CVE-2018-15494

CVE-2018-15494: Dojo Toolkit’s DataGrid in Dojo before 1.14 is vulnerable to unescaped string injection, enabling cross‑site scripting. Affected component is dojox/Grid/DataGrid; impact is client-side script execution in the context of the hosting page. The public fix is to upgrade to Dojo 1.14 o...

CVE-2018-1000665

CVE-2018-1000665 affects the Dojo Dojo Objective Harness (DOH) prior to version 1.14. The vulnerability is an XSS in unit.html and related tests (testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/_base/i18nExhaustive.js) that can cause a victim’s browser to execute injected s...

CVE-2010-2276

CVE-2010-2276 affects Dojo where the default build-process configuration uses copyTests=true and mini=false, enabling remote attackers to cause an unspecified impact via requests to test or demo components. Affected Dojo lines: 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x bef...

CVE-2018-6561

CVE-2018-6561 affects dojo-dijit.Editor in Dojo Toolkit 1.13, enabling cross-site scripting via the onload attribute of an SVG element. The IBM/OSV records confirm the vulnerability details, including the XSS risk in Dijit.Editor and a base score of 6.1 (IBM X-Force vector: CVSS3.0), with exploit...

CVE-2010-2273

Summary: CVE-2010-2273 describes multiple cross-site scripting vulnerabilities in Dojo across several major 1.0.x–1.4.x branches. The flaws allow remote attackers to inject arbitrary script or HTML via unspecified vectors, with potential references to files such as dojo/resources/iframe_history.h...

CVE-2010-2275

CVE-2010-2275 is an XSS vulnerability in the Dojo Toolkit SDK prior to version 1.4.2. The issue arises in the file dijit/tests/_testCommon.js where an attacker can inject arbitrary script or HTML through the theme parameter, demonstrated by an attack against dijit/tests/form/test_Button.html. Mul...

CVE-2015-5654

Dojo Toolkit (before 1.2) is vulnerable to Cross-Site Scripting (XSS) due to improper validation of user-supplied input, enabling remote attackers to inject script/HTML via unspecified vectors. Several vendor advisories confirm this CVE-2015-5654 issue and recommend upgrading Dojo to a version wi...

CVE-2007-6726

CVE-2007-6726 refers to multiple XSS vulnerabilities in Dojo 0.4.1 and 0.4.2 as used in Apache Struts and other products. The issues allow remote injection of arbitrary script/HTML via vectors involving xip_client.html and xip_server.html in src/io/. The NVD entry lists a MEDIUM severity (CVSSv2:...

CVE-2008-6681

CVE-2008-6681 corresponds to a cross-site scripting vulnerability in the Dojo toolkit, specifically in dojo/dijit.Editor components pre-1.1. The issue allows remote attackers to inject arbitrary script or HTML via XML entities entered in a TEXTAREA, with the root cause tied to insufficient input ...

CVE-2010-2274

CVE-2010-2274 describes multiple open redirect vulnerabilities in Dojo across 1.0.x to 1.4.x (before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, 1.4.x before 1.4.2). The issues allow remote attackers to redirect users to arbitrary sites via several components (e.g., dojo/re...

CVE-2010-2272

Technical details are not publicly available in the provided documents. Monitor for updates.