Cross-Site Scripting in dojo
Versions of `dojo` prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the `_testCommon.js` and `runner.html` test files, allowing attackers to execute arbitrary JavaScript in the victim's browser. ## Recommendation Upgrade to version 1.4.2 or later.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2010-2273US | medium4.3 | Exploit | ||
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote atta… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://bugs.dojotoolkit.org/ticket/10773WEB
- http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisoryWEB
- http://secunia.com/advisories/38964WEB
- http://secunia.com/advisories/40007WEB
- http://www-01.ibm.com/support/docview.wss?uid=swg21431472WEB
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833WEB
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849WEB
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan