Search for packages
| purl | pkg:rpm/redhat/jaeger@1.13.1.redhat7-1?arch=el7 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-5618-53yg-8qh4
Aliases: CVE-2020-11022 GHSA-gxr4-xjj5-5px2 |
Potential XSS vulnerability in jQuery ### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround the issue without upgrading, adding the following to your code: ```js jQuery.htmlPrefilter = function( html ) { return html; }; ``` You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue. | There are no reported fixed by versions. |
|
VCID-amqf-ytjf-fydp
Aliases: CVE-2020-12459 GHSA-m25m-5778-fm22 |
Grafana world readable configuration files In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files `/etc/grafana/grafana.ini` and `/etc/grafana/ldap.toml` (which contain a secret_key and a bind_password) are world readable. | There are no reported fixed by versions. |
|
VCID-bhnm-47u8-zfhr
Aliases: CVE-2020-7598 GHSA-vh95-rmgr-6w4m |
Prototype Pollution in minimist Affected versions of `minimist` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument `--__proto__.y=Polluted` adds a `y` property with value `Polluted` to all objects. The argument `--__proto__=Polluted` raises and uncaught error and crashes the application. This is exploitable if attackers have control over the arguments being passed to `minimist`. ## Recommendation Upgrade to versions 0.2.1, 1.2.3 or later. | There are no reported fixed by versions. |
|
VCID-dzeb-zu9x-g3bq
Aliases: CVE-2019-10744 GHSA-jf85-cpcp-j695 |
Prototype Pollution in lodash Versions of `lodash` before 4.17.12 are vulnerable to Prototype Pollution. The function `defaultsDeep` allows a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T14:17:59.825230+00:00 | RedHat Importer | Affected by | VCID-dzeb-zu9x-g3bq | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-10744.json | 38.0.0 |
| 2026-04-01T14:10:05.895564+00:00 | RedHat Importer | Affected by | VCID-bhnm-47u8-zfhr | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-7598.json | 38.0.0 |
| 2026-04-01T14:08:45.825625+00:00 | RedHat Importer | Affected by | VCID-5618-53yg-8qh4 | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-11022.json | 38.0.0 |
| 2026-04-01T14:08:39.697701+00:00 | RedHat Importer | Affected by | VCID-amqf-ytjf-fydp | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-12459.json | 38.0.0 |