dijit (>=1.15.0 <=1.15.2), dojox (>=1.15.0 <=1.15.2) potentially affected by CVE-2020-5258 via dojo (>=1.15.0 <=1.15.2)

dojo NPM version =1.15.0, =1.15.0, =1.15.0, =1.15.2 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

dijit (>=1.14.0 <=1.14.5), dojox (>=1.14.0 <=1.14.5) potentially affected by CVE-2020-5258 via dojo (>=1.14.0 <=1.14.5)

dojo NPM version =1.14.0, =1.14.0, =1.14.0, =1.14.5 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

@agrc/helpers (>=1.0.0 <=1.0.1), @dojo/interop (>=4.0.0 <=7.0.0) +3 more potentially affected by CVE-2020-5258 via dojo (>=1.13.0 <=1.13.6)

dojo NPM version =1.13.0, =1.0.0, =4.0.0, =0.1.10, =1.13.0, =1.13.0, =1.13.10 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

@hpcc-js/dgrid-shim (>=0.0.29 <=0.0.32), dijit (>=1.12.1 <=1.12.11) +1 more potentially affected by CVE-2020-5258 via dojo (>=1.12.1 <=1.12.7)

dojo NPM version =1.12.1, =0.0.29, =1.12.1, =1.12.1, =1.12.11 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

dijit (>=1.10.0 <=1.11.1), dojo-node (=4.1.0) +2 more potentially affected by CVE-2020-5258 via dojo (>=1.10.0 <=1.11.1)

dojo NPM version =1.10.0, =1.10.0, =1.10.3, =0.3.0-alpha.1, =0.3.0-alpha.32 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

Prototype Pollution

Overview dojo is a foundation package for the Dojo 1 Toolkit. While still being maintained, new development is primarily focused on modern Dojo. Affected versions of this package are vulnerable to Prototype Pollution. The deepCopy method within dojo could be tricked into adding or modifying...

Debian DLA-2127-1 : dojo security update

dojox was vulnerable to Cross-site Scripting. This was due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them. For Debian 8 'Jessie', this problem has been fixed in version 1.10.2+dfsg-1+deb8u2. We recommend that you upgrade your dojo packages. NOTE...

[SECURITY] [DLA 2127-1] dojo security update

Package : dojo Version : 1.10.2+dfsg-1+deb8u2 CVE ID : CVE-2019-10785 Debian Bug : 952771 dojox was vulnerable to Cross-site Scripting. This was due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them. For Debian 8 "Jessie", this problem has been fix...

DLA-2127-1 dojo - security update

Bulletin has no description...

bryaktestgrid (>=0.0.1 <=0.0.6), dojo-rql (>=0.1.0 <=0.3.2) +1 more potentially affected by CVE-2019-10785 via dojox (=1.11.2)

dojox NPM version =1.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on dojox and may be impacted: - bryaktestgrid =0.0.1, =0.1.0, =0.0.1, =0.5.24 Source cves: CVE-2019-10785 Source advisory: OSV:GHSA-PG97-WW7H-5MJR...

bryaktestgrid (>=0.0.1 <=0.0.6), dojo-rql (>=0.1.0 <=0.3.2) +1 more potentially affected by CVE-2019-10785 via dojox (=1.11.2)

dojox NPM version =1.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on dojox and may be impacted: - bryaktestgrid =0.0.1, =0.1.0, =0.0.1, =0.5.24 Source cves: CVE-2019-10785 Source advisory: SNYK:JS-DOJOX-548257...

Security Bulletin: A Security Vulnerability exists in the Dojo runtime that affects Rational Application Developer

Summary The dojox/form/resources/fileuploader.swf, dojox/form/resources/uploader.swf, dojox/av/resources/audio.swf, and dojox/av/resources/video.swf files exhibit an cross-site scripting XSS vulnerability. Any web application using the IBM Dojo Toolkit and providing those files might be subject t...

Security Bulletin: Financial Transaction Manager for Corporate Payment Services is affected by a potential cross-site scripting (XSS) vulnerability (CVE-2018-15494)

Summary IBM Financial Transaction Manager for Corporate Payment Services FTM CPS for Multi-Platform has addressed the following vulnerability. A potential cross-site scripting vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...

Security Bulletin: Financial Transaction Manager for Check Services is affected by a potential cross-site scripting (XSS) vulnerability (CVE-2018-15494)

Summary IBM Financial Transaction Manager for Check Services FTM CHK for Multi-Platform has addressed the following vulnerability. A potential cross-site scripting vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

@agrc/helpers (>=1.0.0 <=1.0.1), @dojo/interop (>=4.0.0 <=7.0.0) +3 more potentially affected by CVE-2010-2273 via dojo (=1.13.0)

dojo NPM version =1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on dojo and may be impacted: - @agrc/helpers =1.0.0, =4.0.0, =0.1.10, =0.1.12 - dijit =1.13.0 - dojox =1.13.0 Source cves: CVE-2010-2273 Source advisory: OSV:GHSA-536Q-8GXX-M782...

@hpcc-js/dgrid-shim (>=0.0.29 <=0.0.32), dijit (>=1.12.1 <=1.12.11) +1 more potentially affected by CVE-2010-2273 via dojo (>=1.12.1 <=1.12.3)

dojo NPM version =1.12.1, =0.0.29, =1.12.1, =1.12.1, =1.12.11 Source cves: CVE-2010-2273 Source advisory: OSV:GHSA-536Q-8GXX-M782...

bryaktestgrid (>=0.0.1 <=0.0.6), dijit (>=1.11.0 <=1.11.13) +3 more potentially affected by CVE-2010-2273 via dojo (>=1.11.0 <=1.11.5)

dojo NPM version =1.11.0, =0.0.1, =1.11.0, =0.1.0, =1.11.0, =0.0.1, =0.5.24 Source cves: CVE-2010-2273 Source advisory: OSV:GHSA-536Q-8GXX-M782...

dijit (>=1.10.0 <=1.10.1) potentially affected by CVE-2010-2273 via dojo (>=1.10.0 <=1.10.1)

dojo NPM version =1.10.0, =1.10.0, =1.10.1 Source cves: CVE-2010-2273 Source advisory: OSV:GHSA-536Q-8GXX-M782...

GHSA-536Q-8GXX-M782 Cross-Site Scripting in dojo

Versions of dojo prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting XSS. The package does not sanitize URL parameters in the testCommon.js and runner.html test files, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.4.2 o...

Cross-Site Scripting in dojo

Versions of dojo prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting XSS. The package does not sanitize URL parameters in the testCommon.js and runner.html test files, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.4.2 o...