← Back

CVE-2019-10785

nvd nist
Published: Feb 13, 2020Modified: Jun 17, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: NVD

Description

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.

Affected (7)

Linuxfoundation
1 product
Dojox
Debian
1 product
Debian Linux
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Linuxfoundation
Dojox
From 1.11.0 to 1.11.9
Dojox
From 1.12.0 to 1.12.7
Dojox
From 1.13.0 to 1.13.6
Dojox
From 1.14.0 to 1.14.5
Dojox
From 1.15.0 to 1.15.2
Dojox
From 1.16.0 to 1.16.1
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 8.0

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (6)

Source: report@snyk.io
ExploitThird Party Advisory
Source: report@snyk.io
Mailing ListThird Party Advisory
Source: report@snyk.io
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.