Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMB609D685D630C87BB458CB89A66B87A64831A7617912F7856869B7F1B264C40C
HistoryJul 19, 2022 - 3:29 a.m.

Security Bulletin: Multiple cross-site scripting vulnerabilities in JQuery affect IBM InfoSphere Information Server

2022-07-1903:29:58
www.ibm.com
76

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

0.061 Low

EPSS

Percentile

93.6%

JSON

Summary

Multiple cross-site scripting vulnerabilities in JQuery used by IBM InfoSphere Information Server were addressed.

Vulnerability Details

CVEID:CVE-2020-11022
**DESCRIPTION:**jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the jQuery.htmlPrefilter method. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/181349 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

CVEID:CVE-2020-11023
**DESCRIPTION:**jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the option elements. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/181350 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

CVEID:CVE-2019-11358
**DESCRIPTION:**jQuery, as used in Drupal core, is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to execute script in a victim’s Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/159633 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
InfoSphere Information Server 11.7

Remediation/Fixes

Product VRMF APAR Remediation
InfoSphere Information Server, InfoSphere Information Server on Cloud 11.7 DT134319 --Apply IBM InfoSphere Information Server version 11.7.1.0
--Apply IBM InfoSphere Information Server version 11.7.1.3
--Apply Information Server 11.7.1.3 Service pack 4
--Apply DataStage Flow Design Security patch

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibminfosphere_information_serverMatch11.7
CPENameOperatorVersion
infosphere information servereq11.7

Related

nessus 41
altlinux 1
ibm 45
fedora 7
atlassian 12
hp 2
attackerkb 2
joomla 1
osv 10
openvas 27
suse 3
githubexploit 6
debian 6
oraclelinux 1
checkpoint_advisories 2
drupal 1
redhat 8
rocky 1
typo3 2
gentoo 1
github 3
freebsd 1
cve 2
amazon 1
nodejs 1
veracode 2
packetstorm 1
symantec 1
f5 1
prion 2
alpinelinux 1
nvd 1
redhatcve 1
ubuntucve 1
cvelist 1
nessus
nessus
RHEL 8 : jquery (Unpatched Vulnerability)
2024-05-11 00:00:00
RHEL 7 : ipa (Unpatched Vulnerability)
2024-06-03 00:00:00
Debian DLA-2608-1 : jquery security update
2021-03-26 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 9 package phpipam version 1.42.027-alt1
2020-10-21 00:00:00
ibm
ibm
Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing (PUB) jQuery Vulnerability
2024-02-15 08:30:09
Security Bulletin: Vulnerability in jQuery affects IBM Process Mining (Multiple CVEs)
2023-02-01 21:57:35
Security Bulletin: Multiple vulnerabilities found in third party libraries used by IBM® MobileFirst Platform
2023-04-19 17:26:48
fedora
fedora
[SECURITY] Fedora 32 Update: drupal8-8.9.0-1.fc32
2020-06-16 01:32:24
[SECURITY] Fedora 33 Update: drupal7-7.72-1.fc33
2020-09-25 17:15:48
[SECURITY] Fedora 32 Update: cacti-1.2.13-1.fc32
2020-07-23 01:06:59
atlassian
atlassian
Update jQuery to avoid CVE-2020-11022 and CVE-2020-11023
2021-02-02 09:59:24
Update jQuery to avoid CVE-2020-11022 and CVE-2020-11023
2021-02-02 09:59:24
jquery 2.2.4 XSS vulnerability
2022-08-24 14:53:45
hp
hp
HPSBPI03688 rev. 1 - Certain HP Printer and MFP products - Cross-Site Scripting (XSS)
2020-09-17 00:00:00
Certain HP Printers and MFP products - Cross-Site Scripting (XSS)
2020-09-17 00:00:00
attackerkb
attackerkb
CVE-2020-11023
2020-04-29 00:00:00
CVE-2020-11022
2020-04-29 00:00:00
joomla
joomla
[20200604] - Core - XSS in jQuery.htmlPrefilter
2020-04-10 00:00:00
osv
osv
jquery - security update
2021-03-25 00:00:00
drupal7 - security update
2020-05-26 00:00:00
Low: pcs security, bug fix, and enhancement update
2021-11-09 08:21:49
openvas
openvas
openSUSE: Security Advisory for otrs (openSUSE-SU-2020:1888-1)
2020-11-10 00:00:00
Debian: Security Advisory (DLA-2608-1)
2021-03-26 00:00:00
Discourse < 2.5.0.beta5 Multiple Vulnerabilities
2020-05-28 00:00:00
suse
suse
Security update for otrs (moderate)
2020-11-10 00:00:00
Security update for cacti, cacti-spine (moderate)
2020-07-25 00:00:00
Security update for cacti, cacti-spine (moderate)
2020-07-28 00:00:00
githubexploit
githubexploit
Exploit for Cross-site Scripting in Jquery
2021-10-16 01:10:33
Exploit for Cross-site Scripting in Jquery
2020-04-14 19:12:01
Exploit for Cross-site Scripting in Jquery
2020-11-02 20:55:10
debian
debian
[SECURITY] [DSA 4693-1] drupal7 security update
2020-05-26 21:08:21
[SECURITY] [DLA 2608-1] jquery security update
2021-03-26 01:32:22
[SECURITY] [DSA 4434-1] drupal7 security update
2019-04-20 12:03:09
oraclelinux
oraclelinux
jquery-ui security update
2022-03-01 00:00:00
checkpoint_advisories
checkpoint_advisories
jQuery Cross Site Scripting (CVE-2020-11022; CVE-2020-11023)
2020-11-16 00:00:00
jQuery Prototype Pollution Object Cross-Site Scripting (CVE-2019-11358)
2019-04-29 00:00:00
drupal
drupal
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002
2020-05-20 00:00:00
redhat
redhat
(RHSA-2020:4211) Moderate: Red Hat AMQ Interconnect 1.9.0 release and security update
2020-10-08 06:44:00
(RHSA-2022:7343) Important: pcs security update
2022-11-02 16:05:00
(RHSA-2021:4142) Low: pcs security, bug fix, and enhancement update
2021-11-09 08:21:49
rocky
rocky
pcs security, bug fix, and enhancement update
2021-11-09 08:21:49
typo3
typo3
Cross-Site Scripting in extension "Kitodo.Presentation" (dlf)
2020-07-29 00:00:00
Cross-Site Scripting in jQuery before 3.4.0
2019-05-07 00:00:00
gentoo
gentoo
Cacti: Multiple vulnerabilities
2020-07-26 00:00:00
github
github
Persistent Cross-site Scripting vulnerability in PrivateBin
2022-04-12 20:45:22
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
2019-04-26 16:29:11
eZ Platform Bundled jQuery affected by CVE-2019-11358
2024-05-15 21:08:41
freebsd
freebsd
Cacti -- multiple vulnerabilities
2020-07-15 00:00:00
cve
cve
CVE-2020-11022
2020-04-29 22:15:11
CVE-2019-11358
2019-04-20 00:29:00
amazon
amazon
Medium: pcs
2023-01-18 00:16:00
nodejs
nodejs
Cross-Site Scripting
2020-04-30 18:19:09
veracode
veracode
Cross-Site Scripting (XSS)
2020-04-30 01:59:55
Prototype Pollution
2019-04-22 03:41:01
packetstorm
packetstorm
jQuery 1.2 Cross Site Scripting
2021-04-14 00:00:00
symantec
symantec
JQuery CVE-2019-11358 Cross Site Scripting Vulnerability
2019-04-17 00:00:00
f5
f5
K20455158 : jQuery vulnerability CVE-2019-11358
2020-04-14 00:00:00
prion
prion
Design/Logic Flaw
2019-04-20 00:29:00
Code injection
2020-04-29 21:15:00
alpinelinux
alpinelinux
CVE-2019-11358
2019-04-20 00:29:00
nvd
nvd
CVE-2019-11358
2019-04-20 00:29:00
redhatcve
redhatcve
CVE-2019-11358
2021-07-18 00:15:31
ubuntucve
ubuntucve
CVE-2019-11358
2019-04-20 00:00:00
cvelist
cvelist
CVE-2019-11358
2019-04-19 00:00:00

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

0.061 Low

EPSS

Percentile

93.6%

JSON
Related for B609D685D630C87BB458CB89A66B87A64831A7617912F7856869B7F1B264C40C
nessus41altlinux1ibm45fedora7atlassian12hp2attackerkb2joomla1osv10openvas27suse3githubexploit6debian6oraclelinux1checkpoint_advisories2drupal1redhat8rocky1typo32gentoo1github3freebsd1cve2amazon1nodejs1veracode2packetstorm1symantec1f51prion2alpinelinux1nvd1redhatcve1ubuntucve1cvelist1