ELSA-2020-4847 — Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update (Oracle Linux 8)

Fixed packages 47

Release	Package	Fixed in
Oracle Linux · 8	apache-commons-collections	0:3.2.2-10.module+el8.3.0+7697+44932688
Oracle Linux · 8	apache-commons-lang	0:2.6-21.module+el8.3.0+7697+44932688
Oracle Linux · 8	apache-commons-net	0:3.6-3.module+el8.3.0+7697+44932688
Oracle Linux · 8	bea-stax-api	0:1.2.0-16.module+el8.3.0+7697+44932688
Oracle Linux · 8	glassfish-fastinfoset	0:1.2.13-9.module+el8.3.0+7697+44932688
Oracle Linux · 8	glassfish-jaxb-api	0:2.2.12-8.module+el8.3.0+7697+44932688
Oracle Linux · 8	glassfish-jaxb-core	0:2.2.11-11.module+el8.3.0+7697+44932688
Oracle Linux · 8	glassfish-jaxb-runtime	0:2.2.11-11.module+el8.3.0+7697+44932688
Oracle Linux · 8	glassfish-jaxb-txw2	0:2.2.11-11.module+el8.3.0+7697+44932688
Oracle Linux · 8	jackson-annotations	0:2.10.0-1.module+el8.3.0+7697+44932688
Oracle Linux · 8	jackson-core	0:2.10.0-1.module+el8.3.0+7697+44932688
Oracle Linux · 8	jackson-databind	0:2.10.0-1.module+el8.3.0+7697+44932688
Oracle Linux · 8	jackson-jaxrs-json-provider	0:2.9.9-1.module+el8.3.0+7697+44932688
Oracle Linux · 8	jackson-jaxrs-providers	0:2.9.9-1.module+el8.3.0+7697+44932688
Oracle Linux · 8	jackson-module-jaxb-annotations	0:2.7.6-4.module+el8.3.0+7697+44932688
Oracle Linux · 8	jakarta-commons-httpclient	1:3.1-28.module+el8.3.0+7697+44932688
Oracle Linux · 8	javassist	0:3.18.1-8.module+el8.3.0+7697+44932688
Oracle Linux · 8	javassist-javadoc	0:3.18.1-8.module+el8.3.0+7697+44932688
Oracle Linux · 8	jss	0:4.7.3-1.module+el8.3.0+7857+983338ee
Oracle Linux · 8	jss-javadoc	0:4.7.3-1.module+el8.3.0+7857+983338ee
Oracle Linux · 8	ldapjdk	0:4.22.0-1.module+el8.3.0+7857+983338ee
Oracle Linux · 8	ldapjdk-javadoc	0:4.22.0-1.module+el8.3.0+7857+983338ee
Oracle Linux · 8	pki-base	0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
Oracle Linux · 8	pki-base-java	0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
Oracle Linux · 8	pki-ca	0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
Oracle Linux · 8	pki-kra	0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
Oracle Linux · 8	pki-server	0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
Oracle Linux · 8	pki-servlet-4.0-api	1:9.0.30-1.module+el8.3.0+7697+44932688
Oracle Linux · 8	pki-servlet-engine	1:9.0.30-1.module+el8.3.0+7697+44932688
Oracle Linux · 8	pki-symkey	0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
Oracle Linux · 8	pki-tools	0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
Oracle Linux · 8	python-nss-doc	0:1.0.1-10.module+el8.3.0+7697+44932688
Oracle Linux · 8	python3-nss	0:1.0.1-10.module+el8.3.0+7697+44932688
Oracle Linux · 8	python3-pki	0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
Oracle Linux · 8	relaxngDatatype	0:2011.1-7.module+el8.3.0+7697+44932688
Oracle Linux · 8	resteasy	0:3.0.26-3.module+el8.3.0+7697+44932688
Oracle Linux · 8	slf4j	0:1.7.25-4.module+el8.3.0+7697+44932688
Oracle Linux · 8	slf4j-jdk14	0:1.7.25-4.module+el8.3.0+7697+44932688
Oracle Linux · 8	stax-ex	0:1.7.7-8.module+el8.3.0+7697+44932688
Oracle Linux · 8	tomcatjss	0:7.5.0-1.module+el8.3.0+7857+983338ee
Oracle Linux · 8	velocity	0:1.7-24.module+el8.3.0+7697+44932688
Oracle Linux · 8	xalan-j2	0:2.7.1-38.module+el8.3.0+7697+44932688
Oracle Linux · 8	xerces-j2	0:2.11.0-34.module+el8.3.0+7697+44932688
Oracle Linux · 8	xml-commons-apis	0:1.4.01-25.module+el8.3.0+7697+44932688
Oracle Linux · 8	xml-commons-resolver	0:1.2-26.module+el8.3.0+7697+44932688
Oracle Linux · 8	xmlstreambuffer	0:1.5.4-8.module+el8.3.0+7697+44932688
Oracle Linux · 8	xsom	0:0-19.20110809svn.module+el8.3.0+7697+44932688

Vulnerabilities 13

Medium 6.9

CVE-2020-11023 Exploited Public exploit EPSS 85%

Potential XSS vulnerability in jQuery

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…

jquery jQuery drupal7 cacti Debian Ubuntu Alpine npm Packagist Maven NuGet RubyGems

Apr 29, 2020
KEV Jan 23, 2025
Medium 6.9

CVE-2020-11022 Public exploit EPSS 99%

jQuery has a potential XSS vulnerability

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…

jquery jQuery keycloak-26.6-iamguarded-compat drupal7 Debian Ubuntu Alpine Wolfi npm Packagist Maven NuGet RubyGems

Apr 29, 2020
Medium 6.1

CVE-2015-9251 Public exploit EPSS 30%

Cross-Site Scripting (XSS) in jquery

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

ruby ceph jquery-rails org.webjars.npm:jquery Ubuntu Azure Linux Alpine npm Maven NuGet RubyGems

Jan 18, 2018
Medium 6.1

CVE-2016-10735 Public exploit

Bootstrap Cross-site Scripting vulnerability

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

bootstrap twitter-bootstrap3 twitter-bootstrap3 twbs/bootstrap Debian Ubuntu npm Packagist Maven NuGet RubyGems

Jan 9, 2019
Medium 6.1

CVE-2018-14040 Public exploit

Bootstrap vulnerable to Cross-Site Scripting (XSS)

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

reaper twitter-bootstrap3 bootstrap twitter-bootstrap3 Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Jul 13, 2018
Medium 6.1

CVE-2018-14042 Public exploit

Bootstrap Cross-site Scripting vulnerability

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

ceph fluent-bit pytorch twitter-bootstrap3 Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Jul 13, 2018
Medium 6.1

CVE-2019-11358 Public exploit EPSS 87%

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Obj…

mediawiki mediawiki django drupal/core Debian Ubuntu Azure Linux Alpine npm Packagist Maven PyPI NuGet RubyGems

Apr 19, 2019
Medium 6.1

CVE-2019-8331 Public exploit EPSS 16%

Bootstrap Vulnerable to Cross-Site Scripting

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

ceph fluent-bit pytorch ntopng Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Feb 20, 2019
Medium 4.7

CVE-2019-10146

A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to …

Red Hat pki-core dogtag-pki dogtag-pki Debian Ubuntu

Mar 18, 2020
Medium 4.3

CVE-2019-10179

A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not…

[UNKNOWN] pki-core/pki-kra dogtag-pki dogtag-pki Debian Ubuntu

Mar 20, 2020
Medium 4.3

CVE-2019-10221

A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from …

[UNKNOWN] pki-core dogtag-pki dogtag-pki Debian Ubuntu

Mar 20, 2020
Unscored —

CVE-2020-15720

In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation.…

dogtag-pki dogtag-pki Debian Ubuntu

Jul 14, 2020
Unscored —

CVE-2020-1721

A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly saniti…

dogtag-pki dogtag-pki Debian Ubuntu

Apr 30, 2021

Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update (Oracle Linux 8)

Fixed packages 47

Vulnerabilities 13

Potential XSS vulnerability in jQuery

jQuery has a potential XSS vulnerability

Cross-Site Scripting (XSS) in jquery

Bootstrap Cross-site Scripting vulnerability

Bootstrap vulnerable to Cross-Site Scripting (XSS)

Bootstrap Cross-site Scripting vulnerability

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

Bootstrap Vulnerable to Cross-Site Scripting

A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to …

A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not…

A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from …

In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation.…

A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly saniti…