Most recent entries from all

ALSA-2020:4670 — Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update

Affected: AlmaLinux:8: custodia, AlmaLinux:8: python3-custodia, AlmaLinux:8: python3-jwcrypto, AlmaLinux:8: python3-kdcproxy, AlmaLinux:8: python3-pyusb, AlmaLinux:8: python3-qrcode, AlmaLinux:8: python3-qrcode-core, AlmaLinux:8: python3-yubico

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

The following packages have been upgraded to a later upstream version: ipa (4.8.7), softhsm (2.6.0), opendnssec (2.1.6). (BZ#1759888, BZ#1818765, BZ#1818877)

Security Fix(es):

* js-jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

* bootstrap: XSS in the data-target attribute (CVE-2016-10735)

* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

* bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

* bootstrap: XSS in the tooltip data-viewport attribute (CVE-2018-20676)

* bootstrap: XSS in the affix configuration target property (CVE-2018-20677)

* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

* js-jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)

* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

* ipa: No password length restriction leads to denial of service (CVE-2020-1722)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information o…

bdu:2020-02249

certfr-2019-avi-634 — De multiples vulnérabilités ont été découvertes dans F5 BIG-IP. Certaines d'entre elles permettent à un attaquant de pr…

certfr-2019-avi-634

EUVD-2026-52085

fkie_cve-2019-8331

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

GHSA-9v3m-8fp8-mj99 — Bootstrap Vulnerable to Cross-Site Scripting

Affected: RubyGems: bootstrap, RubyGems: bootstrap-sass, NuGet: Bootstrap.Less, NuGet: bootstrap, NuGet: bootstrap.sass, npm: bootstrap, npm: bootstrap-sass, RubyGems: twitter-bootstrap-rails, Maven: org.webjars:bootstrap, Packagist: twbs/bootstrap

Versions of `bootstrap` prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The `data-template` attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.

## Recommendation

For `bootstrap` 4.x upgrade to 4.3.1 or later. For `bootstrap` 3.x upgrade to 3.4.1 or later.

gsd-2019-8331

RHSA-2019:1456 — Red Hat Security Advisory: Red Hat Single Sign-On 7.3.2 security update

bootstrap: XSS in the data-target attribute bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy bootstrap: XSS in the tooltip data-viewport attribute bootstrap: XSS in the affix configuration target property picketlink: reflected XSS in SAMLRequest via RelayState parameter picketlink: URL injection via xinclude parameter keycloak: missing signatures validation on CRL used to verify client certificates undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed bootstrap: XSS in the tooltip or popover data-template attribute keycloak: Node.js adapter internal NBF can be manipulated leading to DoS. jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

RHSA-2020:3936 — Red Hat Security Advisory: ipa security, bug fix, and enhancement update

jquery: Cross-site scripting via cross-domain ajax requests bootstrap: XSS in the data-target attribute bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip bootstrap: XSS in the tooltip data-viewport attribute bootstrap: XSS in the affix configuration target property bootstrap: XSS in the tooltip or popover data-template attribute jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection ipa: No password length restriction leads to denial of service jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method

UBUNTU-CVE-2019-8331

Affected: Ubuntu:16.04:LTS: twitter-bootstrap, Ubuntu:Pro:16.04:LTS: twitter-bootstrap3, Ubuntu:18.04:LTS: twitter-bootstrap, Ubuntu:Pro:18.04:LTS: twitter-bootstrap3

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

WID-SEC-W-2022-1947 — Red Hat Single Sign On: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Single Sign On ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, einen Denial of Service Zustand hervorzurufen, Informationen auszuspähen, Sicherheitsvorkehrungen zu umgehen oder beliebigen Programmcode auszuführen.