Search for packages
| purl | pkg:rpm/redhat/ipa@4.6.8-5?arch=el7 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3s9f-prpy-hbcx
Aliases: CVE-2019-11358 GHSA-6c3j-c64m-qhgq |
Cross-site Scripting The jQuery library, which is included in rdoc, mishandles `jQuery.extend(true, {}, ...)` because of Object.prototype pollution. If an unsanitized source object contained an enumerable `__proto__` property, it could extend the native `Object.prototype.` | There are no reported fixed by versions. |
|
VCID-5618-53yg-8qh4
Aliases: CVE-2020-11022 GHSA-gxr4-xjj5-5px2 |
Potential XSS vulnerability in jQuery ### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround the issue without upgrading, adding the following to your code: ```js jQuery.htmlPrefilter = function( html ) { return html; }; ``` You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue. | There are no reported fixed by versions. |
|
VCID-br4c-7x9j-g3f6
Aliases: CVE-2018-20676 GHSA-3mgp-fx93-9xv5 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In Bootstrap, XSS is possible in the tooltip data-viewport attribute. | There are no reported fixed by versions. |
|
VCID-eh2s-9hss-yken
Aliases: CVE-2016-10735 GHSA-4p24-vmcr-4gqj |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In Bootstrap, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041. | There are no reported fixed by versions. |
|
VCID-hbwg-ebvx-k7e1
Aliases: CVE-2018-14040 GHSA-3wqf-4x89-9g79 |
Cross-site Scripting In Bootstrap, XSS is possible in the collapse data-parent attribute. | There are no reported fixed by versions. |
|
VCID-hqne-7h6h-3ff8
Aliases: CVE-2018-20677 GHSA-ph58-4vrj-w6hr |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In Bootstrap, XSS is possible in the affix configuration target property. | There are no reported fixed by versions. |
|
VCID-p87t-vvdx-b7dv
Aliases: CVE-2019-8331 GHSA-9v3m-8fp8-mj99 GHSA-fxwm-579q-49qq GHSA-wh77-3x4m-4q9g |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In Bootstrap, XSS is possible in the tooltip or popover data-template attribute. | There are no reported fixed by versions. |
|
VCID-tmjp-8edk-nyh3
Aliases: CVE-2015-9251 GHSA-rmxg-73gg-4p98 |
The jQuery library, which is included in rdoc, is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing `text/javascript` responses to be executed. | There are no reported fixed by versions. |
|
VCID-vfsr-kypp-wbea
Aliases: CVE-2018-14042 GHSA-7mvr-5x2g-wfc8 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In Bootstrap, XSS is possible in the data-container property of tooltip. | There are no reported fixed by versions. |
|
VCID-y7w8-wfsa-kub1
Aliases: CVE-2020-1722 |
ipa: No password length restriction leads to denial of service | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||