CVE-2012-6708 log
Source |
|
Severity | Medium |
Remote | Yes |
Type | Cross-site scripting |
Description | jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common. |
Group | Package | Affected | Fixed | Severity | Status | Ticket |
---|---|---|---|---|---|---|
AVG-1041 | ruby-rdoc | 6.1.1-1 | 6.1.2-1 | Medium | Fixed | FS#63978 |
AVG-1040 | ruby2.5 | 2.5.6-1 | 2.5.7-1 | Medium | Fixed | FS#63977 |
Date | Advisory | Group | Package | Severity | Type |
---|---|---|---|---|---|
02 Oct 2019 | ASA-201910-5 | AVG-1040 | ruby2.5 | Medium | multiple issues |
02 Oct 2019 | ASA-201910-4 | AVG-1041 | ruby-rdoc | Medium | cross-site scripting |
References |
---|
https://bugs.jquery.com/ticket/11290 https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d |