2450 matches found
jQuery Mobile < 1.2.0 Cross-site Scripting
According to its self-reported version number, jQuery Mobile is prior to 1.2.0. Therefore, it may be affected by a cross-site scripting vulnerability due to improper escaping of location.href. Note that the scanner has not tested for these issues but has instead relied only on the application's...
FreeBSD : Django -- AdminURLFieldWidget XSS (ffc73e87-87f0-11e9-ad56-fcaa147e860e)
Django security releases issued : The clickable 'Current URL' link generated by AdminURLFieldWidget displayed the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickab...
Security Bulletin: IBM MessageSight/MessageGateway is affected by the following jQuery vulnerability
Summary IBM MessageSight/MessageGateway has addressed the following jQuery vulnerability: CVE-2019-11358: jQuery mishandles jQuery.extendtrue, , ... Vulnerability Details CVEID: CVE-2019-11358 DESCRIPTION: jQuery, as used in Drupal core, is vulnerable to cross-site scripting, caused by improper...
Django -- AdminURLFieldWidget XSS
Django security releases issued: The clickable "Current URL" link generated by AdminURLFieldWidget displayed the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickabl...
@screeps/launcher (>=0.0.1 <=4.2.0-beta.8), @screepsunleashed/screeps (>=0.1.3 <=0.1.4) +9 more potentially affected by unknown CVE via jquery.terminal (>=0.10.12 <=0.11.4)
jquery.terminal NPM version =0.10.12, =0.0.1, =0.1.3, =2.0.0, =3.3.2, =0.0.3, =0.1.0, =1.0.0, =1.0.2, =0.0.7, =0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-2HWP-G4G7-MWWJ...
F5 Networks BIG-IP : jQuery vulnerability (K62532311)
jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '' character anywhere in the string, giving...
Debian DLA-1797-1 : drupal7 security update
Several security vulnerabilities have been discovered in drupal7, a PHP website platform. The vulnerabilities affect the embedded versions of the jQuery JavaScript library and the Typo3 Phar Stream Wrapper library. CVE-2019-11358 It was discovered that the jQuery version embedded in Drupal was...
Debian: Security Advisory (DLA-1797-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DLA 1777-2] jquery regression update
Package : jquery Version : 1.7.2+dfsg-3.2+deb8u7 Debian Bug : 928827 The minified jquery library was broken in version 1.7.2+dfsg-3.2+deb8u6 due to an error during the build. This problem has now been fixed in version 1.7.2+dfsg-3.2+deb8u7 For Debian 8 "Jessie", this problem has been fixed in...
DLA-1777-2 jquery - regression update
Bulletin has no description...
JQuery < 3.0.0 XSS
The version of JQuery library hosted on the remote web server is prior to 3.0.0. It is, therefore, affected by a cross site scripting vulnerability when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed C Tenable Network Securit...
Cross-Site Scripting
Overview All version of jquery-mobile are vulnerable to Cross-Site Scripting. The package checks for content in location.hash and if a URL is found it does an XmlHttpRequest XHR to the URL and renders the response with innerHTML. It fails to validate the Content-Type of the response, allowing...
jQuery 2.2.4 is vulnerable to prototype pollution
Bitbucket Server comes with jQuery version 2.2.4. This version of jQuery is vulnerable to a security bug CVE-2019-11358, https://nvd.nist.gov/vuln/detail/CVE-2019-11358 which is only fixed in jQuery 3.4.0...
jQuery 2.2.4 is vulnerable to prototype pollution
Bitbucket Server comes with jQuery version 2.2.4. This version of jQuery is vulnerable to a security bug CVE-2019-11358, https://nvd.nist.gov/vuln/detail/CVE-2019-11358 which is only fixed in jQuery 3.4.0...
JQuery < 3.4.0 Object Prototype Pollution Vulnerability
The version of JQuery library hosted on the remote web server is prior to 3.4.0. It is, therefore, affected by an object pollution vulnerability in jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could exte...
Debian: Security Advisory (DLA-1777-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Cross-Site Scripting in jQuery before 3.4.0
jQuery before 3.4.0 mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype...
Debian DLA-1777-2 : jquery regression update
The minified jquery library was broken in version 1.7.2+dfsg-3.2+deb8u6 due to an error during the build. This problem has now been fixed in version 1.7.2+dfsg-3.2+deb8u7 For Debian 8 'Jessie', this problem has been fixed in version 1.7.2+dfsg-3.2+deb8u7. We recommend that you upgrade your jquery...
[SECURITY] [DLA 1777-1] jquery security update
Package : jquery Version : 1.7.2+dfsg-3.2+deb8u6 CVE ID : CVE-2019-11358 jQuery mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype. For additional informatio...