jQuery 2.2.4 is vulnerable to prototype pollution

Bitbucket Server comes with jQuery version 2.2.4. This version of jQuery is vulnerable to a security bug CVE-2019-11358, https://nvd.nist.gov/vuln/detail/CVE-2019-11358 which is only fixed in jQuery 3.4.0...

jQuery 2.2.4 is vulnerable to prototype pollution

Bitbucket Server comes with jQuery version 2.2.4. This version of jQuery is vulnerable to a security bug CVE-2019-11358, https://nvd.nist.gov/vuln/detail/CVE-2019-11358 which is only fixed in jQuery 3.4.0...

JQuery < 3.4.0 Object Prototype Pollution Vulnerability

The version of JQuery library hosted on the remote web server is prior to 3.4.0. It is, therefore, affected by an object pollution vulnerability in jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could exte...

Debian: Security Advisory (DLA-1777-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-1777-2 : jquery regression update

The minified jquery library was broken in version 1.7.2+dfsg-3.2+deb8u6 due to an error during the build. This problem has now been fixed in version 1.7.2+dfsg-3.2+deb8u7 For Debian 8 'Jessie', this problem has been fixed in version 1.7.2+dfsg-3.2+deb8u7. We recommend that you upgrade your jquery...

Cross-Site Scripting in jQuery before 3.4.0

jQuery before 3.4.0 mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype...

[SECURITY] [DLA 1777-1] jquery security update

Package : jquery Version : 1.7.2+dfsg-3.2+deb8u6 CVE ID : CVE-2019-11358 jQuery mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype. For additional informatio...

DLA-1777-1 jquery - security update

Bulletin has no description...

Flerken - Obfuscated Command Detection Tool

Command line obfuscation has been proved to be a non-negligible factor in fileless malware or malicious actors that are "living off the land". To bypass signature-based detection, dedicated obfuscation techniques are shown to be used by red-team penetrations and even APT activities. Meanwhile,...

jQuery Prototype Pollution Object Cross-Site Scripting (CVE-2019-11358)

A Cross-Site Scripting vulnerability exists in jQuery. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...

000demo (>=1.0.0 <=1.1.0), 03-npm-abc (>=1.0.0 <=1.1.0) +5146 more potentially affected by CVE-2019-11358 via jquery (>=1.5.1 <=3.3.1)

jquery NPM version =1.5.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.2.1, =0.1.75, =0.3.0, =4.13.7-rc4, =1.0.0-beta.4, =1.1.7, =1.1.8 - @activix/bootstrap-daterangepicker =1.3.24 and more Source cves: CVE-2019-11358 Source advisory: OSV:GHSA-6C3J-C64M-QHGQ...

GHSA-6C3J-C64M-QHGQ XSS in jQuery as used in Drupal, Backdrop CMS, and other products

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype...

com.novocode:ornate_2.11 (>=0.3 <=0.5), com.novocode:ornate_2.12 (=0.6) +69 more potentially affected by CVE-2019-11358 via org.webjars.npm:jquery (>=2.1.1 <=3.3.1)

org.webjars.npm:jquery MAVEN version =2.1.1, =0.3, =2.4.0, =3.0.0, =3.1.0, =2.4.0, =2.4.0, =0.2.0, =1.0.4, =1.0.5 - org.webjars.npm:bootstrap-material-design =4.0.1 - org.webjars.npm:bootstrap-multiselect =0.9.15 and more Source cves: CVE-2019-11358 Source advisory: OSV:GHSA-6C3J-C64M-QHGQ...

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype...

jQuery < 3.4.0 Object Extensions Vulnerability

jQuery is prone to multiple vulnerabilities regarding property injection in Object.prototype. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...

jQuery < 3.4.0 Prototype Pollution

According to its self-reported version number, jQuery is prior to 3.4.0. Therefore, it may be affected by a prototype pollution vulnerability due to 'extend' function that can be tricked into modifying the prototype of 'Object'. Note that the scanner has not tested for these issues but has instea...

FreeBSD : drupal -- Drupal core - Moderately critical (2bad8b5d-66fb-11e9-9815-78acc0a3b880)

Drupal Security Team reports : CVE-2019-10909: Escape validation messages in the PHP templating engine. CVE-2019-10910: Check service IDs are valid. CVE-2019-10911: Add a separator in the remember me cookie hash. jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extendtru...

Drupal jQuery XSS Vulnerability (SA-CORE-2019-006) - Windows

Drupal is prone to a cross-site scripting vulnerability in jQuery. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"...

Drupal jQuery XSS Vulnerability (SA-CORE-2019-006) - Linux

Drupal is prone to a cross-site scripting vulnerability in jQuery. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"...

GHSA-WV67-Q8RR-GRJP Duplicate Advisory: Prototype Pollution in jquery

Duplicate Advisory This advisory is a duplicate of GHSA-6c3j-c64m-qhgq. This link is maintained to preserve external references. Original Description Versions of jquery prior to 3.4.0 are vulnerable to Prototype Pollution. The extend method allows an attacker to modify the prototype for Object...