Most recent entries from all

ALSA-2020:4670 — Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update

Affected: AlmaLinux:8: custodia, AlmaLinux:8: python3-custodia, AlmaLinux:8: python3-jwcrypto, AlmaLinux:8: python3-kdcproxy, AlmaLinux:8: python3-pyusb, AlmaLinux:8: python3-qrcode, AlmaLinux:8: python3-qrcode-core, AlmaLinux:8: python3-yubico

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

The following packages have been upgraded to a later upstream version: ipa (4.8.7), softhsm (2.6.0), opendnssec (2.1.6). (BZ#1759888, BZ#1818765, BZ#1818877)

Security Fix(es):

* js-jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

* bootstrap: XSS in the data-target attribute (CVE-2016-10735)

* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

* bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

* bootstrap: XSS in the tooltip data-viewport attribute (CVE-2018-20676)

* bootstrap: XSS in the affix configuration target property (CVE-2018-20677)

* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

* js-jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)

* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

* ipa: No password length restriction leads to denial of service (CVE-2020-1722)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information o…

bdu:2020-05190

BIT-drupal-2020-11022 — jQuery has a potential XSS vulnerability

Affected: Bitnami: drupal

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

certfr-2020-avi-310 — De multiples vulnérabilités ont été découvertes dans Drupal. Elles permettent à un attaquant de provoquer un contournem…

certfr-2020-avi-310

CLEANSTART-2024-SR87769 — In jQuery starting with 1

Affected: CleanStart: cacti, CleanStart: drupal7

CVE-2020-11022 affects multiple packages. In jQuery starting with 1. See references for individual vulnerability details.

cnvd-2021-26411

EUVD-2026-290621

fkie_cve-2020-11022

GHSA-gxr4-xjj5-5px2 — Potential XSS vulnerability in jQuery

Affected: npm: jquery, NuGet: jquery, RubyGems: jquery-rails, Maven: org.webjars.npm:jquery, Packagist: maximebf/debugbar, Packagist: athlon1600/youtube-downloader, Packagist: components/jquery

### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.

### Patches This problem is patched in jQuery 3.5.0.

### Workarounds To workaround the issue without upgrading, adding the following to your code:

```js jQuery.htmlPrefilter = function( html ) { return html; }; ```

You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.

### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/

### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.

gsd-2020-11022

ICSA-22-097-01 — Pepperl+Fuchs WirelessHART-Gateway

The affected product allows active SSH and telnet services with hard-coded credentials.CVE-2021-34565 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). jQuery 3.0.0-rc.1 is vulnerable to a denial-of-service condition due to removing a logic a lowercased attribute names. Any attribute using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.CVE-2016-10707 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). If the application is not externally accessible or uses IP-based access restrictions, attackers can use DNS rebinding to bypass any IP or firewall-based access restrictions by proxying through their target's browser. This vulnerability only affects Versions 3.0.7 through 3.0.8.CVE-2021-34561 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). The filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability only affects Version 3.0.7.CVE-2021-33555 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). jQuery Version 1.4.2 allows…

openSUSE-SU-2020:1060-1 — Security update for cacti, cacti-spine

Security update for cacti, cacti-spine

RHSA-2020:2217 — Red Hat Security Advisory: OpenShift Container Platform 3.11 security update

jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method

SUSE-SU-2020:2292-1 — Security update for SUSE Manager Server 3.2

Security update for SUSE Manager Server 3.2

UBUNTU-CVE-2020-11022

Affected: Ubuntu:Pro:14.04:LTS: drupal7, Ubuntu:Pro:16.04:LTS: jquery, Ubuntu:Pro:16.04:LTS: drupal7, Ubuntu:Pro:18.04:LTS: jquery, Ubuntu:20.04:LTS: jquery

VDE-2021-027 — Pepperl+Fuchs: WirelessHART-Gateway - Vulnerability may allow remote attackers to cause a Denial Of Service

Critical vulnerabilities have been discovered in the product and in the utilized components jQuery by jQuery Team and TLS Version 1.0/1.1.

The impact of the vulnerabilities on the affected device may result in

- denial of service - remote code execution - code exposure

WID-SEC-W-2022-1347 — jQuery: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in jQuery ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.