Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

releasealert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

Privacy Policy
Terms of Service
Contact

CVE-2020-11023 — MEDIUM severity vulnerability | Release Alert

CVE-2020-11023

6.9

MEDIUMCVSS v3

Published

April 29, 2020

CVSS v2

4.3 MEDIUM

Affected

15 projects

Assigned by

GitHub

Severity scale

010

Description

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

jquery/jquery

GitHubjQuery JavaScript Library

>= 1.0.3, < 3.5.0NVD

jquery

NPMJavaScript library for DOM operations

>= 1.0.3, < 3.5.0NVD

@types/jquery

NPM

More on this CVE

NVD↗GitHub Advisory↗

TypeScript definitions for jquery

>= 1.0.3, < 3.5.0NVD

@ember/jquery

NPMThe default blueprint for ember-cli addons.

>= 1.0.3, < 3.5.0NVD

drupal/drupal

GitHubVerbatim mirror of the git.drupal.org repository for Drupal core. Please see the https://github.com/drupal/drupal#contributing. PRs are not accepted on GitHub.

>= 7.0, < 7.70, >= 8.7.0, < 8.7.14, >= 8.8.0, < 8.8.6NVD

drupal

RubyGemsComing Soon! This gem is in development - Dont use it, Drupal integration with rails app

>= 7.0, < 7.70, >= 8.7.0, < 8.7.14, >= 8.8.0, < 8.8.6NVD

drupal

NPMImplementation of parts of Drupal’s user/access control API.

>= 7.0, < 7.70, >= 8.7.0, < 8.7.14, >= 8.8.0, < 8.8.6NVD

jquery

Python Package IndexJquery javascript library for TurboGears

>= 1.0.3, < 3.5.0NVD

jQuery

NuGet GalleryjQuery is a new kind of JavaScript Library. jQuery is a fast and concise JavaScript Library that simplifies HTML document traversing, event handling, animating, and Ajax interactions for rapid web development. jQuery is designed to change the way that you write JavaScript. NOTE: This package is maintained on behalf of the library owners by the NuGet Community Packages project at http://nugetpackages.codeplex.com/

>= 1.0.3, < 3.5.0NVD

jquery

RubyGemsjQuery for Ruby.

>= 1.0.3, < 3.5.0NVD