Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:rpm/redhat/ovirt-engine-ui-extensions@1.2.2-1?arch=el8ev
purl pkg:rpm/redhat/ovirt-engine-ui-extensions@1.2.2-1?arch=el8ev
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 10.0
Vulnerabilities affecting this package (3)
Vulnerability Summary Fixed by
VCID-5618-53yg-8qh4
Aliases:
CVE-2020-11022
GHSA-gxr4-xjj5-5px2
Potential XSS vulnerability in jQuery ### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround the issue without upgrading, adding the following to your code: ```js jQuery.htmlPrefilter = function( html ) { return html; }; ``` You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue. There are no reported fixed by versions.
VCID-bhnm-47u8-zfhr
Aliases:
CVE-2020-7598
GHSA-vh95-rmgr-6w4m
Prototype Pollution in minimist Affected versions of `minimist` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument `--__proto__.y=Polluted` adds a `y` property with value `Polluted` to all objects. The argument `--__proto__=Polluted` raises and uncaught error and crashes the application. This is exploitable if attackers have control over the arguments being passed to `minimist`. ## Recommendation Upgrade to versions 0.2.1, 1.2.3 or later. There are no reported fixed by versions.
VCID-cvxp-ctj9-guej
Aliases:
CVE-2020-11023
GHSA-jpcq-cgw6-v4j6
Potential XSS vulnerability in jQuery ### Impact Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround this issue without upgrading, use [DOMPurify](https://github.com/cure53/DOMPurify) with its `SAFE_FOR_JQUERY` option to sanitize the HTML string before passing it to a jQuery method. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue. There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T14:10:06.041974+00:00 RedHat Importer Affected by VCID-bhnm-47u8-zfhr https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-7598.json 38.0.0
2026-04-01T14:08:45.986360+00:00 RedHat Importer Affected by VCID-5618-53yg-8qh4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-11022.json 38.0.0
2026-04-01T14:08:33.773964+00:00 RedHat Importer Affected by VCID-cvxp-ctj9-guej https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-11023.json 38.0.0