Vulnerable software · Scan · first seen 1 Oct · CVE-2020-11022
MediumLikelyOpenMobilefix by 30 Nov
Open · Mobile's
It's Mobile's, but no one has picked it up.
One problem in two places, found by scan.
2 sources · 2 places
Scan
First found Thu 1 Oct, last seen Mon 12 Oct
First found Thu 1 Oct, last seen Thu 15 Oct
What closes it
Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.
22nd of 39 in your queue
Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters
Priority
47 / 100
What each source saw
As each source gives it · secrets, keys and card numbers stay masked
The scan's case file · tessellatepay.com
See it in that scanWhat we saw
blog.tessellatepay.com shows jQuery 3.4.1, a version this advisory covers. We matched the version; the proof, where there is one, is above.
The advisory
Impact Passing HTML from untrusted sources, even after sanitizing it, to one of jQuery's DOM manipulation methods (`.html()`, `.append()` and others) may execute untrusted code.
Patches This problem is patched in jQuery 3.5.0.
The fix
Upgrade to a fixed version, then retest.
Where
Detected
jQuery 3.4.1
How likely
What happened, and what was said
1 event · 0 comments · oldest first