CVE-2019-11358 json
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
published 7y ago modified last mo. also DRUPAL-CORE-2019-006 , GHSA-6c3j-c64m-qhgq , PYSEC-2026-628 , EUVD-2019-0403
- cvss
- 6.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 86.8%
- EPSS 86.8% chance of exploitation in 30 days, percentile 99.7%
- public exploits
- 1
- Exploit-DB
Summary
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Patch / fix
- npm jquery 3.4.0
- rubygems jquery-rails 4.3.4
- nuget jQuery 3.4.0
- pypi django 2.1.9, 2.2.2
- maven org.webjars.npm:jquery 3.4.0
- packagist maximebf/debugbar 1.19.0
- packagist drupal/core 8.5.15, 8.6.15
- jquery jquery 3.4.0
- drupal drupal 7.66, 8.5.15, 8.6.15
- backdropcms backdrop 1.11.9, 1.12.6
- oracle application_express 19.1
- mediawiki Debian 14, Debian 13, Debian 12 1:1.31.2-1
- node-jquery Debian 14, Debian 13, Debian 12 2.2.4+dfsg-4
debian advisories DEBIAN-CVE-2019-11358
- jquery Ubuntu Pro 14.04 LTS 1.7.2+dfsg-2ubuntu1+esm1
- jquery Ubuntu Pro 16.04 LTS 1.11.3+dfsg-4ubuntu0.1~esm1
- jquery Ubuntu Pro 18.04 LTS 3.2.1-1ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2019-11358
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- jss RHEL 8 4.7.3-1.module+el8.3.0+8058+d5cd4219
- xsom RHEL 8 0-19.20110809svn.module+el8.1.0+3366+6dfb954c
- slf4j RHEL 8 1.7.25-4.module+el8.1.0+3366+6dfb954c
- pki-ca RHEL 8 10.9.4-1.module+el8.3.0+8058+d5cd4219
- ldapjdk RHEL 8 4.22.0-1.module+el8.3.0+6784+6e1e4c62
- pki-kra RHEL 8 10.9.4-1.module+el8.3.0+8058+d5cd4219
- stax-ex RHEL 8 1.7.7-8.module+el8.2.0+5723+4574fbff
- bea-stax RHEL 8 1.2.0-16.module+el8.1.0+3366+6dfb954c
red hat advisories RHSA-2020:4847RHSA-2020:4670RHSA-2023:1043RHSA-2023:1044RHSA-2023:1045RHSA-2023:0553
- python-Django5 openSUSE Tumbleweed 5.2.16-1.1
- python-Django openSUSE Tumbleweed 5.2.16-1.1
- python-Django4 openSUSE Tumbleweed 4.2.30-4.1
- python-Django6 openSUSE Tumbleweed 6.0-1.1
- python-notebook Package Hub 15 SP6, openSUSE Leap 15.6 5.7.11-bp156.4.3.1
- python-Django4 openSUSE Tumbleweed 4.2.14-1.1
- python-Django openSUSE Tumbleweed 3.2.7-2.3
- python-Django openSUSE Tumbleweed 4.2.11-2.1
opensuse advisories openSUSE-SU-2026:11270-1openSUSE-SU-2026:11248-1openSUSE-SU-2026:11235-1openSUSE-SU-2026:10005-1openSUSE-SU-2024:0231-1openSUSE-SU-2024:14208-1
- custodia AlmaLinux 8 0.6.0-3.module_el8.6.0+2881+2f24dc92
- python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.5.0+2641+983b221b
- python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.6.0+2881+2f24dc92
- python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.6.0+2737+7e73ea90
- python3-qrcode AlmaLinux 8 5.1-12.module_el8.6.0+2881+2f24dc92
- python3-qrcode AlmaLinux 8 5.1-12.module_el8.5.0+2641+983b221b
- python3-qrcode AlmaLinux 8 5.1-12.module_el8.6.0+2737+7e73ea90
- python3-yubico AlmaLinux 8 1.3.2-9.module_el8.5.0+2641+983b221b
almalinux advisories ALSA-2020:4670
- pcs Rocky Linux 8 0.10.10-4.el8
- xsom Rocky Linux 8 0-19.20110809svn.module+el8.3.0+53+ea062990
- slf4j Rocky Linux 8 1.7.25-4.module+el8.5.0+697+f586bb30
- slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+74+855e3f5d
- slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+133+b8b54b58
- ldapjdk Rocky Linux 8 4.22.0-1.module+el8.4.0+418+b7ae1d4a
- stax-ex Rocky Linux 8 1.7.7-8.module+el8.3.0+53+ea062990
- bea-stax Rocky Linux 8 1.2.0-16.module+el8.3.0+53+ea062990
rocky linux advisories RLSA-2021:4142RLSA-2020:4847RLSA-2020:4670
- drupal7 Alpine 3.9 7.67-r0
- rabbitmq-server Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 3.7.17-r0
alpine advisories ALPINE-CVE-2019-11358
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- orangefs Azure Linux 3.0 2.9.7-7
- python-pygments Azure Linux 3.0 2.7.4-1
- m2crypto Azure Linux 3.0 0.38.0-4
azure linux advisories AZL-38200AZL-40759AZL-41809
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- python-django Arch Linux 2.2.2-1
arch linux advisories AVG-969
- github.com/jquery/jquery@753d591 commit
- github.com/maximebf/php-debugbar@847216e commit
- github.com/django/django@34ec522 commit
- github.com/django/django@95649bc commit
- github.com/django/django@baaf187 commit
- github.com/jquery/jquery#4333 pull request
- drupal.org/sa-core-2019-006 advisory
- seclists.org/bugtraq/2019/May/18 advisory
- seclists.org/fulldisclosure/2019/May/11 advisory
- seclists.org/fulldisclosure/2019/May/13 advisory
Is CVE-2019-11358 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2019-11358 updated cvss 5.6
jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection
-
Red Hat 3scale API Management Platform 2 jquery Red Hat Enterprise Linux 6 ipa, pcp, pcp-gui, pcp-conf, pcp-libs, pcp-webjs, +80 more Red Hat Enterprise Linux 7 pcp, pki-ca, ipsilon, pcp-gui, pki-kra, pcp-conf, +114 more Red Hat Fuse 7 jquery Red Hat OpenShift Container Platform 3.11 openshift3/grafanaaffected: no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform 4 openshift4/ose-grafanaaffected: no fix available
-
Red Hat OpenStack Platform 9 (Mitaka) python-XStatic-jQuery, python-XStatic-jquery-ui Red Hat OpenStack Platform 10 (Newton) python-XStatic-jQuery, python-XStatic-jquery-uiaffected: no fix planned “Will not fix”
-
Red Hat OpenStack Platform 14 (Rocky) python-XStatic-jQuery, python-XStatic-jquery-ui Red Hat Satellite 5 patternfly1 Red Hat Software Collections python27-python-coverage, python27-python-werkzeug, rh-python35-python-coverage, rh-python36-python-coverage, rh-ror42-rubygem-jquery-rails, rh-ror50-rubygem-jquery-rails Red Hat Virtualization 4 ovirt-js-dependencies, ovirt-engine-dashboardaffected: no fix planned “Out of support scope”
-
Red Hat CloudForms Management Engine 5.10 cfme 5.10.9.1-1.el7cf, ansible-tower 3.5.2-1.el7at, cfme-gemset 5.10.9.1-1.el7cf, ansible-tower-ui 3.5.2-1.el7at, cfme-appliance 5.10.9.1-1.el7cf, ansible-tower-setup 3.5.2-1.el7at, +12 morefixed: vendor fix RHSA-2019:2587
-
Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-20fixed: vendor fix RHSA-2023:1047
-
Red Hat Enterprise Linux AppStream (v. 8) jss 4.7.3-1.module+el8.3.0+8058+d5cd4219, ipa 4.8.7-12.module+el8.3.0+8222+c1bff54a, ipa 4.8.7-12.module+el8.3.0+8223+6212645f, pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, +99 morefixed: vendor fix RHSA-2020:4847
-
Red Hat Enterprise Linux Client (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, ipa-client-common 4.6.8-5.el7, ipa-python-compat 4.6.8-5.el7, +1 more Red Hat Enterprise Linux Client Optional (v. 7) ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, ipa-server-common 4.6.8-5.el7, python2-ipaserver 4.6.8-5.el7, ipa-server-trust-ad 4.6.8-5.el7 Red Hat Enterprise Linux ComputeNode (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, ipa-client-common 4.6.8-5.el7, ipa-python-compat 4.6.8-5.el7, +1 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, ipa-server-common 4.6.8-5.el7, python2-ipaserver 4.6.8-5.el7, ipa-server-trust-ad 4.6.8-5.el7fixed: vendor fix RHSA-2020:3936
show 18 moreshow fewer
-
Red Hat Enterprise Linux High Availability (v. 8) pcs 0.10.10-4.el8, pcs-snmp 0.10.10-4.el8 Red Hat Enterprise Linux Resilient Storage (v. 8) pcs 0.10.10-4.el8, pcs-snmp 0.10.10-4.el8fixed: vendor fix RHSA-2021:4142
-
Red Hat Enterprise Linux Server (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, +6 morefixed: vendor fix RHSA-2020:3936
-
Red Hat Enterprise Linux Server High Availability (v. 7) pcs 0.9.169-3.el7_9.3, pcs-snmp 0.9.169-3.el7_9.3 Red Hat Enterprise Linux Server Resilient Storage (v. 7) pcs 0.9.169-3.el7_9.3, pcs-snmp 0.9.169-3.el7_9.3fixed: vendor fix RHSA-2022:7343
-
Red Hat Enterprise Linux Workstation (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, +6 morefixed: vendor fix RHSA-2020:3936
-
Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el7eapfixed: vendor fix RHSA-2023:0552
-
Red Hat JBoss EAP 7.4 for RHEL 8 eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el8eapfixed: vendor fix RHSA-2023:0553
-
Red Hat JBoss EAP 7.4 for RHEL 9 eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el9eapfixed: vendor fix RHSA-2023:0554
-
Red Hat JBoss Enterprise Application Platform 7.4.9 hal-console 3.3.16.Final-redhat-00001fixed: vendor fix RHSA-2023:0556
-
Red Hat OpenShift Container Platform 3.11 jenkins 2.204.2.1580891656-1.el7, jenkins-2-plugins 3.11.1579107288-1.el7, prometheus 3.11.170-1.git.1.227bc98.el7, openshift-kuryr 3.11.170-1.git.1.7265da1.el7, atomic-openshift 3.11.170-1.git.0.00cac56.el7, cri-o 1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7, +37 morefixed: vendor fix RHBA-2020:0402
-
Red Hat OpenShift Container Platform 4.5 openshift4/ose-console v4.5.0-202007012112.p0fixed: vendor fix RHSA-2020:2412
-
Red Hat OpenShift Container Platform 4.6 openshift4/ose-prometheus v4.6.0-202009290409.p0fixed: vendor fix RHSA-2020:4298
-
Red Hat OpenStack Platform 13.0 python-XStatic-jQuery 2.2.4.1-3.el7ost Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server python-XStatic-jQuery 2.2.4.1-3.el7ostfixed: vendor fix RHSA-2020:5581
-
Red Hat OpenStack Platform 15.0 python-XStatic-jQuery 3.4.1.0-1.el8ost, python3-XStatic-jQuery 3.4.1.0-1.el8ostfixed: vendor fix RHSA-2020:1325
-
Red Hat Single Sign-On 7fixed: vendor fix RHSA-2023:1049
-
Red Hat Single Sign-On 7.3.2 zipfixed: vendor fix RHSA-2019:1456
-
Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el7ssofixed: vendor fix RHSA-2023:1043
-
Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el8ssofixed: vendor fix RHSA-2023:1044
-
Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el9ssofixed: vendor fix RHSA-2023:1045
1 more fixed, 13 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-22-097-01 updated cvss 6.1
Pepperl+Fuchs WirelessHART-Gateway
-
Pepperl+Fuchs WHA-GW-F2D2-0-AS- Z2-ETH 3.0.7, 3.0.8, 3.0.9 Pepperl+Fuchs WHA-GW-F2D2-0-AS- Z2-ETH.EIP 3.0.7, 3.0.8, 3.0.9affected: mitigation “Minimize network exposure for affected products and ensure they are not accessible via the Internet.” cert.vde.com
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
Timeline
- Published
- First public exploit (EDB-52141)
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
86.82% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | jquery | >=1.1.4, <3.4.0 |
3.4.0 |
| rubygems | jquery-rails | <4.3.4 |
4.3.4 |
| nuget | jQuery | >=1.1.4, <3.4.0 |
3.4.0 |
| pypi | django | >=2.0a1, <2.1.9 >=2.2a1, <2.2.2 |
2.1.9 2.2.2 |
| maven | org.webjars.npm:jquery | >=1.1.4, <3.4.0 |
3.4.0 |
| packagist | maximebf/debugbar | <1.19.0 |
1.19.0 |
| packagist | drupal/core | >=8.0.0, <8.5.15 >=8.6.0, <8.6.15 |
8.5.15 8.6.15 |
Classification
- Weakness
- Technology feeds
References
-
github.com
/jquery/jquery/pull/4333
web, patch, third-party-advisory
-
github.com
/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b
web, patch, third-party-advisory
-
drupal.org
/sa-core-2019-006
patch, third-party-advisory, web
-
seclists.org
/bugtraq/2019/May/18
mailing-list, web, patch, third-party-advisory
-
seclists.org
/fulldisclosure/2019/May/11
mailing-list, patch, third-party-advisory
-
seclists.org
/fulldisclosure/2019/May/13
mailing-list, patch, third-party-advisory
-
openwall.com
/lists/oss-security/2019/06/03/2
mailing-list, patch, third-party-advisory
-
github.com
/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fc
web
-
github.com
/django/django/commit/34ec52269ade54af31a021b12969913129571a3f
web
-
github.com
/django/django/commit/95649bc08547a878cebfa1d019edec8cb1b80829
web
-
github.com
/django/django/commit/baaf187a4e354bf3976c51e2c83a0d2f8ee6e6ad
web
-
oracle.com
/technetwork/security-advisory/cpuoct2019-5072832.html
web, patch, third-party-advisory
-
oracle.com
/technetwork/security-advisory/cpujul2019-5072835.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpuoct2021.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpuoct2020.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpujul2020.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpujan2022.html
web, patch, third-party-advisory
-
oracle.com
//security-alerts/cpujul2021.html
patch, third-party-advisory
-
oracle.com
/security-alerts/cpuApr2021.html
patch, third-party-advisory
-
oracle.com
/security-alerts/cpuapr2020.html
patch, third-party-advisory
-
oracle.com
/security-alerts/cpujan2020.html
patch, third-party-advisory
-
oracle.com
/security-alerts/cpujan2021.html
patch, third-party-advisory
-
privacy-wise.com
/mitigating-cve-2019-11358-in-old-versions-of-jquery/
patch, third-party-advisory
-
snyk.io
/vuln/SNYK-JS-JQUERY-174006
exploit, third-party-advisory
-
debian.org
/security/2019/dsa-4434
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5/
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:1456
vendor-advisory, third-party-advisory
-
debian.org
/security/2019/dsa-4460
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-08/msg00006.html
vendor-advisory, mailing-list, third-party-advisory
-
access.redhat.com
/errata/RHBA-2019:1570
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-08/msg00025.html
vendor-advisory, mailing-list, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:2587
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:3023
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:3024
vendor-advisory, third-party-advisory
-
blog.jquery.com
/2019/04/10/jquery-3-4-0-released/
release-notes, vendor-advisory
-
synology.com
/security/advisory/Synology_SA_19_19
web
-
seclists.org
/bugtraq/2019/Apr/32
mailing-list, web
-
securityfocus.com
/bid/108023
vdb-entry, broken-link, third-party-advisory
-
lists.apache.org
/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc%40%3Ccommits.airflow.apache.org%3E
mailing-list, issue-tracking
-
lists.apache.org
/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205%40%3Ccommits.airflow.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7%40%3Ccommits.airflow.apache.org%3E
mailing-list, issue-tracking
-
lists.apache.org
/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844%40%3Ccommits.airflow.apache.org%3E
mailing-list, issue-tracking
-
lists.apache.org
/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f%40%3Ccommits.airflow.apache.org%3E
mailing-list, issue-tracking
-
lists.debian.org
/debian-lts-announce/2019/05/msg00006.html
mailing-list, web
-
packetstormsecurity.com
/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
third-party-advisory, vdb-entry
-
seclists.org
/fulldisclosure/2019/May/10
mailing-list, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2019/05/msg00029.html
mailing-list, web
-
packetstormsecurity.com
/files/153237/RetireJS-CORS-Issue-Script-Execution.html
third-party-advisory, vdb-entry
-
seclists.org
/bugtraq/2019/Jun/12
mailing-list, web
-
lists.apache.org
/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E
mailing-list
- security.netapp.com /advisory/ntap-20190919-0001/
-
lists.apache.org
/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
mailing-list, issue-tracking
-
nvd.nist.gov
/vuln/detail/CVE-2019-11358
advisory
-
github.com
/maximebf/php-debugbar/issues/447
web
Sources
- CVE List CVE-2019-11358
- GitHub Advisory GHSA-6c3j-c64m-qhgq
- NVD CVE-2019-11358
- OSV PYSEC-2026-628
- OSV DRUPAL-CORE-2019-006
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.