Most recent entries from all

ALSA-2020:4670 — Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update

Affected: AlmaLinux:8: custodia, AlmaLinux:8: python3-custodia, AlmaLinux:8: python3-jwcrypto, AlmaLinux:8: python3-kdcproxy, AlmaLinux:8: python3-pyusb, AlmaLinux:8: python3-qrcode, AlmaLinux:8: python3-qrcode-core, AlmaLinux:8: python3-yubico

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

The following packages have been upgraded to a later upstream version: ipa (4.8.7), softhsm (2.6.0), opendnssec (2.1.6). (BZ#1759888, BZ#1818765, BZ#1818877)

Security Fix(es):

* js-jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

* bootstrap: XSS in the data-target attribute (CVE-2016-10735)

* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

* bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

* bootstrap: XSS in the tooltip data-viewport attribute (CVE-2018-20676)

* bootstrap: XSS in the affix configuration target property (CVE-2018-20677)

* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

* js-jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)

* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

* ipa: No password length restriction leads to denial of service (CVE-2020-1722)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information o…

bdu:2023-07675

certfr-2019-avi-163 — De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Elles permettent à un attaquant de provoque…

certfr-2019-avi-163

cnvd-2018-02375

EUVD-2026-96173

fkie_cve-2015-9251

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

GHSA-rmxg-73gg-4p98 — Cross-Site Scripting (XSS) in jquery

Affected: npm: jquery, NuGet: jQuery, RubyGems: jquery-rails, Maven: org.webjars.npm:jquery

Affected versions of `jquery` interpret `text/javascript` responses from cross-origin ajax requests, and automatically execute the contents in `jQuery.globalEval`, even when the ajax request doesn't contain the `dataType` option.

## Recommendation

Update to version 3.0.0 or later.

gsd-2015-9251

ICSA-18-212-04 — AVEVA InTouch Access Anywhere

jQuery before Version 3.0.0 is vulnerable to cross-site scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.CVE-2015-9251 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

msrc_CVE-2015-9251 — jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed w…

msrc_CVE-2015-9251

openSUSE-SU-2020:0395-1 — Recommended update for ruby2.5

Recommended update for ruby2.5

RHSA-2020:0481 — Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R15 security and bug fix update

jquery: Cross-site scripting via cross-domain ajax requests infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods

SUSE-SU-2020:0737-1 — Recommended update for ruby2.5

Recommended update for ruby2.5

UBUNTU-CVE-2015-9251

Affected: Ubuntu:Pro:14.04:LTS: jquery, Ubuntu:Pro:16.04:LTS: jquery

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

VDE-2019-009 — PHOENIX CONTACT: Multiple Vulnerabilities in AXC F 2152

Multiple vulnerabilities have been identified in PHOENIX CONTACT AXC F 2152 with firmware versions 1.x

VDE-2021-027 — Pepperl+Fuchs: WirelessHART-Gateway - Vulnerability may allow remote attackers to cause a Denial Of Service

Critical vulnerabilities have been discovered in the product and in the utilized components jQuery by jQuery Team and TLS Version 1.0/1.1.

The impact of the vulnerabilities on the affected device may result in

- denial of service - remote code execution - code exposure

WID-SEC-W-2023-0239 — Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um beliebigen Programmcode auszuführen, ein Cross-Site-Scritping-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.