Vulnerabilities > CVE-2019-11358
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
LOW Integrity impact
LOW Availability impact
NONE Summary
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Vulnerable Configurations
Nessus
NASL family Fedora Local Security Checks NASL id FEDORA_2019-7EAF0BBE7C.NASL description - https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 (CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911) - https://www.drupal.org/SA-CORE-2019-006 (CVE-2019-11358) - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124686 published 2019-05-08 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124686 title Fedora 29 : drupal8 (2019-7eaf0bbe7c) NASL family Debian Local Security Checks NASL id DEBIAN_DLA-2118.NASL description It was discovered that the jQuery version embedded in OTRS, a ticket request system, was prone to a cross site scripting vulnerability in jQuery.extend(). For Debian 8 last seen 2020-03-17 modified 2020-02-25 plugin id 133967 published 2020-02-25 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/133967 title Debian DLA-2118-1 : otrs2 security update NASL family Misc. NASL id ORACLE_WEBLOGIC_SERVER_CPU_OCT_2019.NASL description The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - An unspecified vulnerability in the jquery component of the Web Services of Oracle Weblogic Server. An unauthenticated, remote attacker can exploit this to gain unauthorized update, insert, or delete access to some of Oracle WebLogic Server accessible data. (CVE-2015-9251) - An unspecified vulnerability in the Web Services component of Oracle Weblogic Server. An unauthenticated, remote attacker unauthorized can exploit this to gain read access to some of Oracle WebLogic Server accessible data. (CVE-2019-2887) - An unspecified vulnerability in the Web Services component of Oracle Weblogic Server. An unauthenticated, remote attacker can exploit this to gain unauthorized read access to some of Oracle WebLogic Server accessible data. (CVE-2019-2888) - An unspecified vulnerability in the Web Services component of Oracle Weblogic Server. An authenticated, high priviledge remote attacker can exploit this to compromise Oracle WebLogic Server. (CVE-2019-2890) - An unspecified vulnerability in the console component of Oracle Weblogic Server. An unauthenticated, remote attacker can exploit this to compromise Oracle WebLogic Server. (CVE-2019-2891) - An unspecified vulnerability in the SOAP with Attachments API for Java component of Oracle Weblogic Server. An unauthenticated, remote attacker can exploit this to gain unauthorized update, insert, or delete access to some of Oracle Web Services accessible data as well as unauthorized read access to a subset of Oracle Web Services accessible data. (CVE-2019-2907) - An unspecified vulnerability in the ADF Faces jQuery component of Oracle Weblogic Server. An unauthenticated, remote attacker can exploit this to compromise Oracle JDeveloper and ADF resulting in an unauthorized update, insert, or delete access to some of OracleJDeveloper & ADF accessible data as well as unauthorized read access to a subset of Oracle JDeveloper & ADF accessible data. (CVE-2019-11358) - An unspecified vulnerability in the Web Container jQuery component of Oracle Weblogic Server. An unauthenticated, remote attacker can exploit this to compromise Oracle Service Bus resulting in an unauthorized update, insert, or delete access to some of Service Bus data as well as unauthorized read access to a subset of Oracle Service Bus accessible data. (CVE-2019-11358) - An unspecified vulnerability in the console jQuery component of Oracle Weblogic Server. An unauthenticated, remote attacker can exploit this to compromise Oracle WebLogic Server resulting in an unauthorized update, insert, or delete access to some of Oracle WebLogic Server data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. (CVE-2019-11358) - An unspecified vulnerability in the Web Container Faces jQuery component of Oracle Weblogic Server. An unauthenticated, remote attacker can exploit this to compromise Oracle Service Bus resulting in an unauthorized update, insert, or delete access to some of Oracle WebLogic Server data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. (CVE-2019-17091) last seen 2020-06-01 modified 2020-06-02 plugin id 130012 published 2019-10-17 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/130012 title Oracle WebLogic Server Multiple Vulnerabilities (Oct 2019 CPU) NASL family CGI abuses NASL id ORACLE_PRIMAVERA_UNIFIER_CPU_OCT_2019.NASL description According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote web server is 16.1.x or 16.2.x prior to 16.2.15.10, or 17.7.x through 17.12.x prior to 17.12.11.1, or 18.8.x prior to 18.8.13.0. It is, therefore, affected by multiple vulnerabilities: - An unspecified flaw exists in how last seen 2020-06-01 modified 2020-06-02 plugin id 130070 published 2019-10-21 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/130070 title Oracle Primavera Unifier Multiple Vulnerabilities (Oct 2019 CPU) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2020-1325.NASL description The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1325 advisory. - js-jquery: prototype pollution in object last seen 2020-04-23 modified 2020-04-07 plugin id 135256 published 2020-04-07 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/135256 title RHEL 8 : python-XStatic-jQuery (RHSA-2020:1325) NASL family Misc. NASL id ORACLE_ENTERPRISE_MANAGER_OPS_CENTER_OCT_2019_CPU.NASL description The version of Oracle Enterprise Manager Ops Center installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component: - An unspecified vulnerability in the Networking (cURL) component of Oracle Enterprise Manager Ops Center. An easy to exploit vulnerability could allow an unauthenticated attacker with network access via HTTPS to compromise Enterprise Manager Ops Center. A successful attack of this vulnerability can result in takeover of Enterprise Manager Ops Center. (CVE-2019-5443) - An unspecified vulnerability in the Networking (jQuery) component of Oracle Enterprise Manager Ops Center. A difficult to exploit vulnerability could allow a low privileged attacker with logon to the infrastructure where Enterprise Manager Ops Center executes to compromise Enterprise Manager Ops Center. A successful attack of this vulnerability can result in unauthorized access of Enterprise Manager Ops Center data. (CVE-2019-11358) - An unspecified vulnerability in the OS Provisioning (Apache HTTP Server) component of Oracle Enterprise Manager Ops Center. An easily exploitable vulnerability could allow an unauthenticated attacker with network access via multiple protocols to compromise Enterprise Manager Ops Center. A successful attack of this vulnerability can result in unauthorized access of Enterprise Manager Ops Center data. (CVE-2019-9517) last seen 2020-05-08 modified 2020-01-17 plugin id 133057 published 2020-01-17 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/133057 title Oracle Enterprise Manager Ops Center (Oct 2019 CPU) NASL family Fedora Local Security Checks NASL id FEDORA_2019-2A0CE0C58C.NASL description - https://www.drupal.org/project/drupal/releases/7.66 - https://www.drupal.org/SA-CORE-2019-006 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124699 published 2019-05-09 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124699 title Fedora 30 : drupal7 (2019-2a0ce0c58c) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_FFC73E8787F011E9AD56FCAA147E860E.NASL description Django security releases issued : The clickable last seen 2020-06-01 modified 2020-06-02 plugin id 125750 published 2019-06-07 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125750 title FreeBSD : Django -- AdminURLFieldWidget XSS (ffc73e87-87f0-11e9-ad56-fcaa147e860e) NASL family Misc. NASL id ORACLE_OATS_CPU_JAN_2020.NASL description The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities : - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component: Oracle Flow Builder (Jython)). Supported versions that are affected are 12.5.0.3, 13.1.0.1, 13.2.0.1 and 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. (CVE-2016-4000) - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager subcomponent Oracle Flow Builder (Jython). An unauthenticated, remote attacker with network access via HTTP to compromise Oracle Application Testing Suite. (CVE-2016-4000) - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager subcomponent Load Testing for Web Apps (Apache POI). An unauthenticated, remote attacker with network access via HTTP to compromise Oracle Application Testing Suite and cause the process to hang or frequently repeatable crash (complete DOS). (CVE-2017-12626) - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager subcomponent Oracle Flow Builder (Apache POI). An unauthenticated, remote attacker with network access via HTTP to compromise Oracle Application Testing Suite and cause the process to hang or frequently repeatable crash (complete DOS). (CVE-2017-12626) - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager subcomponent Load Testing for Web Apps (AntiSamy). An unauthenticated, remote attacker with network access via HTTP who is able to obtain human interaction can impact additional products and result in an unauthorized update, insert, or delete access to some accessible data as well as unauthorized read access to a subset of accessible data. (CVE-2017-14735) - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager subcomponent Oracle Flow Builder (Antisamy). An unauthenticated, remote attacker with network access via HTTP who is able to obtain human interaction can impact additional products and result in an unauthorized update, insert, or delete access to some accessible data as well as unauthorized read access to a subset of accessible data. (CVE-2017-14735) - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager subcomponent Load Testing for Web Apps (Application Development Framework). An unauthenticated, remote attacker with network access via HTTP can result in takeover of Oracle Application Testing Suite. (CVE-2019-2904) - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager subcomponent Oracle Flow Builder (jQuery). An unauthenticated, remote attacker with network access via HTTP who is able to obtain human interaction can impact additional products and result in an unauthorized update, insert, or delete access to some accessible data as well as unauthorized read access to a subset of accessible data. (CVE-2019-11358) - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager subcomponent Load Testing for Web Apps (Apache POI). An authenticated, low priviledged remote attacker with network access to the infrastructure can result in unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data. (CVE-2019-12415) - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager subcomponent Oracle Flow Builder. An unauthenticated remote attacker with network access via HTTP can result in unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data. (CVE-2020-2673) last seen 2020-05-08 modified 2020-01-27 plugin id 133260 published 2020-01-27 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/133260 title Oracle Application Testing Suite Multiple Vulnerabilities (Jan 2020 CPU) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2019-3024.NASL description An update for ovirt-web-ui is now available for Red Hat Virtualization Engine 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The ovirt-web-ui package provides the web interface for Red Hat Virtualization. Security Fix(es) : * nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties (CVE-2019-10744) * bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331) * js-jquery: prototype pollution in object last seen 2020-06-01 modified 2020-06-02 plugin id 129862 published 2019-10-15 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/129862 title RHEL 7 : Virtualization Manager (RHSA-2019:3024) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2019-3023.NASL description An update for ovirt-engine-ui-extensions is now available for Red Hat Virtualization Engine 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The ovirt-engine-ui-extensions package contains UI plugins that provide various extensions to the oVirt administration UI. Security Fix(es) : * bootstrap: XSS in the data-target attribute (CVE-2016-10735) * bootstrap: XSS in the tooltip data-viewport attribute (CVE-2018-20676) * bootstrap: XSS in the affix configuration target property (CVE-2018-20677) * bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331) * js-jquery: prototype pollution in object last seen 2020-06-01 modified 2020-06-02 plugin id 129861 published 2019-10-15 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/129861 title RHEL 7 : Virtualization Manager (RHSA-2019:3023) NASL family Fedora Local Security Checks NASL id FEDORA_2019-F563E66380.NASL description - https://www.drupal.org/project/drupal/releases/7.66 - https://www.drupal.org/SA-CORE-2019-006 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124703 published 2019-05-09 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124703 title Fedora 28 : drupal7 (2019-f563e66380) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-4434.NASL description A cross-site scripting vulnerability has been found in Drupal, a fully-featured content management framework. For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2019-006 . last seen 2020-06-01 modified 2020-06-02 plugin id 124205 published 2019-04-22 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124205 title Debian DSA-4434-1 : drupal7 - security update NASL family Fedora Local Security Checks NASL id FEDORA_2019-EBA8E44EE6.NASL description - https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 (CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911) - https://www.drupal.org/SA-CORE-2019-006 (CVE-2019-11358) - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124688 published 2019-05-08 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124688 title Fedora 30 : drupal8 (2019-eba8e44ee6) NASL family Windows NASL id ORACLE_WEBCENTER_SITES_APR_2020_CPU.NASL description Oracle WebCenter Sites component of Oracle Fusion Middleware is vulnerable to multiple vulnerabilities. - Component: Advanced UI (jQuery). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data as well as unauthorized read access to a subset of Oracle WebCenter Sites accessible data (CVE-2019-11358). - Component: Sites (jackson-databind). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites (CVE-2019-16943). - Component: Advanced UI. The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data (CVE-2020-2739 ). last seen 2020-05-08 modified 2020-04-16 plugin id 135676 published 2020-04-16 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/135676 title Oracle WebCenter Sites Multiple Vulnerabilities (April 2020 CPU) NASL family CGI abuses NASL id ORACLE_PRIMAVERA_GATEWAY_CPU_JAN_2020.NASL description According to its self-reported version number, the Oracle Primavera Gateway installation running on the remote web server is 15.x prior to 15.2.18, 16.x prior to 16.2.11, 17.x prior to 17.12.6, or 18.x prior to 18.8.8.1. It is, therefore, affected by multiple vulnerabilities, including the following: - Two Polymorphic Typing issues present in FasterXML jackson-databind related to com.zaxxer.hikari.HikariDataSource which can be exploited by remote, unauthenticated attackers. (CVE-2019-16335, CVE-2019-14540) - A man-in-the-middle vulnerability caused by the getCN function in Apache Axis not properly verifying that the server hostname matches a domain name in the subject last seen 2020-05-08 modified 2020-01-15 plugin id 132936 published 2020-01-15 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132936 title Oracle Primavera Gateway Multiple Vulnerabilities (Jan 2020 CPU) NASL family SuSE Local Security Checks NASL id OPENSUSE-2019-1839.NASL description This update for python-Django fixes the following issues : Security issues fixed : 	 - CVE-2019-11358: Fixed prototype pollution. - CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468) - CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945). - CVE-2019-14232: Fixed denial-of-service possibility in ``django.utils.text.Truncator`` (bsc#1142880). - CVE-2019-14233: Fixed denial-of-service possibility in ``strip_tags()`` (bsc#1142882). - CVE-2019-14234: Fixed SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField`` (bsc#1142883). - CVE-2019-14235: Fixed potential memory exhaustion in ``django.utils.encoding.uri_to_iri()`` (bsc#1142885). Non-security issues fixed : - Fixed a migration crash on PostgreSQL when adding a check constraint with a contains lookup on DateRangeField or DateTimeRangeField, if the right hand side of an expression is the same type. last seen 2020-06-01 modified 2020-06-02 plugin id 127742 published 2019-08-12 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/127742 title openSUSE Security Update : python-Django (openSUSE-2019-1839) NASL family Fedora Local Security Checks NASL id FEDORA_2019-1A3EDD7E8A.NASL description - https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 (CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911) - https://www.drupal.org/SA-CORE-2019-006 (CVE-2019-11358) - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124685 published 2019-05-08 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124685 title Fedora 28 : drupal8 (2019-1a3edd7e8a) NASL family Debian Local Security Checks NASL id DEBIAN_DLA-1797.NASL description Several security vulnerabilities have been discovered in drupal7, a PHP website platform. The vulnerabilities affect the embedded versions of the jQuery JavaScript library and the Typo3 Phar Stream Wrapper library. CVE-2019-11358 It was discovered that the jQuery version embedded in Drupal was prone to a cross site scripting vulnerability in jQuery.extend(). For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2019-006. CVE-2019-11831 It was discovered that incomplete validation in a Phar processing library embedded in Drupal, a fully-featured content management framework, could result in information disclosure. For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2019-007. For Debian 8 last seen 2020-06-01 modified 2020-06-02 plugin id 125298 published 2019-05-21 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125298 title Debian DLA-1797-1 : drupal7 security update NASL family Fedora Local Security Checks NASL id FEDORA_2019-A06DFFAB1C.NASL description - https://www.drupal.org/project/drupal/releases/7.66 - https://www.drupal.org/SA-CORE-2019-006 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124700 published 2019-05-09 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124700 title Fedora 29 : drupal7 (2019-a06dffab1c) NASL family CGI abuses NASL id JQUERY_3_4_0.NASL description The version of JQuery library hosted on the remote web server is prior to 3.4.0. It is, therefore, affected by an object pollution vulnerability in jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. last seen 2020-06-01 modified 2020-06-02 plugin id 124719 published 2019-05-10 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124719 title JQuery < 3.4.0 Object Prototype Pollution Vulnerability NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_3C5A4FE09EBB11E99169FCAA147E860E.NASL description MediaWiki reports : Security fixes : T197279, CVE-2019-12468: Directly POSTing to Special:ChangeEmail would allow for bypassing reauthentication, allowing for potential account takeover. T204729, CVE-2019-12473: Passing invalid titles to the API could cause a DoS by querying the entire `watchlist` table. T207603, CVE-2019-12471: Loading user JavaScript from a non-existent account allows anyone to create the account, and XSS the users last seen 2020-06-01 modified 2020-06-02 plugin id 126485 published 2019-07-05 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/126485 title FreeBSD : mediawiki -- multiple vulnerabilities (3c5a4fe0-9ebb-11e9-9169-fcaa147e860e) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-4460.NASL description Multiple security vulnerabilities have been discovered in MediaWiki, a website engine for collaborative work, which may result in authentication bypass, denial of service, cross-site scripting, information disclosure and bypass of anti-spam measures. last seen 2020-06-01 modified 2020-06-02 plugin id 125858 published 2019-06-13 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125858 title Debian DSA-4460-1 : mediawiki - security update
Redhat
| advisories |
| ||||||||||||||||||||
| rpms |
|
References
- https://www.drupal.org/sa-core-2019-006
- https://snyk.io/vuln/SNYK-JS-JQUERY-174006
- https://github.com/jquery/jquery/pull/4333
- https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b
- https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
- https://backdropcms.org/security/backdrop-sa-core-2019-009
- https://www.debian.org/security/2019/dsa-4434
- https://seclists.org/bugtraq/2019/Apr/32
- http://www.securityfocus.com/bid/108023
- https://lists.debian.org/debian-lts-announce/2019/05/msg00006.html
- https://seclists.org/bugtraq/2019/May/18
- http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
- http://seclists.org/fulldisclosure/2019/May/13
- http://seclists.org/fulldisclosure/2019/May/11
- http://seclists.org/fulldisclosure/2019/May/10
- https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html
- http://www.openwall.com/lists/oss-security/2019/06/03/2
- http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
- https://access.redhat.com/errata/RHSA-2019:1456
- https://www.debian.org/security/2019/dsa-4460
- https://seclists.org/bugtraq/2019/Jun/12
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
- https://access.redhat.com/errata/RHBA-2019:1570
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
- https://access.redhat.com/errata/RHSA-2019:2587
- https://security.netapp.com/advisory/ntap-20190919-0001/
- https://access.redhat.com/errata/RHSA-2019:3023
- https://access.redhat.com/errata/RHSA-2019:3024
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.synology.com/security/advisory/Synology_SA_19_19
- https://www.tenable.com/security/tns-2019-08
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://lists.debian.org/debian-lts-announce/2020/02/msg00024.html
- http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
- https://www.tenable.com/security/tns-2020-02
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
- https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc%40%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205%40%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7%40%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844%40%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f%40%3Ccommits.airflow.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5/
- https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/r38f0d1aa3c923c22977fe7376508f030f22e22c1379fbb155bf29766%40%3Cdev.syncope.apache.org%3E
- https://lists.apache.org/thread.html/r7aac081cbddb6baa24b75e74abf0929bf309b176755a53e3ed810355%40%3Cdev.flink.apache.org%3E
- https://lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d%40%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r2041a75d3fc09dec55adfd95d598b38d22715303f65c997c054844c9%40%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r7e8ebccb7c022e41295f6fdb7b971209b83702339f872ddd8cf8bf73%40%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r41b5bfe009c845f67d4f68948cc9419ac2d62e287804aafd72892b08%40%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r2baacab6e0acb5a2092eb46ae04fd6c3e8277b4fd79b1ffb7f3254fa%40%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r7d64895cc4dff84d0becfc572b20c0e4bf9bfa7b10c6f5f73e783734%40%3Cdev.storm.apache.org%3E