smitpi / psconfigfile

Creates a Config file with Variables, PSDrives, Credentials, Shortcuts(Functions), PSDefaultParameters and a Starting location. You can then execute this config when your profile is loaded, or you can run it manually at any time. And all of the variables, psdrives credentials ext. are then available in your session. This way you can quickly and easily switch between "environment setups"

Hi, I'm Pierre Smit

A passionate PowerShell scripter and anything automation.

• I’m currently learning Anything DevOps
• Ask me about anything Citrix or PowerShell

Connect with me:

 

psconfigfile's Issues

bootstrap-3.3.7.min.js: 5 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - bootstrap-3.3.7.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js

Path to dependency file: /docs/site/Remove-ConfigFromPSConfigFile/index.html

Path to vulnerable library: /docs/site/Remove-ConfigFromPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-CredentialToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-PSDefaultParameterToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/./js/bootstrap-3.3.7.min.js,/docs/site/Add-LocationToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-PSDriveToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Set-PSConfigFileExecution/../js/bootstrap-3.3.7.min.js,/docs/site/Show-PSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-FunctionToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Export-PSConfigFilePFX/../js/bootstrap-3.3.7.min.js,/docs/site/Update-CredentialsInPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-VariableToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-CommandToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Import-PSConfigFilePFX/../js/bootstrap-3.3.7.min.js,/docs/site/js/bootstrap-3.3.7.min.js,/docs/site/New-PSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Invoke-PSConfigFile/../js/bootstrap-3.3.7.min.js

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (bootstrap version)	Remediation Possible**
CVE-2019-8331	Medium	6.1	bootstrap-3.3.7.min.js	Direct	bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1	❌
CVE-2018-20677	Medium	6.1	bootstrap-3.3.7.min.js	Direct	Bootstrap - v3.4.0;NorDroN.AngularTemplate - 0.1.6;Dynamic.NET.Express.ProjectTemplates - 0.8.0;dotnetng.template - 1.0.0.4;ZNxtApp.Core.Module.Theme - 1.0.9-Beta;JMeter - 5.0.0	❌
CVE-2018-20676	Medium	6.1	bootstrap-3.3.7.min.js	Direct	bootstrap - 3.4.0	❌
CVE-2018-14042	Medium	6.1	bootstrap-3.3.7.min.js	Direct	org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:3.4.0	❌
CVE-2016-10735	Medium	6.1	bootstrap-3.3.7.min.js	Direct	bootstrap - 3.4.0, 4.0.0-beta.2	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-8331

Vulnerable Library - bootstrap-3.3.7.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js

Path to dependency file: /docs/site/Remove-ConfigFromPSConfigFile/index.html

Path to vulnerable library: /docs/site/Remove-ConfigFromPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-CredentialToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-PSDefaultParameterToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/./js/bootstrap-3.3.7.min.js,/docs/site/Add-LocationToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-PSDriveToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Set-PSConfigFileExecution/../js/bootstrap-3.3.7.min.js,/docs/site/Show-PSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-FunctionToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Export-PSConfigFilePFX/../js/bootstrap-3.3.7.min.js,/docs/site/Update-CredentialsInPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-VariableToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-CommandToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Import-PSConfigFilePFX/../js/bootstrap-3.3.7.min.js,/docs/site/js/bootstrap-3.3.7.min.js,/docs/site/New-PSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Invoke-PSConfigFile/../js/bootstrap-3.3.7.min.js

Dependency Hierarchy:

• ❌ bootstrap-3.3.7.min.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Publish Date: 2019-02-20

URL: CVE-2019-8331

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-02-20

Fix Resolution: bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1

Step up your Open Source Security Game with Mend here

CVE-2018-20677

Vulnerable Library - bootstrap-3.3.7.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js

Path to dependency file: /docs/site/Remove-ConfigFromPSConfigFile/index.html

Path to vulnerable library: /docs/site/Remove-ConfigFromPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-CredentialToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-PSDefaultParameterToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/./js/bootstrap-3.3.7.min.js,/docs/site/Add-LocationToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-PSDriveToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Set-PSConfigFileExecution/../js/bootstrap-3.3.7.min.js,/docs/site/Show-PSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-FunctionToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Export-PSConfigFilePFX/../js/bootstrap-3.3.7.min.js,/docs/site/Update-CredentialsInPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-VariableToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-CommandToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Import-PSConfigFilePFX/../js/bootstrap-3.3.7.min.js,/docs/site/js/bootstrap-3.3.7.min.js,/docs/site/New-PSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Invoke-PSConfigFile/../js/bootstrap-3.3.7.min.js

Dependency Hierarchy:

• ❌ bootstrap-3.3.7.min.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

Publish Date: 2019-01-09

URL: CVE-2018-20677

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20677

Release Date: 2019-01-09

Fix Resolution: Bootstrap - v3.4.0;NorDroN.AngularTemplate - 0.1.6;Dynamic.NET.Express.ProjectTemplates - 0.8.0;dotnetng.template - 1.0.0.4;ZNxtApp.Core.Module.Theme - 1.0.9-Beta;JMeter - 5.0.0

Step up your Open Source Security Game with Mend here

CVE-2018-20676

Vulnerable Library - bootstrap-3.3.7.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js

Path to dependency file: /docs/site/Remove-ConfigFromPSConfigFile/index.html

Path to vulnerable library: /docs/site/Remove-ConfigFromPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-CredentialToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-PSDefaultParameterToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/./js/bootstrap-3.3.7.min.js,/docs/site/Add-LocationToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-PSDriveToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Set-PSConfigFileExecution/../js/bootstrap-3.3.7.min.js,/docs/site/Show-PSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-FunctionToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Export-PSConfigFilePFX/../js/bootstrap-3.3.7.min.js,/docs/site/Update-CredentialsInPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-VariableToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-CommandToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Import-PSConfigFilePFX/../js/bootstrap-3.3.7.min.js,/docs/site/js/bootstrap-3.3.7.min.js,/docs/site/New-PSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Invoke-PSConfigFile/../js/bootstrap-3.3.7.min.js

Dependency Hierarchy:

• ❌ bootstrap-3.3.7.min.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

Publish Date: 2019-01-09

URL: CVE-2018-20676

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20676

Release Date: 2019-01-09

Fix Resolution: bootstrap - 3.4.0

Step up your Open Source Security Game with Mend here

CVE-2018-14042

Vulnerable Library - bootstrap-3.3.7.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js

Path to dependency file: /docs/site/Remove-ConfigFromPSConfigFile/index.html

Path to vulnerable library: /docs/site/Remove-ConfigFromPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-CredentialToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-PSDefaultParameterToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/./js/bootstrap-3.3.7.min.js,/docs/site/Add-LocationToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-PSDriveToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Set-PSConfigFileExecution/../js/bootstrap-3.3.7.min.js,/docs/site/Show-PSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-FunctionToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Export-PSConfigFilePFX/../js/bootstrap-3.3.7.min.js,/docs/site/Update-CredentialsInPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-VariableToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-CommandToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Import-PSConfigFilePFX/../js/bootstrap-3.3.7.min.js,/docs/site/js/bootstrap-3.3.7.min.js,/docs/site/New-PSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Invoke-PSConfigFile/../js/bootstrap-3.3.7.min.js

Dependency Hierarchy:

• ❌ bootstrap-3.3.7.min.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

Publish Date: 2018-07-13

URL: CVE-2018-14042

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:3.4.0

Step up your Open Source Security Game with Mend here

CVE-2016-10735

Vulnerable Library - bootstrap-3.3.7.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js

Path to dependency file: /docs/site/Remove-ConfigFromPSConfigFile/index.html

Path to vulnerable library: /docs/site/Remove-ConfigFromPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-CredentialToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-PSDefaultParameterToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/./js/bootstrap-3.3.7.min.js,/docs/site/Add-LocationToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-PSDriveToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Set-PSConfigFileExecution/../js/bootstrap-3.3.7.min.js,/docs/site/Show-PSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-FunctionToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Export-PSConfigFilePFX/../js/bootstrap-3.3.7.min.js,/docs/site/Update-CredentialsInPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-VariableToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Add-CommandToPSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Import-PSConfigFilePFX/../js/bootstrap-3.3.7.min.js,/docs/site/js/bootstrap-3.3.7.min.js,/docs/site/New-PSConfigFile/../js/bootstrap-3.3.7.min.js,/docs/site/Invoke-PSConfigFile/../js/bootstrap-3.3.7.min.js

Dependency Hierarchy:

• ❌ bootstrap-3.3.7.min.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

Publish Date: 2019-01-09

URL: CVE-2016-10735

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10735

Release Date: 2019-01-09

Fix Resolution: bootstrap - 3.4.0, 4.0.0-beta.2

Step up your Open Source Security Game with Mend here

bootstrap-3.3.7.js: 5 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - bootstrap-3.3.7.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.js

Path to vulnerable library: /docs/site/js/bootstrap-3.3.7.js

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (bootstrap version)	Remediation Possible**
CVE-2019-8331	Medium	6.1	bootstrap-3.3.7.js	Direct	bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1	❌
CVE-2018-20677	Medium	6.1	bootstrap-3.3.7.js	Direct	Bootstrap - v3.4.0;NorDroN.AngularTemplate - 0.1.6;Dynamic.NET.Express.ProjectTemplates - 0.8.0;dotnetng.template - 1.0.0.4;ZNxtApp.Core.Module.Theme - 1.0.9-Beta;JMeter - 5.0.0	❌
CVE-2018-20676	Medium	6.1	bootstrap-3.3.7.js	Direct	bootstrap - 3.4.0	❌
CVE-2018-14042	Medium	6.1	bootstrap-3.3.7.js	Direct	org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:3.4.0	❌
CVE-2016-10735	Medium	6.1	bootstrap-3.3.7.js	Direct	bootstrap - 3.4.0, 4.0.0-beta.2	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-8331

Vulnerable Library - bootstrap-3.3.7.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.js

Path to vulnerable library: /docs/site/js/bootstrap-3.3.7.js

Dependency Hierarchy:

• ❌ bootstrap-3.3.7.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Publish Date: 2019-02-20

URL: CVE-2019-8331

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-02-20

Fix Resolution: bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1

Step up your Open Source Security Game with Mend here

CVE-2018-20677

Vulnerable Library - bootstrap-3.3.7.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.js

Path to vulnerable library: /docs/site/js/bootstrap-3.3.7.js

Dependency Hierarchy:

• ❌ bootstrap-3.3.7.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

Publish Date: 2019-01-09

URL: CVE-2018-20677

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20677

Release Date: 2019-01-09

Fix Resolution: Bootstrap - v3.4.0;NorDroN.AngularTemplate - 0.1.6;Dynamic.NET.Express.ProjectTemplates - 0.8.0;dotnetng.template - 1.0.0.4;ZNxtApp.Core.Module.Theme - 1.0.9-Beta;JMeter - 5.0.0

Step up your Open Source Security Game with Mend here

CVE-2018-20676

Vulnerable Library - bootstrap-3.3.7.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.js

Path to vulnerable library: /docs/site/js/bootstrap-3.3.7.js

Dependency Hierarchy:

• ❌ bootstrap-3.3.7.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

Publish Date: 2019-01-09

URL: CVE-2018-20676

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20676

Release Date: 2019-01-09

Fix Resolution: bootstrap - 3.4.0

Step up your Open Source Security Game with Mend here

CVE-2018-14042

Vulnerable Library - bootstrap-3.3.7.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.js

Path to vulnerable library: /docs/site/js/bootstrap-3.3.7.js

Dependency Hierarchy:

• ❌ bootstrap-3.3.7.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

Publish Date: 2018-07-13

URL: CVE-2018-14042

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:3.4.0

Step up your Open Source Security Game with Mend here

CVE-2016-10735

Vulnerable Library - bootstrap-3.3.7.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.js

Path to vulnerable library: /docs/site/js/bootstrap-3.3.7.js

Dependency Hierarchy:

• ❌ bootstrap-3.3.7.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

Publish Date: 2019-01-09

URL: CVE-2016-10735

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10735

Release Date: 2019-01-09

Fix Resolution: bootstrap - 3.4.0, 4.0.0-beta.2

Step up your Open Source Security Game with Mend here

jquery-3.2.1.js: 4 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - jquery-3.2.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.js

Path to vulnerable library: /docs/site/js/jquery-3.2.1.js

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (jquery version)	Remediation Possible**
CVE-2020-23064	Medium	6.1	jquery-3.2.1.js	Direct	jquery - 3.5.0	❌
CVE-2020-11023	Medium	6.1	jquery-3.2.1.js	Direct	jquery - 3.5.0;jquery-rails - 4.4.0	❌
CVE-2020-11022	Medium	6.1	jquery-3.2.1.js	Direct	jQuery - 3.5.0	❌
CVE-2019-11358	Medium	6.1	jquery-3.2.1.js	Direct	jquery - 3.4.0	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-23064

Vulnerable Library - jquery-3.2.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.js

Path to vulnerable library: /docs/site/js/jquery-3.2.1.js

Dependency Hierarchy:

• ❌ jquery-3.2.1.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

Cross Site Scripting vulnerability in jQuery 2.2.0 through 3.x before 3.5.0 allows a remote attacker to execute arbitrary code via the element.

Publish Date: 2023-06-26

URL: CVE-2020-23064

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2023-06-26

Fix Resolution: jquery - 3.5.0

Step up your Open Source Security Game with Mend here

CVE-2020-11023

Vulnerable Library - jquery-3.2.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.js

Path to vulnerable library: /docs/site/js/jquery-3.2.1.js

Dependency Hierarchy:

• ❌ jquery-3.2.1.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0

Step up your Open Source Security Game with Mend here

CVE-2020-11022

Vulnerable Library - jquery-3.2.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.js

Path to vulnerable library: /docs/site/js/jquery-3.2.1.js

Dependency Hierarchy:

• ❌ jquery-3.2.1.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

Step up your Open Source Security Game with Mend here

CVE-2019-11358

Vulnerable Library - jquery-3.2.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.js

Path to vulnerable library: /docs/site/js/jquery-3.2.1.js

Dependency Hierarchy:

• ❌ jquery-3.2.1.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: jquery - 3.4.0

Step up your Open Source Security Game with Mend here

jquery-3.2.1.min.js: 4 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - jquery-3.2.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Path to dependency file: /docs/site/New-PSConfigFile/index.html

Path to vulnerable library: /docs/site/New-PSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-LocationToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-PSDefaultParameterToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-PSDriveToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Export-PSConfigFilePFX/../js/jquery-3.2.1.min.js,/docs/site/Add-FunctionToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-VariableToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Import-PSConfigFilePFX/../js/jquery-3.2.1.min.js,/docs/site/js/jquery-3.2.1.min.js,/docs/site/Update-CredentialsInPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Invoke-PSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-CommandToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Show-PSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Set-PSConfigFileExecution/../js/jquery-3.2.1.min.js,/docs/site/./js/jquery-3.2.1.min.js,/docs/site/Remove-ConfigFromPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-CredentialToPSConfigFile/../js/jquery-3.2.1.min.js

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (jquery version)	Remediation Possible**
CVE-2020-23064	Medium	6.1	jquery-3.2.1.min.js	Direct	jquery - 3.5.0	❌
CVE-2020-11023	Medium	6.1	jquery-3.2.1.min.js	Direct	jquery - 3.5.0;jquery-rails - 4.4.0	❌
CVE-2020-11022	Medium	6.1	jquery-3.2.1.min.js	Direct	jQuery - 3.5.0	❌
CVE-2019-11358	Medium	6.1	jquery-3.2.1.min.js	Direct	jquery - 3.4.0	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-23064

Vulnerable Library - jquery-3.2.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Path to dependency file: /docs/site/New-PSConfigFile/index.html

Path to vulnerable library: /docs/site/New-PSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-LocationToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-PSDefaultParameterToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-PSDriveToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Export-PSConfigFilePFX/../js/jquery-3.2.1.min.js,/docs/site/Add-FunctionToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-VariableToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Import-PSConfigFilePFX/../js/jquery-3.2.1.min.js,/docs/site/js/jquery-3.2.1.min.js,/docs/site/Update-CredentialsInPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Invoke-PSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-CommandToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Show-PSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Set-PSConfigFileExecution/../js/jquery-3.2.1.min.js,/docs/site/./js/jquery-3.2.1.min.js,/docs/site/Remove-ConfigFromPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-CredentialToPSConfigFile/../js/jquery-3.2.1.min.js

Dependency Hierarchy:

• ❌ jquery-3.2.1.min.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

Cross Site Scripting vulnerability in jQuery 2.2.0 through 3.x before 3.5.0 allows a remote attacker to execute arbitrary code via the element.

Publish Date: 2023-06-26

URL: CVE-2020-23064

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2023-06-26

Fix Resolution: jquery - 3.5.0

Step up your Open Source Security Game with Mend here

CVE-2020-11023

Vulnerable Library - jquery-3.2.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Path to dependency file: /docs/site/New-PSConfigFile/index.html

Path to vulnerable library: /docs/site/New-PSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-LocationToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-PSDefaultParameterToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-PSDriveToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Export-PSConfigFilePFX/../js/jquery-3.2.1.min.js,/docs/site/Add-FunctionToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-VariableToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Import-PSConfigFilePFX/../js/jquery-3.2.1.min.js,/docs/site/js/jquery-3.2.1.min.js,/docs/site/Update-CredentialsInPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Invoke-PSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-CommandToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Show-PSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Set-PSConfigFileExecution/../js/jquery-3.2.1.min.js,/docs/site/./js/jquery-3.2.1.min.js,/docs/site/Remove-ConfigFromPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-CredentialToPSConfigFile/../js/jquery-3.2.1.min.js

Dependency Hierarchy:

• ❌ jquery-3.2.1.min.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0

Step up your Open Source Security Game with Mend here

CVE-2020-11022

Vulnerable Library - jquery-3.2.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Path to dependency file: /docs/site/New-PSConfigFile/index.html

Path to vulnerable library: /docs/site/New-PSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-LocationToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-PSDefaultParameterToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-PSDriveToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Export-PSConfigFilePFX/../js/jquery-3.2.1.min.js,/docs/site/Add-FunctionToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-VariableToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Import-PSConfigFilePFX/../js/jquery-3.2.1.min.js,/docs/site/js/jquery-3.2.1.min.js,/docs/site/Update-CredentialsInPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Invoke-PSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-CommandToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Show-PSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Set-PSConfigFileExecution/../js/jquery-3.2.1.min.js,/docs/site/./js/jquery-3.2.1.min.js,/docs/site/Remove-ConfigFromPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-CredentialToPSConfigFile/../js/jquery-3.2.1.min.js

Dependency Hierarchy:

• ❌ jquery-3.2.1.min.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

Step up your Open Source Security Game with Mend here

CVE-2019-11358

Vulnerable Library - jquery-3.2.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Path to dependency file: /docs/site/New-PSConfigFile/index.html

Path to vulnerable library: /docs/site/New-PSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-LocationToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-PSDefaultParameterToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-PSDriveToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Export-PSConfigFilePFX/../js/jquery-3.2.1.min.js,/docs/site/Add-FunctionToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-VariableToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Import-PSConfigFilePFX/../js/jquery-3.2.1.min.js,/docs/site/js/jquery-3.2.1.min.js,/docs/site/Update-CredentialsInPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Invoke-PSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-CommandToPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Show-PSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Set-PSConfigFileExecution/../js/jquery-3.2.1.min.js,/docs/site/./js/jquery-3.2.1.min.js,/docs/site/Remove-ConfigFromPSConfigFile/../js/jquery-3.2.1.min.js,/docs/site/Add-CredentialToPSConfigFile/../js/jquery-3.2.1.min.js

Dependency Hierarchy:

• ❌ jquery-3.2.1.min.js (Vulnerable Library)

Found in HEAD commit: df5eee361322a43b3eb9023f603741629861c6c2

Found in base branch: master

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: jquery - 3.4.0

Step up your Open Source Security Game with Mend here