Security Bulletin: Financial Transaction Manager for Corporate Payment Services is affected by a potential cross-site scripting (XSS) vulnerability (CVE-2018-15494)

Summary IBM Financial Transaction Manager for Corporate Payment Services FTM CPS for Multi-Platform has addressed the following vulnerability. A potential cross-site scripting vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...

Security Bulletin: Financial Transaction Manager for Check Services is affected by a potential cross-site scripting (XSS) vulnerability (CVE-2018-15494)

Summary IBM Financial Transaction Manager for Check Services FTM CHK for Multi-Platform has addressed the following vulnerability. A potential cross-site scripting vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

dijit (>=1.10.0, <=1.10.7), dojox (1.10.3) +1 more potentially affected by CVE-2010-2273 via dojo (>=1.10.0, <=1.10.7)

dojo NPM version =1.10.0, =1.10.0, =0.3.0-alpha.1, =0.3.0-alpha.32 Source cves: CVE-2010-2273 Source advisory: OSV:GHSA-536Q-8GXX-M782...

dijit (>=1.12.1, <=1.12.3), dojox (>=1.12.1, <=1.12.3) potentially affected by CVE-2010-2273 via dojo (>=1.12.1, <=1.12.3)

dojo NPM version =1.12.1, =1.12.1, =1.12.1, =1.12.3 Source cves: CVE-2010-2273 Source advisory: OSV:GHSA-536Q-8GXX-M782...

GHSA-536Q-8GXX-M782 Cross-Site Scripting in dojo

Versions of dojo prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting XSS. The package does not sanitize URL parameters in the testCommon.js and runner.html test files, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.4.2 o...

@agrc/helpers (>=1.0.0, <=1.0.1), @dojo/interop (>=4.0.0-alpha.1, <=7.0.0) +3 more potentially affected by CVE-2010-2273 via dojo (1.13.0)

dojo NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on dojo and may be impacted: - @agrc/helpers =1.0.0, =4.0.0-alpha.1, =0.1.10, =0.1.12 - dijit 1.13.0 - dojox 1.13.0 Source cves: CVE-2010-2273 Source advisory: OSV:GHSA-536Q-8GXX-M782...

Cross-Site Scripting in dojo

Versions of dojo prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting XSS. The package does not sanitize URL parameters in the testCommon.js and runner.html test files, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.4.2 o...

bryaktestgrid (>=0.0.1, <=0.0.6), dijit (>=1.11.0-rc1, <=1.11.5) +3 more potentially affected by CVE-2010-2273 via dojo (>=1.11.0, <=1.11.5)

dojo NPM version =1.11.0, =0.0.1, =1.11.0-rc1, =0.1.0, =1.11.0-rc1, =0.0.1, =0.5.24 Source cves: CVE-2010-2273 Source advisory: OSV:GHSA-536Q-8GXX-M782...

Security Bulletin: Financial Transaction Manager for Corporate Payment Services for Multi-Platform v2.1.1 is affected by a potential cross-site scripting (XSS) vulnerability (CVE-2018-15494)

Summary Financial Transaction Manager for Corporate Payment Services for Multi-Platform FTM CPS has addressed the following vulnerability. A potential cross-site scripting vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...

@dojo/cli-test-intern (>=0.1.0, <=2.0.0-beta3.1), express_mvc (>=4.1.1, <=4.3.10) +7 more potentially affected by CVE-2019-1010266 via lodash-amd (4.16.4)

lodash-amd NPM version 4.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on lodash-amd and may be impacted: - @dojo/cli-test-intern =0.1.0, =4.1.1, =3.4.0, =0.0.1, =1.0.14, =0.0.7, =0.0.1, =0.1.5 - xirtam--matrix-operations 0.1.3 Source cves:...

Cross-Site Scripting

Overview Versions of dojo prior to 1.2.0 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize HTML code in user-controlled input, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.2.0 or later. References - CVE -...

Cross-Site Scripting

Overview Versions of dojo prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting XSS. The package does not sanitize URL parameters in the testCommon.js and runner.html test files, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to versio...

The vulnerability of the dijit.Editor text editor module library simplifies the development of JavaScript- or AJAX-based applications and websites using the Dojo Toolkit. This vulnerability allows attackers to perform cross-site scripting attacks.

The vulnerability of dijit.Editor, a text editor that is part of the modular library for simplifying the development of JavaScript- or AJAX-based applications and Dojo Toolkit websites, is related to the unsafe use of the onload attribute for SVG elements. Exploiting this vulnerability could allo...

Security Bulletin: IBM Content Navigator is affected by a vulnerability in Dojo Toolkit (CVE-2018-15494)

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-15494 DESCRIPTION: Dojo Toolkit is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the DataGrid component. A remote attacker could exploit thi...

Cross-Site Scripting (XSS)

Dojo Toolkit is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of a user...

dojox vulnerable to unescaped string injection

In Dojo Toolkit before 1.14.0, there is unescaped string injection in dojox/Grid/DataGrid...

GHSA-84CM-X2Q5-8225 dojox vulnerable to unescaped string injection

In Dojo Toolkit before 1.14.0, there is unescaped string injection in dojox/Grid/DataGrid...

Cross-Site Scripting (XSS)

dojo is vulnerable to cross-site scripting. User input is not sanitized in the server response before being displayed on a user's browser. An attacker is able to inject arbitrary Javascript into a victim's browser through a crafted URL via the status parameter...

CVE-2018-1000665

Dojo Dojo Objective Harness DOH version prior to version 1.14 contains a Cross Site Scripting XSS vulnerability in unit.html and testsDOH/base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/base/i18nExhaustive.js in the DOH that can result in Victim attacked through their browser - deliv...

CVE-2018-1000665

Dojo Dojo Objective Harness DOH version prior to version 1.14 contains a Cross Site Scripting XSS vulnerability in unit.html and testsDOH/base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/base/i18nExhaustive.js in the DOH that can result in Victim attacked through their browser - deliv...