MAL-2024-9054 Malicious code in jquery-ui-smoothness (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbde2167eb940c597861a429b583a7e45ac7225bee0da328cc03ddbbcb363beb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ovirt-engine security update

4.4.10.7-1.0.33 - Fix external providers properties observability 4.4.10.7-1.0.32 - Upgrade bundled frontend dependency of jquery-ui 4.4.10.7-1.0.31 - Allow enrolling certificates in non-responsive state and Extend the lifetime of non-web certificates 4.4.10.7-1.0.30 - Fix network exception...

CVE-2024-8940

Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jqueryplugin/jQuery-File-Upload/server/php/ via a POST request. An attacker could upload malicious files to the server due to the application not properly...

PT-2024-39325 · Unknown · Scriptcase

Name of the Vulnerable Software and Affected Versions: Scriptcase version 9.4.019 Description: The issue involves the arbitrary upload of a file via "/scriptcase/devel/lib/third/jquery plugin/jQuery-File-Upload/server/php/" via a POST request. An attacker could upload malicious files to the serve...

RHSA-2020:5581 Red Hat Security Advisory: python-XStatic-jQuery security update

Bulletin has no description...

RHSA-2020:1325 Red Hat Security Advisory: python-XStatic-jQuery security update

Bulletin has no description...

RHSA-2017:0161 Red Hat Security Advisory: python-XStatic-jquery-ui security update

Bulletin has no description...

RHSA-2016:2933 Red Hat Security Advisory: python-XStatic-jquery-ui security update

Bulletin has no description...

RHSA-2016:2932 Red Hat Security Advisory: python-XStatic-jquery-ui security update

Bulletin has no description...

CBL Mariner 2.0 Security Update: js-jquery (CVE-2019-20149)

The version of js-jquery installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-20149 advisory. - ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attribute...

jQuery before 3.4.0 as used in Drupal Backdrop CMS and other products mishandles jQuery.extend(true {} ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property it could extend the native Object.prototype.

...

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option causing text/javascript responses to be executed.

...

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions jQuery only deems the input to be HTML if it explicitly starts with the '<' character limiting exploitability only to attackers who can control the beginning of a string which is far less common.

...

AZL-49149 CVE-2024-45590 affecting package js-jquery 3.5.0-4

body-parser is Node.js body parsing middleware. body-parser 1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in...

AZL-49158 CVE-2024-45296 affecting package js-jquery 3.5.0-4

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...

AZL-49103 CVE-2024-45296 affecting package js-jquery 3.5.0-4

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...

K000141005: jQuery vulnerability CVE-2020-7656

Security Advisory Description jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "", which results in the enclosed script logic to be executed. CVE-2020-7656 Impact There is no impact; F5 products are not affected by this...

Security Bulletin: Vulnerabilities in Apache Ant affect IBM Operations Analytics - Log Analysis (CVE-2020-11023, CVE-2020-23064, CVE-2020-11022)

Summary There are multple cross site scripting vulnerabilities in Apache Ant that effect IBM Operations Analytics - Log Analysis. These have been addressed. Vulnerability Details CVEID:CVE-2020-11023 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of...

CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4

CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4. A patched version of the package is available...

School Log Management System 1.0 SQL Injection / Code Execution

============================================================================================================================================= | Title : School Log Management System 1.0 WYSIWYG Settings Management Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser :...