CVE-2019-11358
published 2019-04-20CVE-2019-11358: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an…
PriorityP278medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
87.22%
99.7th percentile
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Affected
247 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| backdropcms | backdrop | >= 1.11.0 < 1.11.9 | 1.11.9 |
| backdropcms | backdrop | >= 1.12.0 < 1.12.6 | 1.12.6 |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | mediawiki | < mediawiki 1:1.31.2-1 (bookworm) | mediawiki 1:1.31.2-1 (bookworm) |
| debian | node-jquery | < mediawiki 1:1.31.2-1 (bookworm) | mediawiki 1:1.31.2-1 (bookworm) |
| debian | otrs2 | < mediawiki 1:1.31.2-1 (bookworm) | mediawiki 1:1.31.2-1 (bookworm) |
| djangoproject | django | >= 2.0a1 < 2.1.9 | 2.1.9 |
| djangoproject | django | >= 2.2a1 < 2.2.2 | 2.2.2 |
| drupal | core | >= 8.0.0 < 8.5.15 | 8.5.15 |
| drupal | core | >= 8.6.0 < 8.6.15 | 8.6.15 |
| drupal | drupal | >= 7.0 < 7.66 | 7.66 |
| drupal | drupal | >= 8.5.0 < 8.5.15 | 8.5.15 |
| drupal | drupal | >= 8.6.0 < 8.6.15 | 8.6.15 |
| drupal | drupal_core | — | — |
| ezsystems | ezplatform-admin-ui-assets | >= 4.0.0 < 4.2.0 | 4.2.0 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| joomla | joomla_! | 3.0.0 – 3.9.4 | — |
| jquery | jquery | < 3.4.0 | 3.4.0 |
| jquery | jquery | >= 0 < 1.7.2+dfsg-2ubuntu1+esm1 | 1.7.2+dfsg-2ubuntu1+esm1 |
| jquery | jquery | >= 0 < 1.11.3+dfsg-4ubuntu0.1~esm1 | 1.11.3+dfsg-4ubuntu0.1~esm1 |
| jquery | jquery | >= 0 < 3.2.1-1ubuntu0.1~esm1 | 3.2.1-1ubuntu0.1~esm1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect prototype pollution attempts by monitoring for HTTP request parameters or JSON payloads containing the literal key '__proto__', which is the attack vector for CVE-2019-11358 via jQuery.extend(true, {}, ...). ↗
- →Flag or block any JSON body or query string containing '__proto__' as a key, as this is the specific payload pattern exploiting jQuery.extend deep merge behavior. ↗
- →Identify vulnerable jQuery versions (before 3.4.0) loaded on pages; specifically jQuery 3.3.1 is confirmed exploitable and used in published PoC exploit code. ↗
- →For Drupal deployments, check for Drupal core versions below 8.6.15, 8.5.15, or 7.66 which bundle vulnerable jQuery (3.2.1 for Drupal 8, 1.4.4 for Drupal 7). ↗
- →Monitor DOM manipulation calls such as $('#...').html(...) receiving values derived from polluted Object.prototype properties, which is the final XSS delivery step in this exploit chain. ↗
- ·The vulnerability only triggers when jQuery.extend is called in deep-merge mode (first argument is boolean true). Shallow merges are not affected. ↗
- ·Drupal's fix backports the jQuery.extend() patch without upgrading the bundled jQuery version itself, so the jQuery version string alone cannot be used to confirm patched status on Drupal sites. ↗
- ·Exploitability depends on whether a Drupal module or application passes unsanitized user-controlled data into jQuery.extend; not all jQuery deployments are automatically exploitable. ↗
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
ghsa6.1MEDIUM
osv6.1MEDIUM
vulncheck6.1MEDIUM
vendor_oracle9.8MEDIUM
vendor_debian6.1MEDIUM
vendor_msrc6.1MEDIUM
vendor_redhat6.1MEDIUM
vendor_ubuntu6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
jquery vulnerabilities
osv·2025-07-08·CVSS 6.1
CVE-2012-6708 [MEDIUM] jquery vulnerabilities
jquery vulnerabilities
It was discovered that jQuery did not correctly handle HTML tags. An
attacker could possibly use this issue to execute a cross-site scripting
(XSS) attack. This issue only affected Ubuntu 14.04 LTS. (CVE-2012-6708)
It was discovered that jQuery did not correctly handle unsanitized source
objects due to prototype pollution. An attacker could possibly use this
issue to execute a cross-site scripting (XSS) attack. (CVE-2019-11358)
Masato Kinugawa discovered that jQuery did not correctly sanitize certain
HTML elements. An attacker could possibly use this issue to execute a
cross-site scripting (XSS) attack. This issue only affected
Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-11022)
Masato Kinugawa discovered that jQuery did not correctly sanitize certain
HTML el
GHSA
eZ Platform Bundled jQuery affected by CVE-2019-11358
ghsa·2024-05-15·CVSS 6.1
CVE-2019-11358 [MEDIUM] eZ Platform Bundled jQuery affected by CVE-2019-11358
eZ Platform Bundled jQuery affected by CVE-2019-11358
In eZ Platform 2.x, ezsystems/ezplatform-admin-ui-assets before v4.2.0 includes jQuery version 3.3.1. This version of jQuery is affected by the security vulnerability https://www.cvedetails.com/cve/CVE-2019-11358/
This is fixed in jQuery version 3.4. We recommend that you upgrade your ezsystems/ezplatform-admin-ui-assets to v4.2.0 using Composer. This release includes jQuery 3.4.1.
OSV
eZ Platform Bundled jQuery affected by CVE-2019-11358
osv·2024-05-15·CVSS 6.1
CVE-2019-11358 [MEDIUM] eZ Platform Bundled jQuery affected by CVE-2019-11358
eZ Platform Bundled jQuery affected by CVE-2019-11358
In eZ Platform 2.x, ezsystems/ezplatform-admin-ui-assets before v4.2.0 includes jQuery version 3.3.1. This version of jQuery is affected by the security vulnerability https://www.cvedetails.com/cve/CVE-2019-11358/
This is fixed in jQuery version 3.4. We recommend that you upgrade your ezsystems/ezplatform-admin-ui-assets to v4.2.0 using Composer. This release includes jQuery 3.4.1.
OSV
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
osv·2019-04-26
CVE-2019-11358 [MEDIUM] XSS in jQuery as used in Drupal, Backdrop CMS, and other products
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles `jQuery.extend(true, {}, ...)` because of `Object.prototype` pollution. If an unsanitized source object contained an enumerable `__proto__` property, it could extend the native `Object.prototype`.
GHSA
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
ghsa·2019-04-26
CVE-2019-11358 [MEDIUM] CWE-1321 XSS in jQuery as used in Drupal, Backdrop CMS, and other products
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles `jQuery.extend(true, {}, ...)` because of `Object.prototype` pollution. If an unsanitized source object contained an enumerable `__proto__` property, it could extend the native `Object.prototype`.
OSV
CVE-2019-11358: jQuery before 3
osv·2019-04-20·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358: jQuery before 3
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
OSV
CVE-2019-11358: The jQuery project released version 3
osv·2019-04-17
CVE-2019-11358 CVE-2019-11358: The jQuery project released version 3
The jQuery project released version 3.4.0, and as part of that, disclosed a security vulnerability that affects all prior versions. As described in their [release notes](https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/):
> jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extend(true, {}, ...). If an unsanitized source object contained an enumerable \_\_proto\_\_ property, it could extend the native Object.prototype. This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous jQuery versions.
It's possible that this vulnerability is exploitable with some Drupal modules. As a precaution, this Drupal security release backports the fix to jQuery.extend(), without making any other changes to the jQuery version that is included in Drupal cor
VulnCheck
JQuery JQuery Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
vulncheck·2019·CVSS 6.1
CVE-2019-11358 [MEDIUM] JQuery JQuery Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
JQuery JQuery Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Affected: JQuery JQuery
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.tenable.com/blog/daisy-chaining-how-vulnerabilities-can-be-greater-than-the-sum-of-their-parts; https://www.securin.io/wp-content/uploads/2023/08/2023-State-of-Cybersecurity-for-Medical-Devices-and-Hea
Ubuntu
jQuery vulnerabilities
vendor_ubuntu·2025-07-08·CVSS 6.1
CVE-2012-6708 [MEDIUM] jQuery vulnerabilities
Title: jQuery vulnerabilities
Summary: Several security issues were fixed in jQuery.
It was discovered that jQuery did not correctly handle HTML tags. An
attacker could possibly use this issue to execute a cross-site scripting
(XSS) attack. This issue only affected Ubuntu 14.04 LTS. (CVE-2012-6708)
It was discovered that jQuery did not correctly handle unsanitized source
objects due to prototype pollution. An attacker could possibly use this
issue to execute a cross-site scripting (XSS) attack. (CVE-2019-11358)
Masato Kinugawa discovered that jQuery did not correctly sanitize certain
HTML elements. An attacker could possibly use this issue to execute a
cross-site scripting (XSS) attack. This issue only affected
Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-11022)
Masato Kinugawa di
CISA ICS
Pepperl+Fuchs WirelessHART-Gateway
cisa_ics·2022-04-07·CVSS 7.5
[HIGH] Pepperl+Fuchs WirelessHART-Gateway
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Pepperl+Fuchs WirelessHART-Gateway
Last RevisedApril 07, 2022
Alert CodeICSA-22-097-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Pepperl+Fuchs
- Equipment: WirelessHART-Gateway
- Vulnerabilities: Use of Hard-coded Credentials, Uncontrolled Resource Consumption, Reliance on Reverse DNS Resolution for a Security-critical Action, Path Traversal, Cross-site Scripting, Exposure of Sensitive Information to an Unauthorized Actor, Cleartext Storage of Sensitive Information in a Cookie, HTTP Request Smuggling, Sensitive Co
Oracle
Oracle Oracle Hyperion Risk Matrix: Hyperion Planning (jQuery) — CVE-2019-11358
vendor_oracle·2021-10-15·CVSS 6.1
CVE-2019-11358 [MEDIUM] Oracle Oracle Hyperion Risk Matrix: Hyperion Planning (jQuery) — CVE-2019-11358
Oracle Oracle Hyperion Risk Matrix: Hyperion Planning (jQuery) vulnerability
CVE: CVE-2019-11358
CVSS: 6.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2021 (OCT 2021)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: UI Platform (jQuery) — CVE-2019-11358
vendor_oracle·2021-07-15·CVSS 6.1
CVE-2019-11358 [MEDIUM] Oracle Oracle Fusion Middleware Risk Matrix: UI Platform (jQuery) — CVE-2019-11358
Oracle Oracle Fusion Middleware Risk Matrix: UI Platform (jQuery) vulnerability
CVE: CVE-2019-11358
CVSS: 6.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2021 (JUL 2021)
Oracle
Oracle Oracle Siebel CRM Risk Matrix: UIF Open UI (jQuery) — CVE-2019-11358
vendor_oracle·2021-04-15·CVSS 6.1
CVE-2019-11358 [MEDIUM] Oracle Oracle Siebel CRM Risk Matrix: UIF Open UI (jQuery) — CVE-2019-11358
Oracle Oracle Siebel CRM Risk Matrix: UIF Open UI (jQuery) vulnerability
CVE: CVE-2019-11358
CVSS: 6.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2021 (APR 2021)
Oracle
Oracle Oracle Insurance Applications Risk Matrix: Framework Administrator IBFA (jQuery) — CVE-2019-11358
vendor_oracle·2021-01-15·CVSS 6.1
CVE-2019-11358 [MEDIUM] Oracle Oracle Insurance Applications Risk Matrix: Framework Administrator IBFA (jQuery) — CVE-2019-11358
Oracle Oracle Insurance Applications Risk Matrix: Framework Administrator IBFA (jQuery) vulnerability
CVE: CVE-2019-11358
CVSS: 6.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2021 (JAN 2021)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: BI Publisher Security (jQuery) — CVE-2019-11358
vendor_oracle·2020-10-15·CVSS 6.1
CVE-2019-11358 [MEDIUM] Oracle Oracle Fusion Middleware Risk Matrix: BI Publisher Security (jQuery) — CVE-2019-11358
Oracle Oracle Fusion Middleware Risk Matrix: BI Publisher Security (jQuery) vulnerability
CVE: CVE-2019-11358
CVSS: 6.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2020 (OCT 2020)
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: User Interface (jQuery) — CVE-2019-11358
vendor_oracle·2020-07-15·CVSS 9.8
CVE-2019-11358 [MEDIUM] Oracle Oracle Financial Services Applications Risk Matrix: User Interface (jQuery) — CVE-2019-11358
Oracle Oracle Financial Services Applications Risk Matrix: User Interface (jQuery) vulnerability
CVE: CVE-2019-11358
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2020 (JUL 2020)
CISA ICS
OSIsoft PI System (Update A)
cisa_ics·2020-05-12·CVSS 7.8
[HIGH] OSIsoft PI System (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
OSIsoft PI System (Update A)
Last RevisedJuly 27, 2020
Alert CodeICSA-20-133-02
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: OSIsoft
- Equipment: PI System
- Vulnerabilities: Uncontrolled Search Path Element, Improper Verification of Cryptographic Signature, Incorrect Default Permissions, Uncaught Exception, Null Pointer Dereference, Improper Input Validation, Cross-site Scripting, Insertion of Sensitive Information into Log File
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the original adv
Oracle
Oracle Oracle Communications Applications Risk Matrix: IDIH Visualization (jQuery) — CVE-2019-11358
vendor_oracle·2020-04-15·CVSS 6.1
CVE-2019-11358 [MEDIUM] Oracle Oracle Communications Applications Risk Matrix: IDIH Visualization (jQuery) — CVE-2019-11358
Oracle Oracle Communications Applications Risk Matrix: IDIH Visualization (jQuery) vulnerability
CVE: CVE-2019-11358
CVSS: 6.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2020 (APR 2020)
Oracle
Oracle Oracle Communications Applications Risk Matrix: General (jQuery) — CVE-2019-11358
vendor_oracle·2020-01-15·CVSS 6.1
CVE-2019-11358 [MEDIUM] Oracle Oracle Communications Applications Risk Matrix: General (jQuery) — CVE-2019-11358
Oracle Oracle Communications Applications Risk Matrix: General (jQuery) vulnerability
CVE: CVE-2019-11358
CVSS: 6.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2020 (JAN 2020)
Drupal
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-006
vendor_drupal·2019-04-17
CVE-2019-11358 [MEDIUM] Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-006
Title: Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-006
Vulnerability Type: Cross Site Scripting
Description: The jQuery project released version 3.4.0, and as part of that, disclosed a security vulnerability that affects all prior versions. As described in their release notes : jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extend(true, {}, ...). If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous jQuery versions. It's possible that this vulnerability is exploitable with some Drupal modules. As a precaution, this Drupal security release backports the fix to jQuery.extend(), without making
Microsoft
jQuery before 3.4.0 as used in Drupal Backdrop CMS and other products mishandles jQuery.extend(true {} ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerab
vendor_msrc·2019-04-09·CVSS 6.1
CVE-2019-11358 [MEDIUM] CWE-1321 jQuery before 3.4.0 as used in Drupal Backdrop CMS and other products mishandles jQuery.extend(true {} ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerab
jQuery before 3.4.0 as used in Drupal Backdrop CMS and other products mishandles jQuery.extend(true {} ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property it could extend the native Object.prototype.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information.
Red Hat
jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection
vendor_redhat·2019-03-27·CVSS 6.1
CVE-2019-11358 [MEDIUM] CWE-79 jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection
jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.
Statement: Red Hat Virtualization 4.2 EUS contains the affected version of boot
Debian
CVE-2019-11358: mediawiki - jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishan...
vendor_debian·2019·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358: mediawiki - jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishan...
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Scope: local
bookworm: resolved (fixed in 1:1.31.2-1)
bullseye: resolved (fixed in 1:1.31.2-1)
forky: resolved (fixed in 1:1.31.2-1)
sid: resolved (fixed in 1:1.31.2-1)
trixie: resolved (fixed in 1:1.31.2-1)
No detection rules found.
Bugzilla
CVE-2019-11358 atomic-openshift-web-console: js-jquery: Web console vulnerable to CVE-2019-11358 (moderate d impact) [openshift-enterprise-3.11.z]
bugzilla·2020-01-29·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 atomic-openshift-web-console: js-jquery: Web console vulnerable to CVE-2019-11358 (moderate d impact) [openshift-enterprise-3.11.z]
CVE-2019-11358 atomic-openshift-web-console: js-jquery: Web console vulnerable to CVE-2019-11358 (moderate d impact) [openshift-enterprise-3.11.z]
Description of problem:
A security scan reports that web console in 3.11 contains a vendor.js bundle with jQuery 3.2.1, vulnerable to CVE-2019-11358.
Additional info:
- https://nvd.nist.gov/vuln/detail/CVE-2019-11358
- Some projects were updated on 2019 to fix this CVE, but OpenShift wasn't one of them: https://access.redhat.com/security/cve/CVE-2019-11358
Discussion:
Get the version of jquery in console dev tools:
$().jquery
"3.4.0"
Or
jQuery().jquery
"3.4.0"
from https://access.redhat.com/security/cve/CVE-2019-11358, the jquery vulnerable should be fixed in 3.4.0
verified on:
OpenShift Master: v3.11.169
Kubernetes Master: v1.11.0+d4cac
Bugzilla
CVE-2019-11358 python-XStatic-jQuery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [openstack-rdo]
bugzilla·2019-07-11·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 python-XStatic-jQuery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [openstack-rdo]
CVE-2019-11358 python-XStatic-jQuery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [openstack-rdo]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of openstack-rdo.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed i
Bugzilla
CVE-2019-11358 python-XStatic-jquery-ui: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [openstack-rdo]
bugzilla·2019-07-11·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 python-XStatic-jquery-ui: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [openstack-rdo]
CVE-2019-11358 python-XStatic-jquery-ui: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [openstack-rdo]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of openstack-rdo.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being
Bugzilla
extension workshop is using a vulnerable version of jQuery
bugzilla·2019-05-06·CVSS 6.1
CVE-2019-11358 [MEDIUM] extension workshop is using a vulnerable version of jQuery
extension workshop is using a vulnerable version of jQuery
https://github.com/mozilla/extension-workshop/network/alert/yarn.lock/jquery/open
prototype pollution in $.extend
https://nvd.nist.gov/vuln/detail/CVE-2019-11358
Discussion:
Some more came in:
https://github.com/advisories/GHSA-4g88-fppr-53pp
https://github.com/advisories/GHSA-fhjf-83wg-r2j9
https://github.com/advisories/GHSA-fhjf-83wg-r2j9
https://github.com/advisories/GHSA-cr5j-953j-xw5p
can we could update or ack the alerts on https://github.com/mozilla/extension-workshop/network/alerts ? Some of the renovate PRs might fix these.
I can make a PR to update the deps or kick off the GH automated ones if that'd help.
---
:wezhou is the project still active? If so, do you know who owns it?
:muffinresearch are you still wor
Bugzilla
CVE-2019-11358 drupal7: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [epel-all]
bugzilla·2019-04-24·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 drupal7: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [epel-all]
CVE-2019-11358 drupal7: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog
Bugzilla
CVE-2019-11358 drupal7: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
bugzilla·2019-04-24·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 drupal7: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
CVE-2019-11358 drupal7: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM change
Bugzilla
CVE-2019-11358 drupal7: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
bugzilla·2019-04-23·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 drupal7: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
CVE-2019-11358 drupal7: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM change
Bugzilla
CVE-2019-11358 drupal7: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
bugzilla·2019-04-23·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 drupal7: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
CVE-2019-11358 drupal7: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM change
Bugzilla
CVE-2019-11358 python-tw-jquery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-6]
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 python-tw-jquery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-6]
CVE-2019-11358 python-tw-jquery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-6.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog
Bugzilla
CVE-2019-11358 python-tw2-jquery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-7]
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 python-tw2-jquery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-7]
CVE-2019-11358 python-tw2-jquery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelo
Bugzilla
CVE-2019-11358 python-XStatic-jQuery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-7]
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 python-XStatic-jQuery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-7]
CVE-2019-11358 python-XStatic-jQuery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM chan
Bugzilla
CVE-2019-11358 js-jquery1: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-7]
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 js-jquery1: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-7]
CVE-2019-11358 js-jquery1: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and t
Bugzilla
CVE-2019-11358 python-tw2-jquery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-6]
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 python-tw2-jquery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-6]
CVE-2019-11358 python-tw2-jquery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-6.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelo
Bugzilla
CVE-2019-11358 js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
CVE-2019-11358 js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and t
Bugzilla
CVE-2019-11358 python-XStatic-jquery-ui: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 python-XStatic-jquery-ui: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
CVE-2019-11358 python-XStatic-jquery-ui: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed
Bugzilla
CVE-2019-11358 python-XStatic-jQuery: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 python-XStatic-jQuery: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
CVE-2019-11358 python-XStatic-jQuery: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in
Bugzilla
CVE-2019-11358 python-XStatic-jquery-ui: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [epel-7]
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 python-XStatic-jquery-ui: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [epel-7]
CVE-2019-11358 python-XStatic-jquery-ui: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the R
Bugzilla
CVE-2019-11358 rubygem-jquery-rails: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 rubygem-jquery-rails: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
CVE-2019-11358 rubygem-jquery-rails: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in t
Bugzilla
CVE-2019-11358 rubygem-jquery-ui-rails: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 rubygem-jquery-ui-rails: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
CVE-2019-11358 rubygem-jquery-ui-rails: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed i
Bugzilla
CVE-2019-11358 jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection
CVE-2019-11358 jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection
jquery is a JavaScript library. It makes things like HTML document traversal and manipulation, event handling, animation, and Ajax much simpler with an easy-to-use API that works across a multitude of browsers. Affected versions of this package are vulnerable to Prototype Pollution. The extend function can be tricked into modifying the prototype of Object when the attacker controls part of the structure passed to this function. This can let an attacker add or modify an existing property that will then exist on all objects. Remediation A fix was pushed into the master branch but not yet published.
Upstream patch:
https://github.com/jquery/jquery/comm
Bugzilla
CVE-2019-11358 js-jquery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-7]
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 js-jquery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-7]
CVE-2019-11358 js-jquery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and th
Bugzilla
CVE-2019-11358 js-jquery1: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 js-jquery1: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
CVE-2019-11358 js-jquery1: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM cha
Bugzilla
CVE-2019-11358 python-tw2-jquery: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 python-tw2-jquery: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
CVE-2019-11358 python-tw2-jquery: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the
Bugzilla
CVE-2019-11358 js-jquery2: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
bugzilla·2019-04-22·CVSS 6.1
CVE-2019-11358 [MEDIUM] CVE-2019-11358 js-jquery2: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
CVE-2019-11358 js-jquery2: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM cha
Tenable
Daisy Chaining: How Vulnerabilities Can Be Greater Than the Sum of Their Parts
blogs_tenable·2021-01-21
Daisy Chaining: How Vulnerabilities Can Be Greater Than the Sum of Their Parts
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlhttp://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.htmlhttp://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.htmlhttp://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.htmlhttp://seclists.org/fulldisclosure/2019/May/10http://seclists.org/fulldisclosure/2019/May/11http://seclists.org/fulldisclosure/2019/May/13http://www.openwall.com/lists/oss-security/2019/06/03/2http://www.securityfocus.com/bid/108023https://access.redhat.com/errata/RHBA-2019:1570https://access.redhat.com/errata/RHSA-2019:1456https://access.redhat.com/errata/RHSA-2019:2587https://access.redhat.com/errata/RHSA-2019:3023https://access.redhat.com/errata/RHSA-2019:3024https://backdropcms.org/security/backdrop-sa-core-2019-009https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1bhttps://github.com/jquery/jquery/pull/4333https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc%40%3Ccommits.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844%40%3Ccommits.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f%40%3Ccommits.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7%40%3Ccommits.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205%40%3Ccommits.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3Ehttps://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3Ehttps://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Ehttps://lists.apache.org/thread.html/r2041a75d3fc09dec55adfd95d598b38d22715303f65c997c054844c9%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/r2baacab6e0acb5a2092eb46ae04fd6c3e8277b4fd79b1ffb7f3254fa%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/r38f0d1aa3c923c22977fe7376508f030f22e22c1379fbb155bf29766%40%3Cdev.syncope.apache.org%3Ehttps://lists.apache.org/thread.html/r41b5bfe009c845f67d4f68948cc9419ac2d62e287804aafd72892b08%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/r7aac081cbddb6baa24b75e74abf0929bf309b176755a53e3ed810355%40%3Cdev.flink.apache.org%3Ehttps://lists.apache.org/thread.html/r7d64895cc4dff84d0becfc572b20c0e4bf9bfa7b10c6f5f73e783734%40%3Cdev.storm.apache.org%3Ehttps://lists.apache.org/thread.html/r7e8ebccb7c022e41295f6fdb7b971209b83702339f872ddd8cf8bf73%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/05/msg00006.htmlhttps://lists.debian.org/debian-lts-announce/2019/05/msg00029.htmlhttps://lists.debian.org/debian-lts-announce/2020/02/msg00024.htmlhttps://lists.debian.org/debian-lts-announce/2023/08/msg00040.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5/https://seclists.org/bugtraq/2019/Apr/32https://seclists.org/bugtraq/2019/Jun/12https://seclists.org/bugtraq/2019/May/18https://security.netapp.com/advisory/ntap-20190919-0001/https://snyk.io/vuln/SNYK-JS-JQUERY-174006https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1https://www.debian.org/security/2019/dsa-4434https://www.debian.org/security/2019/dsa-4460https://www.drupal.org/sa-core-2019-006https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujan2020.htmlhttps://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttps://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/https://www.synology.com/security/advisory/Synology_SA_19_19https://www.tenable.com/security/tns-2019-08https://www.tenable.com/security/tns-2020-02http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlhttp://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.htmlhttp://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.htmlhttp://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.htmlhttp://seclists.org/fulldisclosure/2019/May/10http://seclists.org/fulldisclosure/2019/May/11http://seclists.org/fulldisclosure/2019/May/13http://www.openwall.com/lists/oss-security/2019/06/03/2http://www.securityfocus.com/bid/108023https://access.redhat.com/errata/RHBA-2019:1570https://access.redhat.com/errata/RHSA-2019:1456https://access.redhat.com/errata/RHSA-2019:2587https://access.redhat.com/errata/RHSA-2019:3023https://access.redhat.com/errata/RHSA-2019:3024https://backdropcms.org/security/backdrop-sa-core-2019-009https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1bhttps://github.com/jquery/jquery/pull/4333https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc%40%3Ccommits.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844%40%3Ccommits.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f%40%3Ccommits.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7%40%3Ccommits.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205%40%3Ccommits.airflow.apache.org%3E
+ 46 more references
2019-04-20
Published
Exploited in the wild