Financial Services Data Integration Hub CVEs and Security Vulnerabilities

CVE-2020-11022

jQuery has a potential XSS vulnerability

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVSS 3.1 · 6.9 Medium EPSS 99.2% KEV · Not listed

Vendors

Debian Drupal Fedoraproject and 6 more

Products

Debian Linux Drupal Fedora and 85 more

CVE-2020-17530

struts2: using forced OGNL evaluation on untrusted user input can lead to a RCE and security degradation

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

CVSS 3.1 · 9.8 Critical EPSS 96.3% KEV · Listed

Vendors

Apache Oracle

Products

Struts Business Intelligence Communications Diameter Intelligence Hub and 5 more

CVE-2019-11358

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

CVSS 3.1 · 6.1 Medium EPSS 86.8% KEV · Not listed

Vendors

Backdropcms Debian Drupal and 8 more

Products

Backdrop Debian Linux Drupal and 111 more

CVE-2019-0233

struts2: access permission override when performing a file upload leads to DoS

An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.

CVSS 3.1 · 7.5 High EPSS 66.1% KEV · Not listed

Vendors

Apache Oracle

Products

Struts Communications Policy Management Financial Services Data Integration Hub and 2 more

CVE-2019-0230

struts2: possible RCE due to forced double OGNL evaluation when evaluated on raw user input in tag attributes

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 96.9% KEV · Not listed

Vendors

Apache Oracle

Products

Struts Communications Policy Management Financial Services Data Integration Hub and 2 more

CVE-2015-9251

jquery: Cross-site scripting via cross-domain ajax requests

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

CVSS 3.0 · 6.1 Medium EPSS 29.7% KEV · Not listed

Vendors

Jquery Oracle Redhat

Products

Jquery Agile Product Lifecycle Management For Process Banking Platform and 48 more

Search vulnerabilities

jQuery has a potential XSS vulnerability

struts2: using forced OGNL evaluation on untrusted user input can lead to a RCE and security degradation

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

struts2: access permission override when performing a file upload leads to DoS

struts2: possible RCE due to forced double OGNL evaluation when evaluated on raw user input in tag attributes

jquery: Cross-site scripting via cross-domain ajax requests