CVE-2020-5258

CVE-2020-5258 affects the Dojo NPM package where the deepCopy function is vulnerable to Prototype Pollution. The root cause is injection of properties into native JavaScript prototypes, allowing an attacker to mutate a base object’s prototype. Patched versions are 1.12.8, 1.13.7, 1.14.6, 1.15.3 a...

CVE-2020-5258 Prototype pollution in dojo

In affected versions of dojo NPM package, the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or...

CVE-2020-5258

In affected versions of dojo NPM package, the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or...

CVE-2020-5258

creationtimestamp| type| source ---|---|--- 2020-03-10 17:29:40+00:00| published-proof-of-concept| https://github.com/dojo/dojo/security/advisories/GHSA-jxfh-8wgv-vfr2...

CVE-2020-5258: Improper Control of Generation of Code

In affected versions of dojo NPM package, the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or...

MGASA-2020-0126 Updated dojo packages fix security vulnerability

Updated dojo package fixes security vulnerability: dojox was vulnerable to Cross-site Scripting. This was due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them CVE-2019-10785...

Updated dojo packages fix security vulnerability

Updated dojo package fixes security vulnerability: dojox was vulnerable to Cross-site Scripting. This was due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them CVE-2019-10785...

bryaktestgrid (>=0.0.1, <=0.0.6), dojo-rql (>=0.1.0, <=0.3.2) +1 more potentially affected by CVE-2020-5259 via dojox (1.11.2)

dojox NPM version 1.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on dojox and may be impacted: - bryaktestgrid =0.0.1, =0.1.0, =0.0.1, =0.5.24 Source cves: CVE-2020-5259 Source advisory: SNYK:JS-DOJOX-559225...

@agrc/helpers (>=1.0.0, <=1.0.1), @dojo/interop (>=4.0.0-alpha.1, <=7.0.0) +3 more potentially affected by CVE-2020-5258 via dojo (>=1.13.0, <=1.13.6)

dojo NPM version =1.13.0, =1.0.0, =4.0.0-alpha.1, =0.1.10, =1.13.0, =1.13.0, =1.13.6 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

dijit (>=1.14.0, <=1.14.5), dojox (>=1.14.0, <=1.14.5) potentially affected by CVE-2020-5258 via dojo (>=1.14.0, <=1.14.5)

dojo NPM version =1.14.0, =1.14.0, =1.14.0, =1.14.5 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

Prototype Pollution

Overview dojo is a foundation package for the Dojo 1 Toolkit. While still being maintained, new development is primarily focused on modern Dojo. Affected versions of this package are vulnerable to Prototype Pollution. The deepCopy method within dojo could be tricked into adding or modifying...

dijit (>=1.15.0, <=1.15.2), dojox (>=1.15.0, <=1.15.2) potentially affected by CVE-2020-5258 via dojo (>=1.15.0, <=1.15.2)

dojo NPM version =1.15.0, =1.15.0, =1.15.0, =1.15.2 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

bryaktestgrid (>=0.0.1, <=0.0.6), dijit (>=1.7.11, <=1.11.9) +7 more potentially affected by CVE-2020-5258 via dojo (>=1.7.11, <=1.11.9)

dojo NPM version =1.7.11, =0.0.1, =1.7.11, =0.1.0, =1.8.13, =1.2.0, =0.3.0-alpha.1, =0.0.1, =0.1.1, =0.1.3 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

dijit (>=1.12.1, <=1.12.7), dojox (>=1.12.1, <=1.12.7) potentially affected by CVE-2020-5258 via dojo (>=1.12.1, <=1.12.7)

dojo NPM version =1.12.1, =1.12.1, =1.12.1, =1.12.7 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

dijit (>=1.16.0, <=1.16.1), dojox (>=1.16.0, <=1.16.1) potentially affected by CVE-2020-5258 via dojo (>=1.16.0, <=1.16.1)

dojo NPM version =1.16.0, =1.16.0, =1.16.0, =1.16.1 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

Debian DLA-2127-1 : dojo security update

dojox was vulnerable to Cross-site Scripting. This was due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them. For Debian 8 'Jessie', this problem has been fixed in version 1.10.2+dfsg-1+deb8u2. We recommend that you upgrade your dojo packages. NOTE...

[SECURITY] [DLA 2127-1] dojo security update

Package : dojo Version : 1.10.2+dfsg-1+deb8u2 CVE ID : CVE-2019-10785 Debian Bug : 952771 dojox was vulnerable to Cross-site Scripting. This was due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them. For Debian 8 "Jessie", this problem has been fix...

DLA-2127-1 dojo - security update

Bulletin has no description...

bryaktestgrid (>=0.0.1, <=0.0.6), dojo-rql (>=0.1.0, <=0.3.2) +1 more potentially affected by CVE-2019-10785 via dojox (1.11.2)

dojox NPM version 1.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on dojox and may be impacted: - bryaktestgrid =0.0.1, =0.1.0, =0.0.1, =0.5.24 Source cves: CVE-2019-10785 Source advisory: OSV:GHSA-PG97-WW7H-5MJR...

Security Bulletin: A Security Vulnerability exists in the Dojo runtime that affects Rational Application Developer

Summary The dojox/form/resources/fileuploader.swf, dojox/form/resources/uploader.swf, dojox/av/resources/audio.swf, and dojox/av/resources/video.swf files exhibit an cross-site scripting XSS vulnerability. Any web application using the IBM Dojo Toolkit and providing those files might be subject t...