Most recent entries from all

ALSA-2021:1846 — Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update

Affected: AlmaLinux:8: bind-dyndb-ldap, AlmaLinux:8: custodia, AlmaLinux:8: opendnssec, AlmaLinux:8: python3-custodia, AlmaLinux:8: python3-jwcrypto, AlmaLinux:8: python3-kdcproxy, AlmaLinux:8: python3-pyusb, AlmaLinux:8: python3-qrcode, AlmaLinux:8: python3-qrcode-core, AlmaLinux:8: python3-yubico and 2 more

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

* jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2020-04949

BIT-drupal-2020-11023 — Potential XSS vulnerability in jQuery

Affected: Bitnami: drupal

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

certfr-2020-avi-310 — De multiples vulnérabilités ont été découvertes dans Drupal. Elles permettent à un attaquant de provoquer un contournem…

certfr-2020-avi-310

CLEANSTART-2024-DL38300 — In jQuery versions greater than or equal to 1

Affected: CleanStart: cacti, CleanStart: drupal7

CVE-2020-11023 affects multiple packages. In jQuery versions greater than or equal to 1. See references for individual vulnerability details.

cnvd-2020-27491

ESSA-2025:2436 — Moderate: tbb security update

Moderate: tbb security update

EUVD-2026-256107

fkie_cve-2020-11023

FSA-202601 — Several CODESYS vulnerabilities in Festo Automation Suite

Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently.

This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite.

Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

GHSA-jpcq-cgw6-v4j6 — Potential XSS vulnerability in jQuery

Affected: npm: jquery, RubyGems: jquery-rails, NuGet: jQuery, Maven: org.webjars.npm:jquery, Packagist: components/jquery

### Impact Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.

### Patches This problem is patched in jQuery 3.5.0.

### Workarounds To workaround this issue without upgrading, use [DOMPurify](https://github.com/cure53/DOMPurify) with its `SAFE_FOR_JQUERY` option to sanitize the HTML string before passing it to a jQuery method.

### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.

gsd-2020-11023

ICSA-21-306-01 — Sensormatic Electronics VideoEdge

A vulnerability in the JQuery web user interface (UI) component could allow a webpage to be altered before it is served to users.CVE-2020-11023 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

RHBA-2025:1079 — Red Hat Bug Fix Advisory: Red Hat Quay v3.13.4 bug fix release

jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods

SEVD-2025-189-02 — System Monitor Application in Harmony and Pro-face PS5000 Legacy Industrial PCs

Schneider Electric is aware of a vulnerability in its System Monitor application of Harmony Industrial PC and Pro-face PS5000 trusted Legacy industrial PC series products. The Harmony Industrial PC Series and Pro-face PS5000 legacy industrial PC Series are iPCs which incorporate slim, flexible and durable design allowing each customer to configure their iPC based on their individual application needs. These products offer flexible connectivity to a range of devices and designs. Failure to apply the remediations provided below may risk untrusted code execution which could result in operational failures.

UBUNTU-CVE-2020-11023

Affected: Ubuntu:Pro:14.04:LTS: drupal7, Ubuntu:Pro:16.04:LTS: drupal7, Ubuntu:Pro:18.04:LTS: jquery, Ubuntu:20.04:LTS: jquery

VDE-2021-027 — Pepperl+Fuchs: WirelessHART-Gateway - Vulnerability may allow remote attackers to cause a Denial Of Service

Critical vulnerabilities have been discovered in the product and in the utilized components jQuery by jQuery Team and TLS Version 1.0/1.1.

The impact of the vulnerabilities on the affected device may result in

- denial of service - remote code execution - code exposure

WID-SEC-W-2022-1347 — jQuery: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in jQuery ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.