dojox vulnerable to unescaped string injection

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2018-15494 · ADVISORY
• dojo/dojox#283 · WEB
• dojotoolkit.org/blog/dojo-1-14-released · WEB
• GitHub Advisory GHSA-84cm-x2q5-8225 · ADVISORY
• dojo/dojox · PACKAGE
• lists.debian.org/debian-lts-announce/2018/09/msg00002.html · WEB

dojo のその他の脆弱性

• CVE-2018-1000665中 6.1Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDO…
• CVE-2018-6561中 6.1dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element.
• CVE-2015-5654中 4.3Cross-site scripting (XSS) vulnerability in Dojo Toolkit before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspe…
• CVE-2010-2276緊急 10.0The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x…
• CVE-2010-2275中 4.3Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject ar…