Security Bulletin: IBM Kenexa LCMS Premier On Premise - [All] jQuery (Publicly disclosed vulnerability) CVE-2020-11023, CVE-2020-11022

Summary We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. These have been addressed in LCMS Premier 14.0 version. Vulnerability Details CVEID: CVE-2020-11023 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper...

PT-2020-21230

Name of the Vulnerable Software and Affected Versions github-jquery-widgets version 0.1.2 Description The issue concerns malicious code in version 0.1.2 of github-jquery-widgets. When executed in a browser, this code enumerates password, cvc, and cardnumber fields from forms and sends the extract...

FreeBSD : Gitlab -- multiple vulnerabilities (1fb13175-ed52-11ea-8b93-001b217b3468)

Gitlab reports : Vendor Cross-Account Assume-Role Attack Stored XSS on the Vulnerability Page Outdated Job Token Can Be Reused to Access Unauthorized Resources File Disclosure Via Workhorse File Upload Bypass Unauthorized Maintainer Can Edit Group Badge Denial of Service Within Wiki Functionality...

GHSA-78P3-96HC-3J47 Malicious Package in jquery-airload

Version 0.2.5 of jquery-airload contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment. It's also...

Malicious Package in jquery-airload

Version 0.2.5 of jquery-airload contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment. It's also...

AZL-44379 CVE-2020-7729 affecting package js-jquery 3.5.0-4

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

PT-2020-21124

Name of the Vulnerable Software and Affected Versions jquery-airload version 0.2.5 Description The issue concerns malicious code in version 0.2.5 of jquery-airload. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends the...

@baosight/xinrong (>=0.0.36, <=0.0.37), npm_1st_publish (1.0.0) +1 more potentially affected by unknown CVE via jqeury (0.0.1-security)

jqeury NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on jqeury and may be impacted: - @baosight/xinrong =0.0.36, =0.0.37 - npm1stpublish 1.0.0 - wypulldom 1.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-4964-CJRR-JG97...

Cross-Site Scripting in jquery-mobile

All version of jquery-mobile are vulnerable to Cross-Site Scripting. The package checks for content in location.hash and if a URL is found it does an XmlHttpRequest XHR to the URL and renders the response with innerHTML. It fails to validate the Content-Type of the response, allowing attackers to...

@fanswoo/core (>=1.0.0, <=1.3.8), brws-upload (>=1.0.2, <=1.0.3) +4 more potentially affected by unknown CVE via jquery-mobile (>=1.4.1, <=1.5.0-alpha.1)

jquery-mobile NPM version =1.4.1, =1.0.0, =1.0.2, =1.0.0, =1.0.2, =2.0.0, =0.0.1, =1.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-FJ93-7WM4-8X2G...

@fanswoo/core (>=1.0.0, <=1.3.8), brws-upload (>=1.0.2, <=1.0.3) +4 more potentially affected by unknown CVE via jquery-mobile (>=1.4.1, <=1.5.0-alpha.1)

jquery-mobile NPM version =1.4.1, =1.0.0, =1.0.2, =1.0.0, =1.0.2, =2.0.0, =0.0.1, =1.0.4 Source cves: unknown CVE Source advisory: GHSA-FJ93-7WM4-8X2G...

GHSA-FJ93-7WM4-8X2G Cross-Site Scripting in jquery-mobile

All version of jquery-mobile are vulnerable to Cross-Site Scripting. The package checks for content in location.hash and if a URL is found it does an XmlHttpRequest XHR to the URL and renders the response with innerHTML. It fails to validate the Content-Type of the response, allowing attackers to...

Security Bulletin: Multiple vulnerabilities in AngularJS and jQuery affect IBM Spectrum LSF Simulator

Summary There are multiple vulnerabilities in AngularJS and jQuery used by IBM Spectrum LSF Simulator. IBM Spectrum LSF Simulator has addressed the applicable CVEs. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affecte...

PT-2020-21276

Name of the Vulnerable Software and Affected Versions jquery-mobile versions affected versions not specified Description The issue concerns a Cross-Site Scripting problem. It arises because the package checks the location.hash for content and, upon finding a URL, performs an XmlHttpRequest to the...

Western Digital My Cloud Multiple Products < 2.12.127 / 2.20 - 2.30 < 2.31.149 Multiple Vulnerabilities

Multiple Western Digital My Cloud products are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gitlab -- multiple vulnerabilities

Gitlab reports: Vendor Cross-Account Assume-Role Attack Stored XSS on the Vulnerability Page Outdated Job Token Can Be Reused to Access Unauthorized Resources File Disclosure Via Workhorse File Upload Bypass Unauthorized Maintainer Can Edit Group Badge Denial of Service Within Wiki Functionality...

alchemymvc (0.0.1), alinkage (0.1.2) +216 more potentially affected by CVE-2012-6708 via jquery (>=1.5.1, <=1.8.3)

jquery NPM version =1.5.1, =0.1.0, =0.3.3, =0.0.2, =2.0.0, =2.0.1 - arale-tip 2.0.0 - artusi-auth 0.1.0-1 - artusi-drawer 0.1.0-1 - artusi-elevator 0.1.0-1 - artusi-filesystem-drawer 0.1.0-1 - artusi-hob 0.1.0-1 - artusi-kitchen 0.1.0-1 - artusi-kitchen-assistant 0.1.0-1 and more Source cves:...

Cross-Site Scripting in jquery

Affected versions of jquery are vulnerable to cross-site scripting. This occurs because the main jquery function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. The result is that jquery may interpret HTML as selectors wh...

@corex/argon-theme (>=1.1.1, <=1.1.33), @creative-tim-official/argon-dashboard-free (1.2.0) +14 more potentially affected by CVE-2016-1000227 via bootstrap-tagsinput (0.7.1)

bootstrap-tagsinput NPM version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on bootstrap-tagsinput and may be impacted: - @corex/argon-theme =1.1.1, =0.27.0-rc1, =0.0.1, =0.1.0, =3.0.0, =1.2.0, =0.1.0, =0.2.0, =0.1.1, =1.2.6, =1.4.0, =0.1.89,...

Cross-Site Scripting in jquery

Affected versions of jquery are vulnerable to cross-site scripting. This occurs because the main jquery function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. The result is that jquery may interpret HTML as selectors wh...