TI-2020-01862 CVE-2020-1938 · GHSA-c9hw-wf7x-jp9j
Improper privilege management in Apache Tomcat
Priority CRITICAL 100KEV
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.
RHSA-2020:4847
pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
Released 2020-11-04 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
Fixes 17 records
TI-2020-08897 CVE-2020-11023 · GHSA-jpcq-cgw6-v4j6
Potential XSS vulnerability in jQuery
Priority CRITICAL 88KEV
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.
TI-2020-08896 CVE-2020-11022 · GHSA-gxr4-xjj5-5px2
jQuery has a potential XSS vulnerability
Priority HIGH 75
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.
TI-2019-08480 CVE-2019-11358 · GHSA-6c3j-c64m-qhgq
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles…
Priority HIGH 69
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution.
TI-2022-09336 CVE-2022-25762 · GHSA-h3ch-5pp2-vh6w
Response mix-up with WebSocket concurrent send and close
Priority MEDIUM 54
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application wil…
TI-2015-07630 CVE-2015-9251 · GHSA-rmxg-73gg-4p98
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a…
Priority MEDIUM 51
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
TI-2019-05979 CVE-2019-8331 · GHSA-9v3m-8fp8-mj99
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
Priority MEDIUM 44
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
TI-2020-01859 CVE-2020-1935 · GHSA-qxf4-chvg-4r8r
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header…
Priority MEDIUM 40
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid.
TI-2018-10147 CVE-2018-14042 · GHSA-7mvr-5x2g-wfc8
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
Priority LOW 34
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
TI-2018-10145 CVE-2018-14040 · GHSA-3wqf-4x89-9g79
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
Priority LOW 34
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
TI-2016-08775 CVE-2016-10735 · GHSA-4p24-vmcr-4gqj
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the…
Priority LOW 34
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.
TI-2020-12392 CVE-2020-15720 · GHSA-hpcm-hcj8-c96c
In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable…
Priority LOW 32
In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation.
TI-2020-15729 CVE-2020-25715 · GHSA-cg99-xqcm-67pf
Cross-site scripting in pki-core
Priority LOW 30
A flaw was found in pki-core 10.9.0.
TI-2019-07541 CVE-2019-10221 · GHSA-wfff-rc4w-hpx2
Cross-site scripting in [UNKNOWN] pki-core
Priority LOW 30
A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server.
TI-2020-01665 CVE-2020-1721 · GHSA-j9fq-77vj-2ww7
Cross-site scripting in pki-core
Priority LOW 29
A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting (XSS) vul…
TI-2019-07500 CVE-2019-10179 · GHSA-rwmx-694x-q86h
Cross-site scripting in [UNKNOWN] pki-core/pki-kra
Priority LOW 29
A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vuln…
TI-2019-07469 CVE-2019-10146 · GHSA-9wr3-2hgg-f56c
Cross-site scripting in Red Hat pki-core
Priority LOW 23
A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page.