VulnerableCode Package Details - pkg:deb/debian/twitter-bootstrap3@3.4.1%2Bdfsg-2

Search for packages

Vulnerability	Summary	Fixed by
VCID-87kn-rfhf-nbat Aliases: CVE-2024-6485 GHSA-vxmc-5x29-h64v	Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.	3.4.1+dfsg-3+deb12u1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-d4k9-se4n-4fh9 Aliases: CVE-2024-6484 GHSA-9mvj-f7w8-pvh2	Bootstrap Cross-Site Scripting (XSS) vulnerability A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the `data-slide` and `data-slide-to` attributes can be exploited through the href attribute of an `<a>` tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.	3.4.1+dfsg-3+deb12u1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-ys7x-k42v-s7f9 Aliases: CVE-2025-1647	bootstrap: Bootstrap XSS Vulnerability	3.4.1+dfsg-3+deb12u1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 3.4.1+dfsg-6 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-87kn-rfhf-nbat
Aliases:
CVE-2024-6485
GHSA-vxmc-5x29-h64v

Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.

3.4.1+dfsg-3+deb12u1
Affected by 1 other vulnerability.

VCID-d4k9-se4n-4fh9
Aliases:
CVE-2024-6484
GHSA-9mvj-f7w8-pvh2

Bootstrap Cross-Site Scripting (XSS) vulnerability A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the `data-slide` and `data-slide-to` attributes can be exploited through the href attribute of an `<a>` tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.

3.4.1+dfsg-3+deb12u1
Affected by 1 other vulnerability.

VCID-ys7x-k42v-s7f9
Aliases:
CVE-2025-1647

bootstrap: Bootstrap XSS Vulnerability

3.4.1+dfsg-3+deb12u1
Affected by 1 other vulnerability.

3.4.1+dfsg-6
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-04T06:37:07.796503+00:00	Debian Oval Importer	Affected by	VCID-d4k9-se4n-4fh9	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-07-02T02:50:56.924482+00:00	Debian Oval Importer	Affected by	VCID-87kn-rfhf-nbat	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	36.1.3
2025-07-02T00:43:36.003002+00:00	Debian Oval Importer	Affected by	VCID-ys7x-k42v-s7f9	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	36.1.3
2025-07-01T22:09:27.168380+00:00	Debian Oval Importer	Affected by	VCID-d4k9-se4n-4fh9	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	36.1.3