You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Vulnerable Library - Nexmo-Stitch-1.8.0
Path to dependency file: /examples/Podfile.lock
Path to vulnerable library: /examples/Podfile.lock,/examples/QuickStartThree/Podfile.lock
Found in HEAD commit: 2c6ac088ded77d7891305f9f668de29e8e5f9b88
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2020-11023
Vulnerable Library - Socket.IO-Client-Swift-13.3.0
Socket.IO-client for iOS and OS X. Supports ws/wss/polling connections and binary. For socket.io 2.0+ and Swift.
Library home page: https://github.com/socketio/socket.io-client-swift/archive/v13.3.0.zip
Path to dependency file: /examples/Podfile.lock
Path to vulnerable library: /examples/Podfile.lock,/examples/QuickStartThree/Podfile.lock
Dependency Hierarchy:
Found in HEAD commit: 2c6ac088ded77d7891305f9f668de29e8e5f9b88
Found in base branch: main
Vulnerability Details
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
URL: CVE-2020-11023
Threat Assessment
Exploit Maturity: Proof of concept
EPSS: 1.9%
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440
Release Date: 2020-04-29
Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0
CVE-2020-11022
Vulnerable Library - Socket.IO-Client-Swift-13.3.0
Socket.IO-client for iOS and OS X. Supports ws/wss/polling connections and binary. For socket.io 2.0+ and Swift.
Library home page: https://github.com/socketio/socket.io-client-swift/archive/v13.3.0.zip
Path to dependency file: /examples/Podfile.lock
Path to vulnerable library: /examples/Podfile.lock,/examples/QuickStartThree/Podfile.lock
Dependency Hierarchy:
Found in HEAD commit: 2c6ac088ded77d7891305f9f668de29e8e5f9b88
Found in base branch: main
Vulnerability Details
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
URL: CVE-2020-11022
Threat Assessment
Exploit Maturity: Proof of concept
EPSS: 6.1%
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
Release Date: 2020-04-29
Fix Resolution: jQuery - 3.5.0
CVE-2019-11358
Vulnerable Library - Socket.IO-Client-Swift-13.3.0
Socket.IO-client for iOS and OS X. Supports ws/wss/polling connections and binary. For socket.io 2.0+ and Swift.
Library home page: https://github.com/socketio/socket.io-client-swift/archive/v13.3.0.zip
Path to dependency file: /examples/Podfile.lock
Path to vulnerable library: /examples/Podfile.lock,/examples/QuickStartThree/Podfile.lock
Dependency Hierarchy:
Found in HEAD commit: 2c6ac088ded77d7891305f9f668de29e8e5f9b88
Found in base branch: main
Vulnerability Details
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.
Publish Date: 2019-04-20
URL: CVE-2019-11358
Threat Assessment
Exploit Maturity: Proof of concept
EPSS: 3.5%
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358
Release Date: 2019-04-20
Fix Resolution: jquery - 3.4.0
CVE-2015-9251
Vulnerable Library - Socket.IO-Client-Swift-13.3.0
Socket.IO-client for iOS and OS X. Supports ws/wss/polling connections and binary. For socket.io 2.0+ and Swift.
Library home page: https://github.com/socketio/socket.io-client-swift/archive/v13.3.0.zip
Path to dependency file: /examples/Podfile.lock
Path to vulnerable library: /examples/Podfile.lock,/examples/QuickStartThree/Podfile.lock
Dependency Hierarchy:
Found in HEAD commit: 2c6ac088ded77d7891305f9f668de29e8e5f9b88
Found in base branch: main
Vulnerability Details
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Publish Date: 2018-01-18
URL: CVE-2015-9251
Threat Assessment
Exploit Maturity: High
EPSS: 0.70000005%
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251
Release Date: 2018-01-18
Fix Resolution: jQuery - 3.0.0
The text was updated successfully, but these errors were encountered: