This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-10785 →

DEBIAN-CVE-2019-10785

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmp...

Original description

The description as published by the source.

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 dojo

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2+dfsg1-1"}]}]

Debian:13 dojo

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2+dfsg1-1"}]}]

Debian:14 dojo

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2+dfsg1-1"}]}]

References

advisory security-tracker.debian.org