Lucene search
Debian Security Bug TrackerDEBIANCVE:CVE-2019-11358HistoryApr 20, 2019 - 12:29 a.m.
CVE-2019-11358
2019-04-2000:29:00
Debian Security Bug Tracker
security-tracker.debian.org
36
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.024
Percentile
90.2%
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, …) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | mediawiki | < 1:1.31.2-1 | mediawiki_1:1.31.2-1_all.deb |
| Debian | 11 | all | mediawiki | < 1:1.31.2-1 | mediawiki_1:1.31.2-1_all.deb |
| Debian | 999 | all | mediawiki | < 1:1.31.2-1 | mediawiki_1:1.31.2-1_all.deb |
| Debian | 13 | all | mediawiki | < 1:1.31.2-1 | mediawiki_1:1.31.2-1_all.deb |
| Debian | 12 | all | node-jquery | < 2.2.4+dfsg-4 | node-jquery_2.2.4+dfsg-4_all.deb |
| Debian | 11 | all | node-jquery | < 2.2.4+dfsg-4 | node-jquery_2.2.4+dfsg-4_all.deb |
| Debian | 999 | all | node-jquery | < 2.2.4+dfsg-4 | node-jquery_2.2.4+dfsg-4_all.deb |
| Debian | 13 | all | node-jquery | < 2.2.4+dfsg-4 | node-jquery_2.2.4+dfsg-4_all.deb |
| Debian | 11 | all | otrs2 | < 6.0.26-1 | otrs2_6.0.26-1_all.deb |
Related
debian
debian
[SECURITY] [DSA 4434-1] drupal7 security update
2019-04-20 12:03:09
[SECURITY] [DSA 4434-1] drupal7 security update
2019-04-20 12:03:09
[SECURITY] [DLA 2118-1] otrs2 security update
2020-02-24 17:03:32
nessus
nessus
RHEL 7 : python-XStatic-jQuery (RHSA-2020:5581)
2020-12-18 00:00:00
Fedora 28 : drupal7 (2019-f563e66380)
2019-05-09 00:00:00
Oracle Enterprise Manager Ops Center UI or Other Patch (Oct 2019 CPU)
2023-01-12 00:00:00
fedora
fedora
[SECURITY] Fedora 30 Update: drupal7-7.66-1.fc30
2019-05-09 01:34:20
[SECURITY] Fedora 30 Update: drupal7-7.67-1.fc30
2019-05-25 01:06:23
[SECURITY] Fedora 30 Update: drupal7-7.69-1.fc30
2020-01-04 22:16:18
checkpoint_advisories
checkpoint_advisories
jQuery Prototype Pollution Object Cross-Site Scripting (CVE-2019-11358)
2019-04-29 00:00:00
ibm
ibm
amazon
amazon
Medium: pcs
2023-01-18 00:16:00
osv
osv
CVE-2019-11358
2019-04-20 00:29:00
otrs2 - security update
2020-02-24 00:00:00
jquery - security update
2019-05-06 00:00:00
atlassian
atlassian
Update jQuery to address CVE-2019-11358
2019-08-01 05:11:29
Address CVE-2019-11358 in the bundled version of jQuery
2019-07-08 22:57:45
jQuery 2.2.4 is vulnerable to prototype pollution
2019-05-13 01:57:29
rubygems
rubygems
Prototype pollution attack through jQuery $.extend
2019-04-18 21:00:00
redhat
redhat
(RHSA-2020:5581) Moderate: python-XStatic-jQuery security update
2020-12-16 12:57:14
(RHSA-2020:1325) Moderate: python-XStatic-jQuery security update
2020-04-06 08:40:52
hackerone
hackerone
friendsofphp
friendsofphp
EZSA-2019-005 Bundled jQuery affected by CVE-2019-11358
2019-07-04 12:28:00
openvas
openvas
Django jQuery Vulnerability - Linux
2019-06-26 00:00:00
Debian: Security Advisory (DLA-1777-1)
2019-05-07 00:00:00
Django jQuery Vulnerability - Windows
2019-06-26 00:00:00
cvelist
cvelist
CVE-2019-11358
2019-04-19 00:00:00
joomla
joomla
[20190403] - Core - Object.prototype pollution in JQuery $.extend
2019-03-25 00:00:00
ubuntucve
ubuntucve
CVE-2019-11358
2019-04-20 00:00:00
drupal
drupal
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-006
2019-04-17 00:00:00
cbl_mariner
cbl_mariner
veracode
veracode
Prototype Pollution
2019-04-22 03:41:01
alpinelinux
alpinelinux
CVE-2019-11358
2019-04-20 00:29:00
nvd
nvd
CVE-2019-11358
2019-04-20 00:29:00
CVE-2019-5428
2019-04-22 21:29:00
githubexploit
githubexploit
Exploit for Prototype Pollution in Jquery
2020-12-01 09:18:58
Exploit for Prototype Pollution in Jquery
2019-07-18 19:15:33
Exploit for Prototype Pollution in Jquery
2021-03-08 11:34:11
github
github
eZ Platform Bundled jQuery affected by CVE-2019-11358
2024-05-15 21:08:41
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
2019-04-26 16:29:11
redhatcve
redhatcve
CVE-2019-11358
2021-07-18 00:15:31
cve
cve
CVE-2019-11358
2019-04-20 00:29:00
CVE-2019-5428
2019-04-22 21:29:00
symantec
symantec
JQuery CVE-2019-11358 Cross Site Scripting Vulnerability
2019-04-17 00:00:00
typo3
typo3
Cross-Site Scripting in jQuery before 3.4.0
2019-05-07 00:00:00
prion
prion
Design/Logic Flaw
2019-04-20 00:29:00
f5
f5
K20455158 : jQuery vulnerability CVE-2019-11358
2020-04-14 00:00:00
freebsd
freebsd
Django -- AdminURLFieldWidget XSS
2019-06-03 00:00:00
mediawiki -- multiple vulnerabilities
2019-04-23 00:00:00
oraclelinux
oraclelinux
pcs security update
2022-11-03 00:00:00
ipa security, bug fix, and enhancement update
2020-10-06 00:00:00
idm:DL1 and idm:client security, bug fix, and enhancement update
2020-11-10 00:00:00
attackerkb
attackerkb
CVE-2019-11358
2019-04-20 00:00:00
archlinux
archlinux
[ASA-201906-2] python-django: cross-site scripting
2019-06-04 00:00:00
cnvd
cnvd
Silverstripe framework cross-site scripting vulnerability
2022-11-23 00:00:00
rocky
rocky
pcs security, bug fix, and enhancement update
2021-11-09 08:21:49
idm:DL1 and idm:client security, bug fix, and enhancement update
2020-11-03 12:25:36
altlinux
altlinux
Security fix for the ALT Linux 9 package phpipam version 1.42.027-alt1
2020-10-21 00:00:00
Security fix for the ALT Linux 9 package mediawiki version 1.32.2-alt1
2019-06-13 00:00:00
suse
suse
Security update for python-Django (moderate)
2019-08-08 00:00:00
Security update for python-Django (moderate)
2019-08-14 00:00:00
centos
centos
ipa, python2 security update
2020-10-20 18:15:27
almalinux
almalinux
Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update
2020-11-03 12:25:36
mageia
mageia
Updated mediawiki packages fix security vulnerabilities
2019-09-15 17:45:31
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.024
Percentile
90.2%
Related for DEBIANCVE:CVE-2019-11358