Package Instance

Improper Encoding or Escaping of Output
PHPMailer contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.

Potential XSS vulnerability in jQuery
### Impact
Passing HTML from untrusted sources - even after sanitizing it - to
one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`,
and others) may execute untrusted code.

### Patches
This problem is patched in jQuery 3.5.0.

### Workarounds
To workaround the issue without upgrading, adding the following to
your code:
```js
jQuery.htmlPrefilter = function( html ) {
  return html;
};
```
You need to use at least jQuery 1.12/2.2 or newer to be able to
apply this workaround.

### References
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://jquery.com/upgrade-guide/3.5/

### For more information
If you have any questions or comments about this advisory, search
for a relevant issue in
[the jQuery repo](https://github.com/jquery/jquery/issues).

If you don't find an answer, open a new issue."

Potential XSS vulnerability in jQuery
## Impact

Passing HTML containing `<option>` elements from untrusted sources - even after
sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`,
`.append()`, and others) may execute untrusted code.

## Workarounds

To workaround this issue without upgrading, use DOMPurify with its
`SAFE_FOR_JQUERY` option to sanitize the HTML string before passing it to a
jQuery method.