MGASA-2020-0126 Updated dojo packages fix security vulnerability

Updated dojo package fixes security vulnerability: dojox was vulnerable to Cross-site Scripting. This was due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them CVE-2019-10785...

Prototype Pollution

Overview dojox is a dojo extension, a rollup of many useful sub-projects and varying states of maturity, from very stable and robust, to alpha and experimental. Affected versions of this package are vulnerable to Prototype Pollution. The Dojox jQuery wrapper jqMix mixin method is vulnerable to...

bryaktestgrid (>=0.0.1, <=0.0.6), dojo-rql (>=0.1.0, <=0.3.2) +1 more potentially affected by CVE-2020-5259 via dojox (1.11.2)

dojox NPM version 1.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on dojox and may be impacted: - bryaktestgrid =0.0.1, =0.1.0, =0.0.1, =0.5.24 Source cves: CVE-2020-5259 Source advisory: SNYK:JS-DOJOX-559225...

@hpcc-js/dgrid-shim (>=0.1.10, <=0.1.12) potentially affected by CVE-2020-5259 via dojox (1.13.0)

dojox NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on dojox and may be impacted: - @hpcc-js/dgrid-shim =0.1.10, =0.1.12 Source cves: CVE-2020-5259 Source advisory: SNYK:JS-DOJOX-559225...

dijit (>=1.14.0, <=1.14.5), dojox (>=1.14.0, <=1.14.5) potentially affected by CVE-2020-5258 via dojo (>=1.14.0, <=1.14.5)

dojo NPM version =1.14.0, =1.14.0, =1.14.0, =1.14.5 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

bryaktestgrid (>=0.0.1, <=0.0.6), dijit (>=1.7.11, <=1.11.9) +7 more potentially affected by CVE-2020-5258 via dojo (>=1.7.11, <=1.11.9)

dojo NPM version =1.7.11, =0.0.1, =1.7.11, =0.1.0, =1.8.13, =1.2.0, =0.3.0-alpha.1, =0.0.1, =0.1.1, =0.1.3 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

dijit (>=1.15.0, <=1.15.2), dojox (>=1.15.0, <=1.15.2) potentially affected by CVE-2020-5258 via dojo (>=1.15.0, <=1.15.2)

dojo NPM version =1.15.0, =1.15.0, =1.15.0, =1.15.2 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

dijit (>=1.16.0, <=1.16.1), dojox (>=1.16.0, <=1.16.1) potentially affected by CVE-2020-5258 via dojo (>=1.16.0, <=1.16.1)

dojo NPM version =1.16.0, =1.16.0, =1.16.0, =1.16.1 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

dijit (>=1.12.1, <=1.12.7), dojox (>=1.12.1, <=1.12.7) potentially affected by CVE-2020-5258 via dojo (>=1.12.1, <=1.12.7)

dojo NPM version =1.12.1, =1.12.1, =1.12.1, =1.12.7 Source cves: CVE-2020-5258 Source advisory: SNYK:JS-DOJO-559224...

Cross-Site Scripting (XSS)

dojox is vulnerable to cross-site scripting XSS. insufficient XML escaping in dojox.xmpp.util.xmlEncode allows an attacker to inject and execute arbitrary Javascript in a user's browser via a malicious XML document...

Dojox Cross-Site Scripting Vulnerability

DojoX is a domain application for developing other Dojo features. A cross-site scripting vulnerability exists in dojox. The vulnerability stems from the WEB application lacking proper validation of client-side data. An attacker can exploit this vulnerability to execute client-side code...

bryaktestgrid (>=0.0.1, <=0.0.6), dojo-rql (>=0.1.0, <=0.3.2) +1 more potentially affected by CVE-2019-10785 via dojox (1.11.2)

dojox NPM version 1.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on dojox and may be impacted: - bryaktestgrid =0.0.1, =0.1.0, =0.0.1, =0.5.24 Source cves: CVE-2019-10785 Source advisory: OSV:GHSA-PG97-WW7H-5MJR...

XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode

Impact What kind of vulnerability is it? Who is impacted? Potential XSS vulnerability for users of dojox/xmpp and dojox/dtl. Patches Has the problem been patched? What versions should users upgrade to? Yes, patches are available for the 1.11 through 1.16 versions. Users should upgrade to one of...

@hpcc-js/dgrid-shim (>=0.1.10, <=0.1.12) potentially affected by CVE-2019-10785 via dojox (1.13.0)

dojox NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on dojox and may be impacted: - @hpcc-js/dgrid-shim =0.1.10, =0.1.12 Source cves: CVE-2019-10785 Source advisory: OSV:GHSA-PG97-WW7H-5MJR...

GHSA-PG97-WW7H-5MJR XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode

Impact What kind of vulnerability is it? Who is impacted? Potential XSS vulnerability for users of dojox/xmpp and dojox/dtl. Patches Has the problem been patched? What versions should users upgrade to? Yes, patches are available for the 1.11 through 1.16 versions. Users should upgrade to one of...

CVE-2019-10785

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them...

CVE-2019-10785

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them...

DEBIAN-CVE-2019-10785

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them...

UBUNTU-CVE-2019-10785

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them...

Cross site scripting

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them...