VulnerableCode Package Details - pkg:rpm/redhat/eap7-hal-console@3.3.16-1.Final_redhat

Search for packages

Vulnerability	Summary	Fixed by
VCID-3gg5-1921-rbfs Aliases: CVE-2018-14041 GHSA-pj7m-g53m-7638	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In Bootstrap, XSS is possible in the data-target property of scrollspy.	There are no reported fixed by versions.
VCID-3s9f-prpy-hbcx Aliases: CVE-2019-11358 GHSA-6c3j-c64m-qhgq	Cross-site Scripting The jQuery library, which is included in rdoc, mishandles `jQuery.extend(true, {}, ...)` because of Object.prototype pollution. If an unsanitized source object contained an enumerable `__proto__` property, it could extend the native `Object.prototype.`	There are no reported fixed by versions.
VCID-5618-53yg-8qh4 Aliases: CVE-2020-11022 GHSA-gxr4-xjj5-5px2	Potential XSS vulnerability in jQuery ### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround the issue without upgrading, adding the following to your code: ```js jQuery.htmlPrefilter = function( html ) { return html; }; ``` You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.	There are no reported fixed by versions.
VCID-cjwf-nuwg-4yc2 Aliases: CVE-2017-18214 GHSA-446m-mv8f-q348	Uncontrolled Resource Consumption The moment module for `Node.js` is prone to a regular expression denial of service via a crafted date string.	There are no reported fixed by versions.
VCID-cvxp-ctj9-guej Aliases: CVE-2020-11023 GHSA-jpcq-cgw6-v4j6	Potential XSS vulnerability in jQuery ### Impact Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround this issue without upgrading, use [DOMPurify](https://github.com/cure53/DOMPurify) with its `SAFE_FOR_JQUERY` option to sanitize the HTML string before passing it to a jQuery method. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.	There are no reported fixed by versions.
VCID-eh2s-9hss-yken Aliases: CVE-2016-10735 GHSA-4p24-vmcr-4gqj	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In Bootstrap, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.	There are no reported fixed by versions.
VCID-hbwg-ebvx-k7e1 Aliases: CVE-2018-14040 GHSA-3wqf-4x89-9g79	Cross-site Scripting In Bootstrap, XSS is possible in the collapse data-parent attribute.	There are no reported fixed by versions.
VCID-p87t-vvdx-b7dv Aliases: CVE-2019-8331 GHSA-9v3m-8fp8-mj99 GHSA-fxwm-579q-49qq GHSA-wh77-3x4m-4q9g	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In Bootstrap, XSS is possible in the tooltip or popover data-template attribute.	There are no reported fixed by versions.
VCID-tmjp-8edk-nyh3 Aliases: CVE-2015-9251 GHSA-rmxg-73gg-4p98	The jQuery library, which is included in rdoc, is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing `text/javascript` responses to be executed.	There are no reported fixed by versions.
VCID-vfsr-kypp-wbea Aliases: CVE-2018-14042 GHSA-7mvr-5x2g-wfc8	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In Bootstrap, XSS is possible in the data-container property of tooltip.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-3gg5-1921-rbfs
Aliases:
CVE-2018-14041
GHSA-pj7m-g53m-7638

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In Bootstrap, XSS is possible in the data-target property of scrollspy.