CVE-2019-10785

2020-02-1316:02:46

snyk

www.cve.org

6.1 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.4%

JSON

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.

CNA Affected

[
  {
    "product": "dojox",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9."
      }
    ]
  }
]