by CVE-2020-15215 via electron (10.1.1)
electron NPM version 10.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - @dojo/cli-build-app =8.0.0-alpha.1, =2.0.1, =2.0.2 - sidewinder-viewer 0.6.1 Source cves: CVE-2020-15215 Source advisory: OSV:GHSA-56PC-6JQP-XQJ...
Cross-Site Scripting in dojo
Versions of dojo prior to 1.2.0 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize HTML code in user-controlled input, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.2.0 or later...
dijit (>=1.7.11, <=1.8.14), dojox (>=1.8.13, <=1.8.14) +1 more potentially affected by CVE-2015-5654 via dojo (>=1.7.11, <=1.8.14)
dojo NPM version =1.7.11, =1.7.11, =1.8.13, =0.1.1, =0.1.3 Source cves: CVE-2015-5654 Source advisory: OSV:GHSA-P82G-2XPP-M5R3...
Security Bulletin: A Security Vulnerability exists in the Dojo runtime that affects Rational Software Architect and Rational Software Architect for Websphere Software
Summary The dojox/form/resources/fileuploader.swf, dojox/form/resources/uploader.swf, dojox/av/resources/audio.swf, and dojox/av/resources/video.swf files exhibit an cross-site scripting XSS vulnerability. Any web application using the IBM Dojo Toolkit and providing those files might be subject t...
GHSA-39CX-XCWJ-3RC4 Cross-Site Scripting in dojo
Affected versions of dojo are susceptible to a cross-site scripting vulnerability in the dijit.Editor and textarea components, which execute their contents as Javascript, even when sanitized. Recommendation Update to version 1.1.0 or later...
Cross-Site Scripting in dojo
Affected versions of dojo are susceptible to a cross-site scripting vulnerability in the dijit.Editor and textarea components, which execute their contents as Javascript, even when sanitized. Recommendation Update to version 1.1.0 or later...
Vulnerability of the Cluster component: Packaging (dojo) of the Oracle MySQL Cluster database management system, which allows attackers to compromise data integrity.
The vulnerability of the Cluster: Packaging dojo component of the Oracle MySQL Cluster database management system exists due to the failure to take measures to neutralize specific elements. Exploiting this vulnerability can allow a malicious actor, operating remotely, to compromise the integrity ...
Security Bulletin: Vulnerabilities in Dojo affect IBM Spectrum Protect for Virtual Environments (CVE-2020-5259, CVE-2020-5258)
Summary Dojo could allow a remote attacker to inject arbitrary code on the system which affects IBM Spectrum Protect for Virtual Environments. Vulnerability Details CVEID: CVE-2020-5259 DESCRIPTION: Dojo dojox could allow a remote attacker to inject arbitrary code on the system, caused by a...
Security Bulletin: IBM Content Navigator is vulnerable to a Prototype Pollution vulnerability
Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-5259 DESCRIPTION: Dojo dojox could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By injecting other values, an attacker could...
Security Bulletin: IBM Tivoli Netcool Impact is affected by IBM Dojo Toolkit vulnerabilities (CVE-2020-5258, CVE-2020-5259)
Summary IBM Tivoli Netcool Impact has addressed the following IBM Dojo Toolkit vulnerabilities. Vulnerability Details CVEID: CVE-2020-5259 DESCRIPTION: Dojo dojox could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By injecting other values,...
Security Bulletin: IBM Tivoli Netcool Impact is affected by an IBM Dojo Toolkit vulnerability (CVE-2019-10785)
Summary IBM Tivoli Netcool Impact has addressed the following IBM Dojo Toolkit vulnerability. Vulnerability Details CVEID: CVE-2019-10785 DESCRIPTION: Dojox is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the dojox.xmpp.util.xmlEncode. A remote...
Cross-site Scripting in dijit editor's LinkDialog plugin
Impact XSS possible for users of the Dijit Editor's LinkDialog plugin Patches Yes, 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3 Workarounds Users may apply the patch made in these releases. For more information If you have any questions or comments about this advisory, open an issue in dojo/di...
Security Bulletin: Vulnerabilities in Dojo affect IBM Spectrum Protect Operations Center (CVE-2020-5259, CVE-2020-5258)
Summary Dojo could allow a remote attacker to inject arbitrary code on the system which affects IBM Spectrum Protect Operations Center. Vulnerability Details CVEID: CVE-2020-5259 DESCRIPTION: Dojo dojox could allow a remote attacker to inject arbitrary code on the system, caused by a prototype...
Security Bulletin: Vulnerability in Dojo Toolkit affecting Watson Knowledge Catalog for IBM Cloud Pak for Data
Summary Unescaped string injection in dojox/Grid/DataGrid is affecting some of the Watson Knowledge Catalog for IBM Cloud Pak for Data web UIs. Vulnerability Details CVEID: CVE-2018-15494 DESCRIPTION: Dojo Toolkit is vulnerable to cross-site scripting, caused by improper validation of user-suppli...
dojo-toolkit.33424.n3.nabble.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1181877 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Updated dojo packages fix security vulnerability
Updated dojo package fixes security vulnerabilities: In affected versions of dojo, the deepCopy method is vulnerable to prototype Pollution. An attacker could manipulate these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other valu...
MGASA-2020-0232 Updated dojo packages fix security vulnerability
Updated dojo package fixes security vulnerabilities: In affected versions of dojo, the deepCopy method is vulnerable to prototype Pollution. An attacker could manipulate these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other valu...
Debian: Security Advisory (DLA-2139-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...