dojox vulnerable to unescaped string injection

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2018-15494 · ADVISORY
• dojo/dojox#283 · WEB
• dojotoolkit.org/blog/dojo-1-14-released · WEB
• GitHub Advisory GHSA-84cm-x2q5-8225 · ADVISORY
• dojo/dojox · PACKAGE
• lists.debian.org/debian-lts-announce/2018/09/msg00002.html · WEB

Lỗ hổng khác của dojo

• CVE-2018-1000665TRUNG BÌNH 6.1Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDO…
• CVE-2018-6561TRUNG BÌNH 6.1dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element.
• CVE-2015-5654TRUNG BÌNH 4.3Cross-site scripting (XSS) vulnerability in Dojo Toolkit before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspe…
• CVE-2010-2276NGHIÊM TRỌNG 10.0The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x…
• CVE-2010-2275TRUNG BÌNH 4.3Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject ar…