jQuery has a potential XSS vulnerability
Priority HIGH 75CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Partial Red Hat: 26 fixed, 10 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.99215 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial jQuery (jquery): 3.5.0jquery (npm): 3.5.0+6 more productsRed Hat: 23 advisoriesRed Hat: 26 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| JQuery | jQuery | 1.12.0 to before 3.5.0 | 3.5.0 | Patch available | CNA |
| — | jquery (npm) | 1.12.0 to before 3.5.0 | 3.5.0 | Patch available | GHSA-gxr4-xjj5-5px2 |
| — | jquery (NuGet) | 1.12.0 to before 3.5.0 | 3.5.0 | Patch available | GHSA-gxr4-xjj5-5px2 |
| — | jquery-rails (RubyGems) | before 4.4.0 | 4.4.0 | Patch available | GHSA-gxr4-xjj5-5px2 |
| — | org.webjars.npm:jquery (Maven) | 1.12.0 to before 3.5.0 | 3.5.0 | Patch available | GHSA-gxr4-xjj5-5px2 |
| — | maximebf/debugbar (Packagist) | before 1.19.0 | 1.19.0 | Patch available | GHSA-gxr4-xjj5-5px2 |
| — | athlon1600/youtube-downloader (Packagist) | before 4.0.1 | 4.0.1 | Patch available | GHSA-gxr4-xjj5-5px2 |
| — | components/jquery (Packagist) | 1.12.0 to before 3.5.0 | 3.5.0 | Patch available | GHSA-gxr4-xjj5-5px2 |
- jQuery VendorJQuery Affected 1.12.0 to before 3.5.0 Fixed in 3.5.0 Patch available CNA
- jquery (npm) Vendor— Affected 1.12.0 to before 3.5.0 Fixed in 3.5.0 Patch available GHSA-gxr4-xjj5-5px2
- jquery (NuGet) Vendor— Affected 1.12.0 to before 3.5.0 Fixed in 3.5.0 Patch available GHSA-gxr4-xjj5-5px2
- jquery-rails (RubyGems) Vendor— Affected before 4.4.0 Fixed in 4.4.0 Patch available GHSA-gxr4-xjj5-5px2
- org.webjars.npm:jquery (Maven) Vendor— Affected 1.12.0 to before 3.5.0 Fixed in 3.5.0 Patch available GHSA-gxr4-xjj5-5px2
- maximebf/debugbar (Packagist) Vendor— Affected before 1.19.0 Fixed in 1.19.0 Patch available GHSA-gxr4-xjj5-5px2
- athlon1600/youtube-downloader (Packagist) Vendor— Affected before 4.0.1 Fixed in 4.0.1 Patch available GHSA-gxr4-xjj5-5px2
- components/jquery (Packagist) Vendor— Affected 1.12.0 to before 3.5.0 Fixed in 3.5.0 Patch available GHSA-gxr4-xjj5-5px2
CPE configurations NVD · 127
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* | 1.2 to before 3.5.0 | Vulnerable | JQuery |
| cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* | 7.0 to before 7.70; 8.7.0 to before 8.7.14; 8.8.0 to before 8.8.6 | Vulnerable | Drupal |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:* | 6.2.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* | 13.3.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:* | 18.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:* | 18.2 | Vulnerable | Oracle |
- cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* Versions 1.2 to before 3.5.0 Vulnerable ·JQuery
- cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 7.0 to before 7.70; 8.7.0 to before 8.7.14; 8.8.0 to before 8.8.6 Vulnerable ·Drupal
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:* Versions 6.2.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* Versions 13.3.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:* Versions 18.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:* Versions 18.2 Vulnerable ·Oracle
Show 117 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:* | 18.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* | 19.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* | 19.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* | 20.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* | before 21.1.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:* | 3.8m0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* | 7.5.0.23.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* | 12.0.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\::*:*:*:*:*:*:*:* | 8.0.0 – 8.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* | 16.1.0 – 16.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:* | 7.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* | 12.4.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* | 8.0.6.0.0 – 8.1.0.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:* | 8.0.6 – 8.0.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.6:*:*:*:*:*:*:* | 8.0.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.7:*:*:*:*:*:*:* | 8.0.7 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:* | 8.0.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:* | 8.0.6 – 8.0.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:* | 8.0.6 – 8.0.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:* | 8.0.6 – 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:* | 8.0.6 – 8.0.9 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:* | 8.0.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.7:*:*:*:*:*:*:* | 8.0.7 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.6:*:*:*:*:*:*:* | 8.0.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.7:*:*:*:*:*:*:* | 8.0.7 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:* | 8.0.6 – 8.0.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:* | 8.0.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.7:*:*:*:*:*:*:* | 8.0.7 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:* | 8.0.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:* | 8.0.7 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* | 8.0.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:* | 8.0.6 – 8.0.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* | 8.0.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* | 8.0.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:* | 8.0.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.7:*:*:*:*:*:*:* | 8.0.7 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_profitability_management:8.0.6:*:*:*:*:*:*:* | 8.0.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_profitability_management:8.0.7:*:*:*:*:*:*:* | 8.0.7 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:*:*:*:*:*:*:*:* | 8.0.6 – 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:* | 8.0.6 – 8.0.9 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:* | 7.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:* | 7.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:healthcare_foundation:7.2.1:*:*:*:*:*:*:* | 7.2.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:* | 7.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* | 18.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hospitality_simphony:*:*:*:*:*:*:*:* | 19.1.0 – 19.1.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:* | 18.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:* | 18.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:* | 8.0.9 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:* | 8.0.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_data_foundation:*:*:*:*:*:*:*:* | 8.0.6 – 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:* | 5.0.0.0 – 5.6.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:* | 5.6.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* | 11.1.1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* | 8.56 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* | 8.57 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | 8.58 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* | 12.2.0 – 12.2.20 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:* | 10.4.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:* | 12.2.0 – 12.2.20 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* | 14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* | 19.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:* | 14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:* | 20.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* | 8.5.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* | 10.3.6.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* | 12.1.3.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* | 14.1.1.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* | 3.0 – 3.1.3 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* | 15.2 | Vulnerable | openSUSE |
| cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:* | before 6.0.9 | Vulnerable | Tenable |
| cpe:2.3:a:oracle:agile_product_supplier_collaboration_for_process:6.2.0.0:*:*:*:*:*:*:* | 6.2.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:* | 18.1 – 20.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* | 8.0.6 – 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hospitality_simphony:19.1.0-19.1.2:*:*:*:*:*:*:* | 19.1.0-19.1.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_data_foundation:8.0.6-8.1.0:*:*:*:*:*:*:* | 8.0.6-8.1.0 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:* Versions 18.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* Versions before 21.1.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:* Versions 3.8m0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* Versions 7.5.0.23.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\::*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* Versions 16.1.0 – 16.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* Versions 12.4.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 8.0.6.0.0 – 8.1.0.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.0.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.7:*:*:*:*:*:*:* Versions 8.0.7 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:* Versions 8.0.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.0.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.0.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.0.9 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.7:*:*:*:*:*:*:* Versions 8.0.7 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.7:*:*:*:*:*:*:* Versions 8.0.7 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.0.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.7:*:*:*:*:*:*:* Versions 8.0.7 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:* Versions 8.0.7 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* Versions 8.0.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.0.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:* Versions 8.0.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.7:*:*:*:*:*:*:* Versions 8.0.7 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_profitability_management:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_profitability_management:8.0.7:*:*:*:*:*:*:* Versions 8.0.7 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.0.9 Vulnerable ·Oracle
- cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:* Versions 7.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:healthcare_foundation:7.2.1:*:*:*:*:*:*:* Versions 7.2.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* Versions 18.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hospitality_simphony:*:*:*:*:*:*:*:* Versions 19.1.0 – 19.1.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:* Versions 18.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:* Versions 18.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:* Versions 8.0.9 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:* Versions 8.0.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_data_foundation:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:* Versions 5.0.0.0 – 5.6.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:* Versions 5.6.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* Versions 8.56 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
- cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* Versions 12.2.0 – 12.2.20 Vulnerable ·Oracle
- cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:* Versions 10.4.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:* Versions 12.2.0 – 12.2.20 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* Versions 19.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:* Versions 20.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* Versions 8.5.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* Versions 10.3.6.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle
- cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* Versions 3.0 – 3.1.3 Vulnerable ·NetApp
- cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
- cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:* Versions before 6.0.9 Vulnerable ·Tenable
- cpe:2.3:a:oracle:agile_product_supplier_collaboration_for_process:6.2.0.0:*:*:*:*:*:*:* Versions 6.2.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:* Versions 18.1 – 20.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hospitality_simphony:19.1.0-19.1.2:*:*:*:*:*:*:* Versions 19.1.0-19.1.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_data_foundation:8.0.6-8.1.0:*:*:*:*:*:*:* Versions 8.0.6-8.1.0 Vulnerable ·Oracle
Remediation
- Fix · CNA jQuery (jquery) Fixed in 3.5.0
- Fix · GHSA-gxr4-xjj5-5px2 jquery (npm) Fixed in 3.5.0 Advisory →
- Fix · GHSA-gxr4-xjj5-5px2 jquery (NuGet) Fixed in 3.5.0 Advisory →
- Fix · GHSA-gxr4-xjj5-5px2 jquery-rails (RubyGems) Fixed in 4.4.0 Advisory →
- Fix · GHSA-gxr4-xjj5-5px2 org.webjars.npm:jquery (Maven) Fixed in 3.5.0 Advisory →
- Fix · GHSA-gxr4-xjj5-5px2 maximebf/debugbar (Packagist) Fixed in 1.19.0 Advisory →
- Fix · GHSA-gxr4-xjj5-5px2 athlon1600/youtube-downloader (Packagist) Fixed in 4.0.1 Advisory →
- Fix · GHSA-gxr4-xjj5-5px2 components/jquery (Packagist) Fixed in 3.5.0 Advisory →
Red Hat 23 advisories
- RHSA-2023:1043 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el7sso
- RHSA-2023:1049 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update
- Red Hat Single Sign-On 7
- RHSA-2023:1047 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
Show 20 more Red Hat advisories
- RHSA-2023:1045 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el9sso
- RHSA-2023:1044 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el8sso
- RHSA-2023:0556 Released 2023-01-31 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.9 Security update
- Red Hat JBoss Enterprise Application Platform 7.4.9 com.fasterxml.jackson.core.jackson-databind-2.12.7.redhat-00003.jar, com.fasterxml.woodstox.woodstox-core-6.4.0.redhat-00001.jar, org.apache.cxf.cxf-core-3.4.10.redhat-00001.jar +4
- RHSA-2023:0554 Released 2023-01-31 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.9 Security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el9eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el9eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el9eap +44
- RHSA-2023:0552 Released 2023-01-31 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.9 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd-2.9.2-1.redhat_00001.1.el7eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el7eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el7eap +46
- RHSA-2023:0553 Released 2023-01-31 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.9 Security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el8eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el8eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el8eap +44
- RHSA-2022:6393 Released 2022-09-08 · Red Hat rating ImportantRHV Manager (ovirt-engine) [ovirt-4.5.2] bug fix and security update
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-4.5.2.4-0.1.el8ev, ovirt-engine-backend-4.5.2.4-0.1.el8ev, ovirt-engine-dbscripts-4.5.2.4-0.1.el8ev +20
- RHSA-2021:0778 Released 2021-03-09 · Red Hat rating ImportantRed Hat Ansible Tower 3.6.7-1 - Container security and bug fix update
- Red Hat Ansible Tower 3.6 for RHEL 7 ansible-tower-36/ansible-tower
- RHSA-2020:5249 Released 2020-11-30 · Red Hat rating Moderatesecurity update - Red Hat Ansible Tower 3.7.4-1 - RHEL7 Container
- Red Hat Ansible Tower 3.7 for RHEL 7 ansible-tower-37/ansible-tower-rhel7
- RHSA-2020:4847 Released 2020-11-04 · Red Hat rating Moderatepki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
- RHSA-2020:4670 Released 2020-11-04 · Red Hat rating Moderateidm:DL1 and idm:client security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.aarch64::idm:DL1, bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.ppc64le::idm:DL1, bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.s390x::idm:DL1 +47
- RHSA-2020:4298 Released 2020-10-27 · Red Hat rating ModerateOpenShift Container Platform 4.6.1 image security update
- Red Hat OpenShift Container Platform 4.6 openshift4/ose-ansible-operator, openshift4/ose-aws-machine-controllers, openshift4/ose-azure-machine-controllers +47
- RHSA-2020:4211 Released 2020-10-08 · Red Hat rating ModerateRed Hat AMQ Interconnect 1.9.0 release and security update
- Red Hat AMQ Interconnect 1 qpid-dispatch-1.13.0-3.el6_10, qpid-dispatch-1.13.0-3.el7, qpid-dispatch-1.13.0-3.el8 +12
- RHSA-2020:3936 Released 2020-09-29 · Red Hat rating Moderateipa security, bug fix, and enhancement update
- Red Hat Enterprise Linux Client (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +4
- Red Hat Enterprise Linux Client Optional (v. 7) ipa-server-4.6.8-5.el7, ipa-server-common-4.6.8-5.el7, ipa-server-dns-4.6.8-5.el7 +2
- Red Hat Enterprise Linux ComputeNode (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +4
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server-4.6.8-5.el7, ipa-server-common-4.6.8-5.el7, ipa-server-dns-4.6.8-5.el7 +2
- Red Hat Enterprise Linux Server (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +9
- Red Hat Enterprise Linux Workstation (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +9
- RHSA-2020:3807 Released 2020-09-23 · Red Hat rating ModerateRed Hat Virtualization security, bug fix, and enhancement update
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-4.4.2.3-0.6.el8ev, ovirt-engine-backend-4.4.2.3-0.6.el8ev, ovirt-engine-dbscripts-4.4.2.3-0.6.el8ev +19
- RHSA-2020:3247 Released 2020-08-04 · Red Hat rating ImportantRHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 novnc-1.1.0-1.el8ost, ovirt-engine-4.4.1.8-0.7.el8ev, ovirt-engine-api-explorer-0.0.6-1.el8ev +21
- RHSA-2020:2412 Released 2020-07-13 · Red Hat rating ModerateOpenShift Container Platform 4.5 container image security update
- Red Hat OpenShift Container Platform 4.5 openshift4/ose-cluster-logging-operator, openshift4/ose-console, openshift4/ose-hyperkube +2
- RHSA-2020:2813 Released 2020-07-02 · Red Hat rating ImportantRed Hat Single Sign-On 7.4.1 security update
- Red Hat Single Sign-On 7.4.1
- RHSA-2020:2362 Released 2020-06-02 · Red Hat rating ModerateRed Hat OpenShift Service Mesh security update
- OpenShift Service Mesh 1.0 servicemesh-grafana-6.2.2-36.el8, servicemesh-grafana-prometheus-6.2.2-36.el8
- Red Hat OpenShift Service Mesh 1.0 jaeger-v1.13.1.redhat7-1.el7, kiali-v1.0.11.redhat1-1.el7
- RHSA-2020:2217 Released 2020-05-28 · Red Hat rating ModerateOpenShift Container Platform 3.11 security update
- Red Hat OpenShift Container Platform 3.11 atomic-openshift-web-console-3.11.219-1.git.1.9b9b889.el7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| CloudForms Management Engine 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat Satellite 5 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Virtualization 4 | Affected | No fix yet: Fix deferred |
| Middleware Containers for OpenShift | Fixed | RHSA-2023:1047 |
| OpenShift Service Mesh 1.0 | Fixed | RHSA-2020:2362 |
| RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 | Fixed | RHSA-2020:3247, RHSA-2020:3807, RHSA-2022:6393 |
| Red Hat AMQ Interconnect 1 | Fixed | RHSA-2020:4211 |
| Red Hat Ansible Tower 3.6 for RHEL 7 | Fixed | RHSA-2021:0778 |
| Red Hat Ansible Tower 3.7 for RHEL 7 | Fixed | RHSA-2020:5249 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:4670, RHSA-2020:4847 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2020:3936 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2020:3936 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2020:3936 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2020:3936 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:3936 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:3936 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2023:0552 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2023:0553 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2023:0554 |
| Red Hat JBoss Enterprise Application Platform 7.4.9 | Fixed | RHSA-2023:0556 |
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2020:2217 |
| Red Hat OpenShift Container Platform 4.5 | Fixed | RHSA-2020:2412 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | RHSA-2020:4298 |
| Red Hat OpenShift Service Mesh 1.0 | Fixed | RHSA-2020:2362 |
| Red Hat Single Sign-On 7 | Fixed | RHSA-2023:1049 |
| Red Hat Single Sign-On 7.4.1 | Fixed | RHSA-2020:2813 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2023:1043 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2023:1044 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2023:1045 |
Not affected: 16 products
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 9
- Red Hat JBoss Enterprise Application Platform 7.4.9
- Red Hat OpenShift Container Platform 4.5
- Red Hat OpenShift Container Platform 4.6
- Red Hat OpenStack Platform 10 (Newton)
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 15 (Stein)
- Red Hat OpenStack Platform 16 (Train)
- Red Hat Quay 3
- Red Hat Satellite 6
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2020-11022
- 2026-10-03 Alias added: GHSA-gxr4-xjj5-5px2
- 2026-10-21 Affected versions changed · Red Hat
- 2026-11-02 CISA SSVC decision points changed
References
Patch 6
- https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
Advisory 16
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
- https://security.gentoo.org/glsa/202007-03
- https://www.debian.org/security/2020/dsa-4693
- https://www.drupal.org/sa-core-2020-002
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.tenable.com/security/tns-2020-10
- https://www.tenable.com/security/tns-2020-11
- https://www.tenable.com/security/tns-2021-02
- https://www.tenable.com/security/tns-2021-10
- https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-11022
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
- https://jquery.com/upgrade-guide/3.5/
- https://security.netapp.com/advisory/ntap-20200511-0006/
Other 32
- https://github.com/maximebf/php-debugbar/issues/447
- https://github.com/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fc
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W
- https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html
- https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html
- https://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html
- https://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html
- https://www.oracle.com/security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released
- https://github.com/jquery/jquery/releases/tag/3.5.0
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-11022.yml
- https://jquery.com/upgrade-guide/3.5
- https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67@%3Cdev.flink.apache.org%3E
- https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133@%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2@%3Cissues.flink.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B
- http://security.netapp.com/advisory/ntap-20200511-0006
- https://github.com/Athlon1600/youtube-downloader/releases/tag/v4.0.1
- https://github.com/jquery/jquery
More Jquery vulnerabilities
- TI-2020-08897 Potential XSS vulnerability in jQuery KEVCVSS 3.1MEDIUM 6.9
- TI-2019-08480 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles… CVSS 3.1MEDIUM 6.1
- TI-2015-07630 jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a… CVSS 3.0MEDIUM 6.1
- TI-2016-08748 jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that… CVSS 3.1HIGH 7.5
- TI-2012-05410 jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. CVSS 3.0MEDIUM 6.1
- TI-2011-04277 Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2020-11022 · CVE Program
- CVE-2020-11022 · NVD
- FIRST EPSS
- GHSA-gxr4-xjj5-5px2 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-11022 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences