CVE-2020-11022

Published: Apr 29, 2020Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Affected (121)

Products: Jquery: Jquery · Drupal: Drupal · Debian: Debian Linux · +5 more

Show all products

1 product

1 product

1 product

1 product

51 products

Agile Product Lifecycle Management For Process

Application Testing Suite

Banking Digital Experience

Blockchain Platform

Communications Eagle Application Processor

Communications Services Gatekeeper

Financial Services Analytical Applications Infrastructure

Hospitality Simphony

Insurance Data Foundation

Storagetek Acsls

Agile Product Supplier Collaboration For Process

Communications Application Session Controller

Communications Billing And Revenue Management

Communications Diameter Signaling Router Idih\

Communications Webrtc Session Controller

Enterprise Manager Ops Center

Enterprise Session Border Controller

Financial Services Analytical Applications Reconciliation Framework

Financial Services Asset Liability Management

Financial Services Balance Sheet Planning

Financial Services Basel Regulatory Capital Basic

Financial Services Basel Regulatory Capital Internal Ratings Based Approach

Financial Services Data Foundation

Financial Services Data Governance For Us Regulatory Reporting

Financial Services Data Integration Hub

Financial Services Funds Transfer Pricing

Financial Services Hedge Management And Ifrs Valuations

Financial Services Institutional Performance Analytics

Financial Services Liquidity Risk Management

Financial Services Liquidity Risk Measurement And Management

Financial Services Loan Loss Forecasting And Provisioning

Financial Services Market Risk Measurement And Management

Financial Services Price Creation And Discovery

Financial Services Profitability Management

Financial Services Regulatory Reporting For European Banking Authority

Financial Services Regulatory Reporting For Us Federal Reserve

Healthcare Foundation

Hospitality Materials Control

Insurance Accounting Analyzer

Insurance Allocation Manager For Enterprise Profitability

Insurance Insbridge Rating And Underwriting

Jdeveloper

Peoplesoft Enterprise Peopletools

Policy Automation

Policy Automation Connector For Siebel

Policy Automation For Mobile Devices

Retail Back Office

Retail Customer Management And Segmentation Foundation

Retail Returns Management

13 products

Oncommand System Manager

Snap Creator Framework

1 product

1 product

Log Correlation Engine

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jquery Jquery	From 1.2 to 3.5.0

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Drupal Drupal	From 7.0 to 7.70
Drupal Drupal	From 8.7.0 to 8.7.14
Drupal Drupal	From 8.8.0 to 8.8.6

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33

Configuration E

15 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Product Lifecycle Management For Process	Version 6.2.0.0
Oracle Application Testing Suite	Version 13.3.0.1
Oracle Banking Digital Experience	Version 18.1
Oracle Banking Digital Experience	Version 18.2
Oracle Banking Digital Experience	Version 18.3
Oracle Banking Digital Experience	Version 19.1
Oracle Banking Digital Experience	Version 19.2
Oracle Banking Digital Experience	Version 20.1
Oracle Blockchain Platform	Before 21.1.2
Oracle Communications Eagle Application Processor	From 16.1.0 to 16.4.0
Oracle Communications Services Gatekeeper	Version 7.0
Oracle Financial Services Analytical Applications Infrastructure	From 8.0.6.0.0 to 8.1.0.0.0
Oracle Hospitality Simphony	From 19.1.0 to 19.1.2
Oracle Insurance Data Foundation	From 8.0.6 to 8.1.0
Oracle Storagetek Acsls	Version 8.5.1

Configuration F

5 vulnerable

Vulnerable Software	Affected Versions
Netapp Max Data	All versions
Netapp Oncommand Insight	All versions
Netapp Oncommand System Manager	From 3.0 to 3.1.3
Netapp Snap Creator Framework	All versions
Netapp Snapcenter	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300s Firmware	All versions

Running on/with	Platform Versions
Netapp H300s	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500s Firmware	All versions

Running on/with	Platform Versions
Netapp H500s	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700s Firmware	All versions

Running on/with	Platform Versions
Netapp H700s	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300e Firmware	All versions

Running on/with	Platform Versions
Netapp H300e	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500e Firmware	All versions

Running on/with	Platform Versions
Netapp H500e	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700e Firmware	All versions

Running on/with	Platform Versions
Netapp H700e	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410s Firmware	All versions

Running on/with	Platform Versions
Netapp H410s	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410c Firmware	All versions

Running on/with	Platform Versions
Netapp H410c	All versions

Configuration O

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1
Opensuse Leap	Version 15.2

Configuration P

1 vulnerable

Vulnerable Software	Affected Versions
Tenable Log Correlation Engine	Before 6.0.9

Configuration Q

82 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Product Supplier Collaboration For Process	Version 6.2.0.0
Oracle Banking Digital Experience	From 18.1 to 20.1
Oracle Communications Application Session Controller	Version 3.8m0
Oracle Communications Billing And Revenue Management	Version 12.0.0.3.0
Oracle Communications Billing And Revenue Management	Version 7.5.0.23.0
Oracle Communications Diameter Signaling Router Idih\	From 8.0.0 to 8.2.2
Oracle Communications Webrtc Session Controller	Version 7.2
Oracle Enterprise Manager Ops Center	Version 12.4.0.0
Oracle Enterprise Session Border Controller	Version 8.4
Oracle Financial Services Analytical Applications Infrastructure	From 8.0.6 to 8.1.0
Oracle Financial Services Analytical Applications Reconciliation Framework	From 8.0.6 to 8.0.8
Oracle Financial Services Analytical Applications Reconciliation Framework	Version 8.1.0
Oracle Financial Services Asset Liability Management	Version 8.0.6
Oracle Financial Services Asset Liability Management	Version 8.0.7
Oracle Financial Services Asset Liability Management	Version 8.1.0
Oracle Financial Services Balance Sheet Planning	Version 8.0.8
Oracle Financial Services Basel Regulatory Capital Basic	From 8.0.6 to 8.0.8
Oracle Financial Services Basel Regulatory Capital Basic	Version 8.1.0
Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach	From 8.0.6 to 8.0.8
Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach	Version 8.1.0
Oracle Financial Services Data Foundation	From 8.0.6 to 8.1.0
Oracle Financial Services Data Governance For Us Regulatory Reporting	From 8.0.6 to 8.0.9
Oracle Financial Services Data Integration Hub	Version 8.0.6
Oracle Financial Services Data Integration Hub	Version 8.0.7
Oracle Financial Services Data Integration Hub	Version 8.1.0
Oracle Financial Services Funds Transfer Pricing	Version 8.0.6
Oracle Financial Services Funds Transfer Pricing	Version 8.0.7
Oracle Financial Services Funds Transfer Pricing	Version 8.1.0
Oracle Financial Services Hedge Management And Ifrs Valuations	From 8.0.6 to 8.0.8
Oracle Financial Services Hedge Management And Ifrs Valuations	Version 8.1.0
Oracle Financial Services Institutional Performance Analytics	Version 8.0.6
Oracle Financial Services Institutional Performance Analytics	Version 8.0.7
Oracle Financial Services Institutional Performance Analytics	Version 8.1.0
Oracle Financial Services Liquidity Risk Management	Version 8.0.6
Oracle Financial Services Liquidity Risk Measurement And Management	Version 8.0.7
Oracle Financial Services Liquidity Risk Measurement And Management	Version 8.0.8
Oracle Financial Services Liquidity Risk Measurement And Management	Version 8.1.0
Oracle Financial Services Loan Loss Forecasting And Provisioning	From 8.0.6 to 8.0.8
Oracle Financial Services Loan Loss Forecasting And Provisioning	Version 8.1.0
Oracle Financial Services Market Risk Measurement And Management	Version 8.0.6
Oracle Financial Services Market Risk Measurement And Management	Version 8.0.8
Oracle Financial Services Price Creation And Discovery	Version 8.0.6
Oracle Financial Services Price Creation And Discovery	Version 8.0.7
Oracle Financial Services Profitability Management	Version 8.0.6
Oracle Financial Services Profitability Management	Version 8.0.7
Oracle Financial Services Profitability Management	Version 8.1.0
Oracle Financial Services Regulatory Reporting For European Banking Authority	From 8.0.6 to 8.1.0
Oracle Financial Services Regulatory Reporting For Us Federal Reserve	From 8.0.6 to 8.0.9
Oracle Healthcare Foundation	Version 7.1.1
Oracle Healthcare Foundation	Version 7.2.0
Oracle Healthcare Foundation	Version 7.2.1
Oracle Healthcare Foundation	Version 7.3.0
Oracle Hospitality Materials Control	Version 18.1
Oracle Hospitality Simphony	Version 18.1
Oracle Hospitality Simphony	Version 18.2
Oracle Hospitality Simphony	Version 19.1.0-19.1.2
Oracle Insurance Accounting Analyzer	Version 8.0.9
Oracle Insurance Allocation Manager For Enterprise Profitability	Version 8.0.8
Oracle Insurance Allocation Manager For Enterprise Profitability	Version 8.1.0
Oracle Insurance Data Foundation	Version 8.0.6-8.1.0
Oracle Insurance Insbridge Rating And Underwriting	From 5.0.0.0 to 5.6.0.0
Oracle Insurance Insbridge Rating And Underwriting	Version 5.6.1.0
Oracle Jdeveloper	Version 11.1.1.9.0
Oracle Jdeveloper	Version 12.2.1.3.0
Oracle Jdeveloper	Version 12.2.1.4.0
Oracle Peoplesoft Enterprise Peopletools	Version 8.56
Oracle Peoplesoft Enterprise Peopletools	Version 8.57
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Policy Automation	From 12.2.0 to 12.2.20
Oracle Policy Automation Connector For Siebel	Version 10.4.6
Oracle Policy Automation For Mobile Devices	From 12.2.0 to 12.2.20
Oracle Retail Back Office	Version 14.0
Oracle Retail Back Office	Version 14.1
Oracle Retail Customer Management And Segmentation Foundation	Version 19.0
Oracle Retail Returns Management	Version 14.0
Oracle Retail Returns Management	Version 14.1
Oracle Siebel Ui Framework	Version 20.8
Oracle Weblogic Server	Version 10.3.6.0.0
Oracle Weblogic Server	Version 12.1.3.0.0
Oracle Weblogic Server	Version 12.2.1.3.0
Oracle Weblogic Server	Version 12.2.1.4.0
Oracle Weblogic Server	Version 14.1.1.0.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.