Summary
It was discovered that Drupal incorrectly parsed untrusted HTML. A
remote attacker could possibly use this issue to execute arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | drupal7 | 7.26-1ubuntu0.1+esm3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | drupal7 | 7.44-1ubuntu1~16.04.0+esm3 |
Vulnerabilities 2
-
Medium 6.9
Potential XSS vulnerability in jQuery
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…
KEV Jan 23, 2025 -
Medium 6.9
jQuery has a potential XSS vulnerability
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…