000demo (>=1.0.0 <=1.1.0), 03-npm-abc (>=1.0.0 <=1.1.0) +5146 more potentially affected by CVE-2019-11358 via jquery (>=1.5.1 <=3.3.1)

jquery NPM version =1.5.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.2.1, =0.1.75, =0.3.0, =4.13.7-rc4, =1.0.0-beta.4, =1.1.7, =1.1.8 - @activix/bootstrap-daterangepicker =1.3.24 and more Source cves: CVE-2019-11358 Source advisory: OSV:GHSA-6C3J-C64M-QHGQ...

AZL-38200 CVE-2019-11358 affecting package orangefs for versions less than 2.9.7-7

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype...

CVE-2019-11358

CVE-2019-11358 is a prototype pollution vulnerability in jQuery (before 3.4.0) where mishandling of extend(true, {}, ...) can extend Object.prototype if an unsanitized source object has an enumerable proto property. The Core issue is triggered when a polluted prototype is introduced via nested ob...

rt -- XSS via jQuery

BestPractical reports: The version of jQuery used in RT 4.2 and 4.4 has a Cross-site Scripting XSS vulnerability when using cross-domain Ajax requests. This vulnerability is assigned CVE-2015-9251. RT does not use this jQuery feature so it is not directly vulnerable. jQuery version 1.12 no longer...

jQuery cross-site scripting vulnerability (CNVD-2018-14534)

jQuery is an American programmer John Resig developed a set of open source , cross-browser JavaScript library . The library simplifies the operation between HTML and JavaScript , and has a modular , plug-in extensions and other features . A cross-site scripting vulnerability exists in jQuery...

AZL-44547 CVE-2017-16042 affecting package js-jquery 3.5.0-4

Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution...

FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (57580fcc-1a61-11e8-97e0-00e04c1ea73d)

Drupal Security Team reports : CVE-2017-6926: Comment reply form allows access to restricted content CVE-2017-6927: JavaScript cross-site scripting prevention is incomplete CVE-2017-6928: Private file access bypass - Moderately Critical CVE-2017-6929: jQuery vulnerability with untrusted domains -...

jQuery vulnerability with untrusted domains.

More info at https://www.drupal.org/SA-CORE-2018-001...

jQuery vulnerability with untrusted domains.

More info at https://www.drupal.org/SA-CORE-2018-001...

org.webjars.npm:addel (=1.3.1), org.webjars.npm:angular-chosen-localytics (=1.4.0) +36 more potentially affected by CVE-2016-10707 via org.webjars.npm:jquery (=3.0.0-rc1)

org.webjars.npm:jquery MAVEN version =3.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:jquery and may be impacted: - org.webjars.npm:addel =1.3.1 - org.webjars.npm:angular-chosen-localytics =1.4.0 -...

000demo (>=1.0.0 <=1.1.0), 03-npm-abc (>=1.0.0 <=1.1.0) +5128 more potentially affected by CVE-2015-9251 via jquery (>=1.12.3 <=2.2.4)

jquery NPM version =1.12.3, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.2.1, =0.1.75, =0.3.0, =1.0.0, =4.13.7-rc4, =0.65.0, =0.17.0, =0.24.2 and more Source cves: CVE-2015-9251 Source advisory: OSV:GHSA-RMXG-73GG-4P98...

0624zmj (=1.0.0), 192.168.0.172 (=4.6.1) +322 more potentially affected by CVE-2015-9251 via jquery (>=1.11.0 <=1.12.1)

jquery NPM version =1.11.0, =0.0.3, =0.0.6, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2 and more Source cves: CVE-2015-9251 Source advisory: OSV:GHSA-RMXG-73GG-4P98...

com.novocode:ornate_2.11 (>=0.3 <=0.5), com.novocode:ornate_2.12 (=0.6) +66 more potentially affected by CVE-2015-9251 via org.webjars.npm:jquery (>=1.12.3 <=3.0.0-rc1)

org.webjars.npm:jquery MAVEN version =1.12.3, =0.3, =0.2.0, =2.0.9, =1.0.4, =1.3.2, =5.0.3, =5.1.3 and more Source cves: CVE-2015-9251 Source advisory: OSV:GHSA-RMXG-73GG-4P98...

CVE-2016-10707

jQuery 3.0.0-rc.1 is vulnerable to Denial of Service DoS due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit...

Stack overflow

jQuery 3.0.0-rc.1 is vulnerable to Denial of Service DoS due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit...

AZL-44730 CVE-2012-6708 affecting package python-httplib2 0.20.3-3

jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '' character anywhere in the string, giving...

UBUNTU-CVE-2012-6708

jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '' character anywhere in the string, giving...

AZL-43897 CVE-2012-6708 affecting package python-httplib2 0.20.3-3

jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '' character anywhere in the string, giving...

AZL-41228 CVE-2015-9251 affecting package ceph for versions less than 18.2.2-1

jQuery before 3.0.0 is vulnerable to Cross-site Scripting XSS attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed...

CVE-2016-10707

jQuery 3.0.0-rc.1 is vulnerable to Denial of Service DoS due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit...