Cross-site scripting in jQuery - CVE-2020-11022

Vulnerability identifier: #VU27052

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2020-11022

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the regex operation in "jQuery.htmlPrefilter". A remote attacker can pass specially crafted data to the application that uses .html()</code>, <code>.append() or similar methods for it and execute arbitrary JavaScript code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

jQuery
watsonx.data
Planning Analytics Local
Oracle Financial Services Regulatory Reporting for De Nederlandsche Bank
PeopleSoft Enterprise PeopleTools
PeopleSoft Enterprise PT PeopleTools
PT-G503
Dell EMC VxRail Appliance
IBM Cloud Pak for Watson AIOps
IBM Security Verify Information Queue
IBM Watson Machine Learning Accelerator
Oracle Banking Platform
Oracle Communications Operations Monitor
Tivoli Network Manager IP Edition
RecoverPoint Classic
Oracle Business Intelligence Enterprise Edition
Oracle Agile Product Lifecycle Management for Process
IBM Business Automation Manager Open Editions
Oracle Financial Services Analytical Applications Infrastructure
Oracle Enterprise Session Border Controller
PeopleSoft Enterprise SCM Purchasing
PeopleSoft Enterprise SCM eProcurement
Oracle Policy Automation Connector for Siebel
Financial Reporting
Oracle Policy Automation
Oracle Communications User Data Repository
Oracle Application Testing Suite
Oracle Retail Returns Management
Oracle Retail Back Office
Oracle Retail Central Office
Oracle Communications EAGLE Application Processor
Oracle Banking Digital Experience
IBM Aspera Shares
Storage Copy Data Management
IBM Aspera Console
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
IBM Engineering Lifecycle Optimization - Publishing
MobileFirst Platform
OpenPages for IBM Cloud Pak for Data
Security Verify Privilege On-Premises
Robotic Process Automation for Cloud Pak
Gentoo Linux
Fedora
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Ubuntu
SUSE Linux
Opensuse
EcoWebServerIII MES3-255C-DM-CN
EcoWebServerIII MES3-255C-CN
EcoWebServerIII MES3-255C-DM-EN
EcoWebServerIII MES3-255C-EN
AMQ Interconnect
IBM Process Mining
IBM Cloud Transformation Advisor
StorageTek Tape Analytics SW Tool
Oracle Financial Services Revenue Management and Billing Analytics
Oracle Banking Enterprise Collections
Oracle Communications Application Session Controller
Oracle Communications WebRTC Session Controller
Oracle Financial Services Data Foundation
Oracle Financial Services Analytical Applications Reconciliation Framework
Oracle Financial Services Loan Loss Forecasting and Provisioning
Oracle Financial Services Liquidity Risk Management
Oracle Financial Services Data Integration Hub
Oracle Financial Services Data Governance for US Regulatory Reporting
Oracle Financial Services Regulatory Reporting for US Federal Reserve
Oracle Financial Services Profitability Management
Oracle Financial Services Regulatory Reporting for European Banking Authority
Oracle Financial Services Asset Liability Management
Oracle Insurance Data Foundation
Oracle Financial Services Price Creation and Discovery
Oracle Financial Services Institutional Performance Analytics
Oracle Financial Services Liquidity Risk Measurement and Management
Oracle Financial Services Balance Sheet Planning
Oracle Insurance Allocation Manager for Enterprise Profitability
Oracle Insurance Accounting Analyzer
Oracle Communications Session Report Manager
Oracle StorageTek ACSLS
WebSphere eXtreme Scale
Oracle Communications Analytics
IBM Cloud Pak for Business Automation
Autodesk Infraworks
Log Analysis
Netcool Operations Insight
Dell PowerPath Management Appliance
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
Data Replication on Cloud Pak for Data
IBM Sterling B2B Integrator
Engineering Workflow Management
IBM Maximo Asset Management
IBM Security Verify Governance - Containerized Identity Manager
IBM Security Verify Governance
Oracle Blockchain Platform
Tenable.sc
QRadar Pulse App
Cacti
Moodle
Oracle Utilities Application Framework
Request Tracker
Cloudera Data Platform Private Cloud Base for IBM
Oracle Communications Session Route Manager
Oracle Communications Element Manager
PeopleSoft Enterprise FIN Expenses
PeopleSoft Enterprise FIN Common Application Objects
Oracle WebCenter Sites
Oracle Fusion Middleware MapViewer
qpid-dispatch (Red Hat package)
rhv-log-collector-analyzer (Red Hat package)
cacti (Alpine package)
ovirt-engine-ui-extensions (Red Hat package)
ovirt-engine-extension-aaa-ldap (Red Hat package)
vdsm-jsonrpc-java (Red Hat package)
ovirt-web-ui (Red Hat package)
ipa (Red Hat package)
ovirt-log-collector (Red Hat package)
ovirt-engine (Red Hat package)
ovirt-engine-dwh (Red Hat package)
otrs (Alpine package)
drupal7 (Alpine package)
drupal7 (Debian package)
eap7-jboss-jsp (Red Hat package)
eap7-jboss-jsf (Red Hat package)
eap7-javaee-security-soteria (Red Hat package)
eap7-jettison (Red Hat package)
eap7-ironjacamar (Red Hat package)
jquery (Ubuntu package)
eap7-elytron-web (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-undertow (Red Hat package)
eap7-apache-sshd (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-jackson-core (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
libjs-jquery (Ubuntu package)
eap7-hal-console (Red Hat package)
atomic-openshift-web-console (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-hibernate-search (Red Hat package)
unboundid-ldapsdk (Red Hat package)
eap7-woodstox-core (Red Hat package)
eap7-wildfly (Red Hat package)
drupal7 (Ubuntu package)
drupal7
drupal8
rh-sso7-keycloak (Red Hat package)
October CMS
Backdrop CMS
Joomla!
Drupal
Oracle Healthcare Translational Research
Oracle Healthcare Foundation
Oracle Financial Services Funds Transfer Pricing
PeopleSoft Enterprise HCM Human Resources
Oracle Hospitality Simphony
Red Hat Virtualization Manager
Nessus Network Monitor
Traffix SDC
JD Edwards EnterpriseOne Tools
Primavera Unifier
Red Hat OpenShift Container Platform
IBM Tivoli Network Manager (ITNM)
Oracle Insurance Insbridge Rating and Underwriting
IBM Qradar SIEM
Oracle Financial Services Market Risk Measurement and Management
Oracle Financial Services Hedge Management and IFRS Valuations
Zoho ManageEngine OpManager
Oracle Hospitality Materials Control
IBM Cognos Command Center
IBM Cognos Controller
Oracle Communications Interactive Session Recorder
Oracle Communications Services Gatekeeper
Oracle Communications Billing and Revenue Management
JBoss Enterprise Application Platform
Oracle WebLogic Server
Primavera Gateway
Juniper Secure Analytics (JSA)
Dell EMC NetWorker vProxy
Red Hat Single Sign-On
Integrated Diameter Intelligence Hub (IDIH)
Oracle Financial Services Basel Regulatory Capital Basic
Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach
RSA Authentication Manager
JD Edwards EnterpriseOne Orchestrator
Oracle Enterprise Manager Ops Center
Juniper Junos Space
Oracle Agile PLM Framework
Oracle JDeveloper
IBM CICS TX Standard
IBM CICS TX Advanced
Oracle Commerce Merchandising
Oracle Commerce Guided Search
Oracle Retail Customer Management and Segmentation Foundation
IBM InfoSphere Information Server
SUSE Package Hub for SUSE Linux Enterprise
Oracle Policy Automation for Mobile Devices
Siebel Mobile App
BIG-IP
Siebel UI Framework
IBM Cloud Pak System
IBM Storage Scale System
Dell Storage Manager

Install updates from vendor's website.

jQuery - update to 3.5.0
PT-G503 - update to 5.3
EcoWebServerIII MES3-255C-DM-CN - update to 3.3.1
EcoWebServerIII MES3-255C-CN - update to 3.3.1
EcoWebServerIII MES3-255C-DM-EN - update to 3.3.1
EcoWebServerIII MES3-255C-EN - update to 3.3.1
Tenable.sc - addressed in versions 5.17.0, 5.19.0
AMQ Interconnect - update to 1.9.0
QRadar Pulse App - update to 2.2.9
qpid-dispatch (Red Hat package) - addressed in versions 1.13.0-3.el6_10, 1.13.0-3.el7, 1.13.0-3.el8
IBM Security Verify Information Queue - update to 10.0.0
rhv-log-collector-analyzer (Red Hat package) - update to 1.0.15-1.el8ev
October CMS - update to 1.0.466
Cacti - update to 1.2.13
ovirt-engine-ui-extensions (Red Hat package) - update to 1.3.5-1.el8ev
ovirt-engine-extension-aaa-ldap (Red Hat package) - update to 1.4.6-1.el8ev
vdsm-jsonrpc-java (Red Hat package) - update to 1.7.2-1.el8ev
ovirt-web-ui (Red Hat package) - update to 1.9.1-1.el8ev
IBM Process Mining - update to 1.12.0.4
Backdrop CMS - addressed in versions 1.15.3, 1.16.1
IBM Cloud Transformation Advisor - update to 3.1.0
IBM Watson Machine Learning Accelerator - update to 2.6.0
Joomla! - update to 3.9.19
Oracle Communications Operations Monitor - update to 4.3.0
Moodle - addressed in versions 3.5.17, 3.8.8, 3.9.5, 3.10.2
ipa (Red Hat package) - update to 4.6.8-5.el7
Tivoli Network Manager IP Edition - update to 4.2.0.20
ovirt-log-collector (Red Hat package) - update to 4.4.7-2.el8ev
ovirt-engine (Red Hat package) - update to 4.5.2.4-0.1.el8ev
ovirt-engine-dwh (Red Hat package) - update to 4.5.4-1.el8ev
Request Tracker - update to 5.0.3
Nessus Network Monitor - update to 5.13.0
Oracle Insurance Insbridge Rating and Underwriting - update to 5.6.1.0
otrs (Alpine package) - update to 6.0.33-r0
RecoverPoint Classic - update to 5.1 SP4 P4
Drupal - addressed in versions 7.70, 8.7.14, 8.8.6
Cloudera Data Platform Private Cloud Base for IBM - addressed in versions 7.1.7 SP3, 7.1.9 SP1
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 9, 7.4.3 Fix Pack 1
JBoss Enterprise Application Platform - update to 7.4.9
Juniper Secure Analytics (JSA) - update to 7.5.0 UP9 IF02
Red Hat Single Sign-On - update to 7.6.2
drupal7 (Alpine package) - update to 7.70-r0
drupal7 (Debian package) - update to 7.52-2+deb9u10
IBM Business Automation Manager Open Editions - update to 8.0.7
WebSphere eXtreme Scale - update to 8.6.1.5 PH53340
JD Edwards EnterpriseOne Tools - update to 9.2.5.0
JD Edwards EnterpriseOne Orchestrator - update to 9.2.5.0
IBM InfoSphere Information Server - addressed in versions 11.7.1.0, 11.7.1.3, 11.7.1.3 Service pack 4
Zoho ManageEngine OpManager - update to 12.5 125212
Juniper Junos Space - update to 24.1R2
Autodesk Infraworks - addressed in versions 2019.3 Hotfix 5, 2020.2 Hotfix 4, 2021.2 Hotfix 4, 2022.0 Hotfix 3, 2022.1 Hotfix 2
eap7-jboss-jsp (Red Hat package) - addressed in versions api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el7eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el8eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el9eap
eap7-jboss-jsf (Red Hat package) - addressed in versions api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el7eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el8eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el9eap
eap7-javaee-security-soteria (Red Hat package) - addressed in versions 1.0.1-3.redhat_00003.1.el7eap, 1.0.1-3.redhat_00003.1.el8eap, 1.0.1-3.redhat_00003.1.el9eap
Log Analysis - update to 1.3.8
eap7-jettison (Red Hat package) - addressed in versions 1.5.2-1.redhat_00002.1.el7eap, 1.5.2-1.redhat_00002.1.el8eap, 1.5.2-1.redhat_00002.1.el9eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.10-1.Final_redhat_00001.1.el7eap, 1.5.10-1.Final_redhat_00001.1.el8eap, 1.5.10-1.Final_redhat_00001.1.el9eap
Netcool Operations Insight - update to 1.6.8
jquery (Ubuntu package) - addressed in versions 1.7.2+dfsg-2ubuntu1+esm1, 1.11.3+dfsg-4ubuntu0.1~esm1, 3.2.1-1ubuntu0.1~esm1
eap7-elytron-web (Red Hat package) - addressed in versions 1.9.3-1.Final_redhat_00001.1.el7eap, 1.9.3-1.Final_redhat_00001.1.el8eap, 1.9.3-1.Final_redhat_00001.1.el9eap
IBM Aspera Shares - update to 1.9.15
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-24.Final_redhat_00023.1.el7eap, 1.10.0-24.Final_redhat_00023.1.el8eap, 1.10.0-24.Final_redhat_00023.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.16-1.Final_redhat_00001.1.el7eap, 1.15.16-1.Final_redhat_00001.1.el8eap, 1.15.16-1.Final_redhat_00001.1.el9eap
watsonx.data - update to 2.1
eap7-undertow (Red Hat package) - addressed in versions 2.2.22-1.SP3_redhat_00001.1.el7eap, 2.2.22-1.SP3_redhat_00001.1.el8eap, 2.2.22-1.SP3_redhat_00001.1.el9eap
Storage Copy Data Management - update to 2.2.26.0
IBM Cloud Pak System - update to 2.3.4.0
eap7-apache-sshd (Red Hat package) - addressed in versions 2.9.2-1.redhat_00001.1.el7eap, 2.9.2-1.redhat_00001.1.el8eap, 2.9.2-1.redhat_00001.1.el9eap
eap7-jackson-databind (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-core (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-base (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-annotations (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-jaxrs-providers (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-java8 (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
Dell PowerPath Management Appliance - update to 3.1
libjs-jquery (Ubuntu package) - update to 3.3.1~dfsg-3ubuntu0.1
eap7-hal-console (Red Hat package) - addressed in versions 3.3.16-1.Final_redhat_00001.1.el7eap, 3.3.16-1.Final_redhat_00001.1.el8eap, 3.3.16-1.Final_redhat_00001.1.el9eap
IBM Aspera Console - update to 3.4.2
Red Hat OpenShift Container Platform - update to 3.11.0
atomic-openshift-web-console (Red Hat package) - update to 3.11.219-1.git.1.9b9b889.el7
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.49-1.Final_redhat_00001.1.el7eap, 4.0.49-1.Final_redhat_00001.1.el8eap, 4.0.49-1.Final_redhat_00001.1.el9eap
IBM Tivoli Network Manager (ITNM) - update to 4.2.0.16
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.5.1
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
DB2 on Cloud Pak for Data - update to 4.8.5
IBM Decision Optimization for Cloud Pak for Data - update to 5.0
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.27-1.Final_redhat_00001.1.el7eap, 5.0.27-1.Final_redhat_00001.1.el8eap, 5.0.27-1.Final_redhat_00001.1.el9eap
Data Replication on Cloud Pak for Data - update to 5.1.0
IBM Storage Scale System - addressed in versions 5.1.9.7, 5.2.2.0
eap7-hibernate-search (Red Hat package) - addressed in versions 5.10.13-3.Final_redhat_00001.1.el7eap, 5.10.13-3.Final_redhat_00001.1.el8eap, 5.10.13-3.Final_redhat_00001.1.el9eap
IBM Sterling B2B Integrator - addressed in versions 6.0.3.8, 6.1.2.2
unboundid-ldapsdk (Red Hat package) - update to 6.0.4-1.el8ev
eap7-woodstox-core (Red Hat package) - addressed in versions 6.4.0-1.redhat_00001.1.el7eap, 6.4.0-1.redhat_00001.1.el8eap, 6.4.0-1.redhat_00001.1.el9eap
Engineering Workflow Management - addressed in versions 7.0.1 iFix021, 7.0.2 iFix021
IBM Engineering Lifecycle Optimization - Publishing - addressed in versions 7.0.2.27, 7.0.3.2
Dell EMC VxRail Appliance - update to 7.0.100
eap7-wildfly (Red Hat package) - addressed in versions 7.4.9-4.GA_redhat_00003.1.el7eap, 7.4.9-4.GA_redhat_00003.1.el8eap, 7.4.9-4.GA_redhat_00003.1.el9eap
IBM Maximo Asset Management - update to 7.6.1.2.37
drupal7 (Ubuntu package) - addressed in versions 7.26-1ubuntu0.1+esm3, 7.44-1ubuntu1~16.04.0+esm3
drupal7 - addressed in versions 7.70-1.fc32, 7.72-1.el6, 7.72-1.el7, 7.72-1.fc31, 7.72-1.fc32, 7.72-1.fc33
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202304111626
RSA Authentication Manager - update to 8.5 Patch 2
drupal8 - update to 8.9.0-1.fc32
OpenPages for IBM Cloud Pak for Data - update to 9.000.0
IBM Security Verify Governance - Containerized Identity Manager - update to 10.0.2
IBM Security Verify Governance - update to 10.0.2.0.1
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF17
IBM Cognos Controller - addressed in versions 10.4.1.0.15, 10.4.2.0.2
IBM CICS TX Standard - update to 11.1.0.0 ifix5
IBM CICS TX Advanced - update to 11.1.0.0 ifix5
Security Verify Privilege On-Premises - update to 11.5.0.2
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso, 18.0.6-1.redhat_00001.1.el9sso
Dell EMC NetWorker vProxy - addressed in versions 19.2.1.4, 19.3.04, 19.4
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.10, 23.0.10
Oracle Blockchain Platform - update to 21.1.2
Dell Storage Manager - update to 2020 R1.21

• Exploit #7683 - CVE-2020-11022-CVE-2020-11023 (Little thing put together quickly to demonstrate this CVE ) (April 24, 2022)
• Exploit #5392 - jQuery 1.2 - Cross-Site Scripting (XSS) (May 9, 2021)
• Exploit #4910 - CVE-2020-11022 () (December 11, 2020)
• Exploit #2957 - snyk-js-jquery-565129 (patches for SNYK-JS-JQUERY-565129, SNYK-JS-JQUERY-567880, CVE-2020-1102, CVE-2020-11023, includes the patches for SNYK-JS-JQUERY-174006, CVE-2019-11358, CVE-2019-5428) (June 3, 2020)
• Exploit #2615 - jQuery html() Cross Site Scripting (April 28, 2020)

• https://snyk.io/vuln/SNYK-JS-JQUERY-565129
• https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77
• https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
• https://github.com/advisories/GHSA-gxr4-xjj5-5px2

• Cross-site scripting in jQuery
• Drupal update for jQuery
• Backdrop update for jQuery
• Debian update for drupal7
• Joomla! update for jQuery
• Multiple vulnerabilities in October CMS
• Multiple vulnerabilities in Oracle Communications Interactive Session Recorder
• Multiple vulnerabilities in Oracle Communications Session Route Manager
• Multiple vulnerabilities in Oracle Communications Session Report Manager
• Multiple vulnerabilities in Oracle Communications Operations Monitor
• Multiple vulnerabilities in Oracle Communications Element Manager
• Multiple vulnerabilities in Oracle Communications Analytics
• Multiple vulnerabilities in Primavera Gateway
• Cross-site scripting in Oracle Financial Services Regulatory Reporting for De Nederlandsche Bank
• Multiple vulnerabilities in Oracle Banking Enterprise Collections
• Multiple vulnerabilities in Oracle Banking Platform
• Cross-site scripting in Oracle Healthcare Translational Research
• OpenSUSE Linux update for cacti, cacti-spine
• OpenSUSE Linux update for cacti, cacti-spine
• Multiple vulnerabilities in Cacti
• Gentoo update for Cacti
• OpenSUSE Linux update for cacti, cacti-spine
• Cross-site scripting in drupal7 (Alpine package)
• Cross-site scripting in cacti (Alpine package)
• Zoho ManageEngine OpManager update for jQuery
• Red Hat Enterprise Linux 7 update for ipa
• Multiple vulnerabilities in Red Hat AMQ Interconnect
• Cross-site scripting in Oracle Agile Product Lifecycle Management for Process
• Multiple vulnerabilities in Integrated Diameter Intelligence Hub (IDIH)
• Multiple vulnerabilities in Oracle Communications Application Session Controller
• Multiple vulnerabilities in Oracle Communications Billing and Revenue Management
• Cross-site scripting in Oracle Enterprise Session Border Controller
• Cross-site scripting in Oracle Communications WebRTC Session Controller
• Cross-site scripting in Oracle Insurance Data Foundation
• Cross-site scripting in Oracle Insurance Allocation Manager for Enterprise Profitability
• Cross-site scripting in Oracle Insurance Accounting Analyzer
• Cross-site scripting in Oracle Financial Services Regulatory Reporting for US Federal Reserve
• Cross-site scripting in Oracle Financial Services Regulatory Reporting for European Banking Authority
• Cross-site scripting in Oracle Financial Services Profitability Management
• Multiple vulnerabilities in Oracle Financial Services Market Risk Measurement and Management
• Cross-site scripting in Oracle Financial Services Loan Loss Forecasting and Provisioning
• Cross-site scripting in Oracle Financial Services Liquidity Risk Measurement and Management
• Cross-site scripting in Oracle Financial Services Liquidity Risk Management
• Cross-site scripting in Oracle Financial Services Hedge Management and IFRS Valuations
• Cross-site scripting in Oracle Financial Services Funds Transfer Pricing
• Cross-site scripting in Oracle Financial Services Data Integration Hub
• Cross-site scripting in Oracle Financial Services Data Governance for US Regulatory Reporting
• Cross-site scripting in Oracle Financial Services Data Foundation
• Cross-site scripting in Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach
• Cross-site scripting in Oracle Financial Services Basel Regulatory Capital Basic
• Cross-site scripting in Oracle Financial Services Balance Sheet Planning
• Cross-site scripting in Oracle Financial Services Asset Liability Management
• Cross-site scripting in Oracle Financial Services Analytical Applications Reconciliation Framework
• Multiple vulnerabilities in Oracle Banking Digital Experience
• Multiple vulnerabilities in Oracle Financial Services Price Creation and Discovery
• Multiple vulnerabilities in Oracle Financial Services Institutional Performance Analytics
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Multiple vulnerabilities in Oracle Healthcare Foundation
• Cross-site scripting in Oracle JDeveloper
• Multiple vulnerabilities in Oracle WebLogic Server
• Cross-site scripting in Oracle Hospitality Simphony
• Cross-site scripting in Oracle Hospitality Materials Control
• Multiple vulnerabilities in Oracle Insurance Insbridge Rating and Underwriting
• Multiple vulnerabilities in Oracle Enterprise Manager Ops Center
• Multiple vulnerabilities in Oracle Policy Automation for Mobile Devices
• Multiple vulnerabilities in Oracle Policy Automation Connector for Siebel
• Cross-site scripting in Siebel UI Framework
• Multiple vulnerabilities in Oracle Retail Customer Management and Segmentation Foundation
• Multiple vulnerabilities in Oracle Retail Returns Management
• Multiple vulnerabilities in Oracle Retail Central Office
• Multiple vulnerabilities in Oracle Retail Back Office
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Oracle Policy Automation
• Red Hat Enterprise Linux 8 update for the idm:DL1 and idm:client modules
• OpenSUSE Linux update for otrs
• Multiple vulnerabilities in Tenable.sc
• Multiple vulnerabilities in Oracle Application Testing Suite
• Cross-site scripting in Oracle WebCenter Sites
• Multiple vulnerabilities in Oracle WebLogic Server
• Cross-site scripting in Hyperion Financial Reporting
• Multiple vulnerabilities in PeopleSoft Enterprise HCM Human Resources
• Cross-site scripting in Siebel Mobile App
• Multiple vulnerabilities in StorageTek Tape Analytics SW Tool
• Multiple vulnerabilities in JD Edwards EnterpriseOne Orchestrator
• Multiple vulnerabilities in JD Edwards EnterpriseOne Tools
• Nessus Network Monitor update for jQuery
• Moodle update for jQuery
• Cross-site scripting in otrs (Alpine package)
• Multiple vulnerabilities in Oracle Commerce Merchandising
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in Oracle Fusion Middleware MapViewer
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Cross-site scripting in PeopleSoft Enterprise SCM Purchasing
• Multiple vulnerabilities in PeopleSoft Enterprise SCM eProcurement
• Cross-site scripting in PeopleSoft Enterprise FIN Expenses
• Cross-site scripting in PeopleSoft Enterprise FIN Common Application Objects
• Multiple vulnerabilities in PeopleSoft Enterprise PT PeopleTools
• Multiple vulnerabilities in JD Edwards EnterpriseOne Tools
• Multiple vulnerabilities in Tenable.sc
• Multiple vulnerabilities in Oracle Financial Services Revenue Management and Billing Analytics
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Autodesk InfraWorks
• Multiple vulnerabilities in Oracle Communications Services Gatekeeper
• Multiple vulnerabilities in Oracle Communications EAGLE Application Processor
• Multiple vulnerabilities in Mitsubishi Electric EcoWebServerIII
• Multiple vulnerabilities in Oracle Blockchain Platform
• Multiple vulnerabilities in Oracle StorageTek ACSLS
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Best Practical Request Tracker (RT)
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in Oracle Agile PLM Framework
• Cross-site scripting in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Aspera Console and Aspera Shares
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Red Hat Virtualization Manager
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM QRadar Pulse for QRadar SIEM
• Multiple vulnerabilities in Oracle Communications User Data Repository
• Multiple vulnerabilities in Dell NetWorker
• Cross-site scripting in Dell EMC PowerPath Management Appliance (PPMA)
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in IBM Tivoli Network Manager
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM CICS TX Advanced
• Multiple vulnerabilities in IBM CICS TX Standard
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in IBM WebSphere eXtreme Scale Liberty Deployment
• Multiple vulnerabilities in IBM MobileFirst Platform
• Multiple vulnerabilities in IBM Engineering Workflow Management (EWM)
• Multiple vulnerabilities in IBM Cognos Command Center
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in Dell RecoverPoint Classic
• Multiple vulnerabilities in IBM Security Verify Information Queue
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Maximo Asset Management
• Multiple vulnerabilities in Moxa PT-G503 Series
• Multiple vulnerabilities in IBM OpenPages for IBM Cloud Pak for Data
• Watson Machine Learning Accelerator on Cloud Pak for Data update for jQuery
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Multiple vulnerabilities in IBM Operations Analytics
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Security Verify Privilege On-Premises
• Multiple vulnerabilities in IBM Engineering Lifecycle Optimization - Publishing (PUB)
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
• Cross-site scripting in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Security Verify Governance - Containerized Identity Manager
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in Oracle Utilities Application Framework
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition (ITNM)
• Multiple vulnerabilities in IBM Storage Scale
• Multiple vulnerabilities in Junos Space
• Ubuntu update for jquery
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM Data Replication on Cloud Pak for Data
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Cross-site scripting in Red Hat OpenShift Container Platform 3
• Fedora 32 update for drupal7
• Fedora 32 update for drupal8
• Fedora 32 update for drupal7
• Fedora 31 update for drupal7
• Fedora EPEL 6 update for drupal7
• Fedora EPEL 7 update for drupal7
• Fedora 33 update for drupal7
• RSA Authentication Manager update for third-party components
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in Dell Storage Manager
• XSS in F5 BIG-IP jQuery library used by TMUI/Configuration utility and iAppsLX
• XSS in F5 Traffix SDC jQuery library used by WebUI
• Ubuntu update for jquery
• Ubuntu update for drupal7
• Multiple vulnerabilities in Cloudera Data Platform Private Cloud Base with IBM (CDP)