bryaktestgrid (>=0.0.1 <=0.0.6), dojo-rql (>=0.1.0 <=0.3.2) +1 more potentially affected by CVE-2019-10785 via dojox (=1.11.2)

dojox NPM version =1.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on dojox and may be impacted: - bryaktestgrid =0.0.1, =0.1.0, =0.0.1, =0.5.24 Source cves: CVE-2019-10785 Source advisory: SNYK:JS-DOJOX-548257...

Cross-site Scripting (XSS)

Overview dojox is a dojo extension, a rollup of many useful sub-projects and varying states of maturity, from very stable and robust, to alpha and experimental. Affected versions of this package are vulnerable to Cross-site Scripting XSS. dojox.xmpp.util.xmlEncode only encodes the first occurrenc...

@agrc/helpers (>=1.0.0 <=1.0.1), @dojo/interop (>=4.0.0 <=7.0.0) +3 more potentially affected by CVE-2010-2273 via dojo (=1.13.0)

dojo NPM version =1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on dojo and may be impacted: - @agrc/helpers =1.0.0, =4.0.0, =0.1.10, =0.1.12 - dijit =1.13.0 - dojox =1.13.0 Source cves: CVE-2010-2273 Source advisory: OSV:GHSA-536Q-8GXX-M782...

@hpcc-js/dgrid-shim (>=0.0.29 <=0.0.32), dijit (>=1.12.1 <=1.12.11) +1 more potentially affected by CVE-2010-2273 via dojo (>=1.12.1 <=1.12.3)

dojo NPM version =1.12.1, =0.0.29, =1.12.1, =1.12.1, =1.12.11 Source cves: CVE-2010-2273 Source advisory: OSV:GHSA-536Q-8GXX-M782...

bryaktestgrid (>=0.0.1 <=0.0.6), dijit (>=1.11.0 <=1.11.13) +3 more potentially affected by CVE-2010-2273 via dojo (>=1.11.0 <=1.11.5)

dojo NPM version =1.11.0, =0.0.1, =1.11.0, =0.1.0, =1.11.0, =0.0.1, =0.5.24 Source cves: CVE-2010-2273 Source advisory: OSV:GHSA-536Q-8GXX-M782...

dojox vulnerable to unescaped string injection

In Dojo Toolkit before 1.14.0, there is unescaped string injection in dojox/Grid/DataGrid...

Cross-Site Scripting (XSS)

This is Due to the unescaped quotes in dojox/Grid/DataGrid when editing rows, which would allow an attacker to inject arbitrary HTML and Javascript into a victim's browser. Which makes dojox vulnerable to cross-site scripting...