Orta CVSS 6.1 PoC var

CVE-2020-11022: Jquery: siteler arası betik çalıştırma (XSS)

Yayın: 30 Nisan 2020 01:15 · Güncelleme: 6 Kasım 2026 09:46

Açıklama (NVD)

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Özet bilgiler

Ürün: Jquery Jquery
CVSS v3.1: 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: %99,22 (yüzdelik 100)
CWE: CWE-79
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
jquery-jquery	1.2	—	3.5.0
drupal-drupal	7.0	—	7.70
drupal-drupal	8.7.0	—	8.7.14
drupal-drupal	8.8.0	—	8.8.6
debian-debian-linux	9.0	9.0	—
fedoraproject-fedora	31	31	—
fedoraproject-fedora	32	32	—
fedoraproject-fedora	33	33	—
oracle-agile-product-lifecycle-management-for-process	6.2.0.0	6.2.0.0	—
oracle-application-testing-suite	13.3.0.1	13.3.0.1	—
oracle-banking-digital-experience	18.1	18.1	—
oracle-banking-digital-experience	18.2	18.2	—
oracle-banking-digital-experience	18.3	18.3	—
oracle-banking-digital-experience	19.1	19.1	—
oracle-banking-digital-experience	19.2	19.2	—
oracle-banking-digital-experience	20.1	20.1	—
oracle-blockchain-platform	—	—	21.1.2
oracle-communications-application-session-controller	3.8m0	3.8m0	—
oracle-communications-billing-and-revenue-management	7.5.0.23.0	7.5.0.23.0	—
oracle-communications-billing-and-revenue-management	12.0.0.3.0	12.0.0.3.0	—
oracle-communications-diameter-signaling-router-idih	8.0.0	8.2.2	—
oracle-communications-eagle-application-processor	16.1.0	16.4.0	—
oracle-communications-services-gatekeeper	7.0	7.0	—
oracle-communications-webrtc-session-controller	7.2	7.2	—
oracle-enterprise-manager-ops-center	12.4.0.0	12.4.0.0	—
oracle-enterprise-session-border-controller	8.4	8.4	—
oracle-financial-services-analytical-applications-infrastructure	8.0.6.0.0	8.1.0.0.0	—
oracle-financial-services-analytical-applications-reconciliation-framework	8.0.6	8.0.8	—
oracle-financial-services-analytical-applications-reconciliation-framework	8.1.0	8.1.0	—
oracle-financial-services-asset-liability-management	8.0.6	8.0.6	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları