CVE-2020-11022 json
jQuery has a potential XSS vulnerability
published 6y ago modified 7d ago also BIT-drupal-2020-11022 , EUVD-2020-0383 , GHSA-gxr4-xjj5-5px2
- cvss
- 6.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 99.2%
- EPSS 99.2% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 1
- Exploit-DB
Summary
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Patch / fix
- npm jquery 3.5.0
- nuget jquery 3.5.0
- rubygems jquery-rails 4.4.0
- maven org.webjars.npm:jquery 3.5.0
- packagist maximebf/debugbar 1.19.0
- packagist athlon1600/youtube-downloader 4.0.1
- packagist components/jquery 3.5.0
- bitnami drupal 7.70.0, 8.7.14, 8.8.6
- jquery jquery 3.5.0
- drupal drupal 7.70, 8.7.14, 8.8.6
- oracle blockchain_platform 21.1.2
- tenable log_correlation_engine 6.0.9
- znc Debian 14 1.10.3-1
- node-jquery Debian 14, Debian 13, Debian 12 3.5.0+dfsg-2
debian advisories DEBIAN-CVE-2020-11022
- jquery Ubuntu 20.04 LTS 3.3.1~dfsg-3ubuntu0.1
- jquery Ubuntu Pro 16.04 LTS 1.11.3+dfsg-4ubuntu0.1~esm1
- jquery Ubuntu Pro 18.04 LTS 3.2.1-1ubuntu0.1~esm1
- drupal7 Ubuntu Pro 14.04 LTS 7.26-1ubuntu0.1+esm3
- drupal7 Ubuntu Pro 16.04 LTS 7.44-1ubuntu1~16.04.0+esm3
ubuntu advisories UBUNTU-CVE-2020-11022
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- jss RHEL 8 4.7.3-1.module+el8.3.0+8058+d5cd4219
- xsom RHEL 8 0-19.20110809svn.module+el8.1.0+3366+6dfb954c
- slf4j RHEL 8 1.7.25-4.module+el8.1.0+3366+6dfb954c
- pki-ca RHEL 8 10.9.4-1.module+el8.3.0+8058+d5cd4219
- ldapjdk RHEL 8 4.22.0-1.module+el8.3.0+6784+6e1e4c62
- pki-kra RHEL 8 10.9.4-1.module+el8.3.0+8058+d5cd4219
- stax-ex RHEL 8 1.7.7-8.module+el8.2.0+5723+4574fbff
- bea-stax RHEL 8 1.2.0-16.module+el8.1.0+3366+6dfb954c
red hat advisories RHSA-2020:4847RHSA-2020:4670RHSA-2023:1043RHSA-2023:1044RHSA-2023:1045RHSA-2022:6393
- spacecmd Manager Server Module 4.0, Manager Proxy Module 4.0 4.0.20-3.19.2
- hibernate5 Manager Server Module 4.0 5.3.7-4.3.2
- susemanager Manager Server Module 4.0 4.0.28-3.36.3
- spacewalk-web Manager Server Module 4.0, Manager Proxy Module 4.0 4.0.23-3.30.3
- spacewalk-java Manager Server Module 4.0 4.0.37-3.39.1
- openvpn-formula Manager Server Module 4.0 0.1.1-4.6.2
- spacewalk-admin Manager Server Module 4.0 4.0.11-3.12.1
- spacewalk-proxy Manager Proxy Module 4.0 4.0.14-3.10.3
suse advisories SUSE-SU-2020:2650-1SUSE-SU-2020:2373-1SUSE-SU-2020:2292-1
- znc openSUSE Tumbleweed 1.10.3-1.1
- syncthing openSUSE Tumbleweed 2.1.0-1.1
- cacti openSUSE Tumbleweed 1.2.18-1.2
- otrs Package Hub 15 SP2, Package Hub 15 SP1, openSUSE Leap 15.2 +1 more 6.0.30-bp152.2.11.1
- cacti-spine Package Hub 15 SP1 1.2.13-bp151.4.12.1
- cacti Package Hub 15 SP1 1.2.13-bp151.4.12.1
- cacti-spine Package Hub 12, openSUSE Leap 15.2, openSUSE Leap 15.1 1.2.13-8.1
- cacti Package Hub 12, openSUSE Leap 15.2, openSUSE Leap 15.1 1.2.13-11.1
opensuse advisories openSUSE-SU-2026:11782-1openSUSE-SU-2026:10764-1openSUSE-SU-2024:10670-1openSUSE-SU-2020:1888-1openSUSE-SU-2020:1106-1openSUSE-SU-2020:1060-1
- custodia AlmaLinux 8 0.6.0-3.module_el8.6.0+2881+2f24dc92
- python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.5.0+2641+983b221b
- python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.6.0+2881+2f24dc92
- python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.6.0+2737+7e73ea90
- python3-qrcode AlmaLinux 8 5.1-12.module_el8.6.0+2881+2f24dc92
- python3-qrcode AlmaLinux 8 5.1-12.module_el8.5.0+2641+983b221b
- python3-qrcode AlmaLinux 8 5.1-12.module_el8.6.0+2737+7e73ea90
- python3-yubico AlmaLinux 8 1.3.2-9.module_el8.5.0+2641+983b221b
almalinux advisories ALSA-2020:4670
- xsom Rocky Linux 8 0-19.20110809svn.module+el8.3.0+53+ea062990
- slf4j Rocky Linux 8 1.7.25-4.module+el8.5.0+697+f586bb30
- slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+74+855e3f5d
- slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+133+b8b54b58
- ldapjdk Rocky Linux 8 4.22.0-1.module+el8.4.0+418+b7ae1d4a
- stax-ex Rocky Linux 8 1.7.7-8.module+el8.3.0+53+ea062990
- bea-stax Rocky Linux 8 1.2.0-16.module+el8.3.0+53+ea062990
- resteasy Rocky Linux 8 3.0.26-3.module+el8.3.0+53+ea062990
rocky linux advisories RLSA-2020:4847RLSA-2020:4670
- cacti Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 1.2.13-r0
- drupal7 Alpine 3.20, Alpine 3.19, Alpine 3.18 +7 more 7.70-r0
alpine advisories ALPINE-CVE-2020-11022
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- github.com/jquery/jquery@1d61fd9 commit
- github.com/maximebf/php-debugbar@847216e commit
- github.com/jquery/jquery/releases/tag/3.5.0 release
- github.com/Athlon1600/youtube-downloader/releases/tag/v4.0.1 release
- oracle.com/security-alerts/cpuApr2021.html advisory
- oracle.com/security-alerts/cpuapr2022.html advisory
- oracle.com/security-alerts/cpujan2022.html advisory
- oracle.com/security-alerts/cpuoct2021.html advisory
- oracle.com//security-alerts/cpujul2021.html advisory
Is CVE-2020-11022 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2020-11022 updated cvss 0.0
jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
-
Red Hat CloudForms Management Engine 5 cfme-gemsetaffected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux 6 ipa, pcp, pcs, pcp-gui, pcp-conf, pcp-libs, +81 more Red Hat Enterprise Linux 7 pki-ca, cockpit, ipsilon, pki-kra, pki-base, pki-core, +21 moreaffected: no fix planned “Out of support scope”
-
Red Hat Fuse 7 jquery Red Hat OpenShift Container Platform 3.11 openshift3/grafanaaffected: no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform 4 rhel8/grafanaaffected: no fix available
-
Red Hat Satellite 5 jquery-ui, patternfly1 Red Hat Software Collections python27-python-coverage, python27-python-werkzeug, rh-ror42-rubygem-jquery-rails, rh-ror50-rubygem-jquery-railsaffected: no fix planned “Out of support scope”
-
Red Hat Storage 3 pcs, python-testtoolsaffected: no fix planned “Will not fix”
-
Red Hat Virtualization 4 ovirt-js-dependencies, ovirt-engine-api-exploreraffected: no fix available, no fix planned “Out of support scope”
-
Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-20fixed: vendor fix RHSA-2023:1047
show 21 moreshow fewer
-
Red Hat OpenShift Service Mesh 1.0 servicemesh-grafana 6.2.2-36.el8, servicemesh-grafana-prometheus 6.2.2-36.el8fixed: vendor fix RHSA-2020:2362
-
Red Hat AMQ Interconnect 1 qpid-dispatch 1.13.0-3.el7, qpid-dispatch 1.13.0-3.el8, qpid-dispatch 1.13.0-3.el6_10, qpid-dispatch-tools 1.13.0-3.el7, qpid-dispatch-tools 1.13.0-3.el8, qpid-dispatch-router 1.13.0-3.el7, +6 morefixed: vendor fix RHSA-2020:4211
-
Red Hat Ansible Tower 3.6 for RHEL 7 ansible-tower-36/ansible-tower 3.6.7-1fixed: vendor fix RHSA-2021:0778
-
Red Hat Ansible Tower 3.7 for RHEL 7 ansible-tower-37/ansible-tower-rhel7 3.7.4-1fixed: vendor fix RHSA-2020:5249
-
Red Hat Enterprise Linux AppStream (v. 8) jss 4.7.3-1.module+el8.3.0+8058+d5cd4219, ipa 4.8.7-12.module+el8.3.0+8222+c1bff54a, ipa 4.8.7-12.module+el8.3.0+8223+6212645f, pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, +99 morefixed: vendor fix RHSA-2020:4847
-
Red Hat Enterprise Linux Client (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, ipa-client-common 4.6.8-5.el7, ipa-python-compat 4.6.8-5.el7, +1 more Red Hat Enterprise Linux Client Optional (v. 7) ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, ipa-server-common 4.6.8-5.el7, python2-ipaserver 4.6.8-5.el7, ipa-server-trust-ad 4.6.8-5.el7 Red Hat Enterprise Linux ComputeNode (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, ipa-client-common 4.6.8-5.el7, ipa-python-compat 4.6.8-5.el7, +1 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, ipa-server-common 4.6.8-5.el7, python2-ipaserver 4.6.8-5.el7, ipa-server-trust-ad 4.6.8-5.el7 Red Hat Enterprise Linux Server (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, +6 more Red Hat Enterprise Linux Workstation (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, +6 morefixed: vendor fix RHSA-2020:3936
-
Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el7eapfixed: vendor fix RHSA-2023:0552
-
Red Hat JBoss EAP 7.4 for RHEL 8 eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el8eapfixed: vendor fix RHSA-2023:0553
-
Red Hat JBoss EAP 7.4 for RHEL 9 eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el9eapfixed: vendor fix RHSA-2023:0554
-
Red Hat JBoss Enterprise Application Platform 7.4.9 hal-console 3.3.16.Final-redhat-00001fixed: vendor fix RHSA-2023:0556
-
Red Hat OpenShift Container Platform 3.11 atomic-openshift-web-console 3.11.219-1.git.1.9b9b889.el7fixed: vendor fix RHSA-2020:2217
-
Red Hat OpenShift Container Platform 4.5 openshift4/ose-console v4.5.0-202007012112.p0fixed: vendor fix RHSA-2020:2412
-
Red Hat OpenShift Container Platform 4.6 openshift4/ose-grafana v4.6.0-202010061132.p0, openshift4/ose-prometheus v4.6.0-202009290409.p0fixed: vendor fix RHSA-2020:4298
-
Red Hat OpenShift Service Mesh 1.0 kiali v1.0.11.redhat1-1.el7, jaeger v1.13.1.redhat7-1.el7fixed: vendor fix RHSA-2020:2362
-
Red Hat Single Sign-On 7fixed: vendor fix RHSA-2023:1049
-
Red Hat Single Sign-On 7.4.1fixed: vendor fix RHSA-2020:2813
-
Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el7ssofixed: vendor fix RHSA-2023:1043
-
Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el8ssofixed: vendor fix RHSA-2023:1044
-
Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el9ssofixed: vendor fix RHSA-2023:1045
-
Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 rhvm 4.5.2.4-0.1.el8ev, ovirt-web-ui 1.6.4-1.el8ev, ovirt-engine 4.5.2.4-0.1.el8ev, ovirt-engine-setup 4.5.2.4-0.1.el8ev, ovirt-engine-tools 4.5.2.4-0.1.el8ev, ovirt-engine-backend 4.5.2.4-0.1.el8ev, +16 morefixed: vendor fix RHSA-2022:6393
-
Red Hat Enterprise Linux 7 pcp, pcs, pcp-gui, pcp-conf, pcp-libs, pcs-snmp, +95 more Red Hat Enterprise Linux 8 pcs, cockpit, pcs-snmp, cockpit-ws, cockpit-bridge, cockpit-system Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jettison 1.5.2-1.redhat_00002.1.el7eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el7eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el7eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el7eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el7eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el7eap, +42 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jettison 1.5.2-1.redhat_00002.1.el8eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el8eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el8eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el8eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el8eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el8eap, +40 morenot affected: vulnerable code not present
12 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-25-182-07 updated cvss 6.1
Hitachi Energy MSM
-
Hitachi Energy MSM <=2.2.9affected: mitigation
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-22-342-02 updated cvss 6.1
AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere
-
AVEVA Software, LLC InTouch Access Anywhere <= 2023 AVEVA Software, LLC Plant SCADA Access Anywhere <= 2020 R2affected: mitigation “InTouch Access Anywhere Secure Gateway 2020 R2 (version 20.1.0) Hotfix.”
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
cisa ICSA-22-097-01 updated cvss 6.1
Pepperl+Fuchs WirelessHART-Gateway
-
Pepperl+Fuchs WHA-GW-F2D2-0-AS- Z2-ETH 3.0.7, 3.0.8, 3.0.9 Pepperl+Fuchs WHA-GW-F2D2-0-AS- Z2-ETH.EIP 3.0.7, 3.0.8, 3.0.9affected: mitigation “Minimize network exposure for affected products and ensure they are not accessible via the Internet.” cert.vde.com
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
Timeline
- Published
- First public exploit (EDB-49766)
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7d ago
Exploit prediction
99.22% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-49766 jQuery 1.2 - Cross-Site Scripting (XSS) webapps, 2021-04-14
- packetstormsecurity.com http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N |
| GitHub | 3.1 | 6.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | jquery | >=1.12.0, <3.5.0 |
3.5.0 |
| nuget | jquery | >=1.12.0, <3.5.0 |
3.5.0 |
| rubygems | jquery-rails | <4.4.0 |
4.4.0 |
| maven | org.webjars.npm:jquery | >=1.12.0, <3.5.0 |
3.5.0 |
| packagist | maximebf/debugbar | <1.19.0 |
1.19.0 |
| packagist | athlon1600/youtube-downloader | <4.0.1 |
4.0.1 |
| packagist | components/jquery | >=1.12.0, <3.5.0 |
3.5.0 |
| bitnami | drupal | >=7.0.0, <7.70.0 >=8.7.0, <8.7.14 >=8.8.0, <8.8.6 |
7.70.0 8.7.14 8.8.6 |
Affected products
- jquery jQuery
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77
web, patch, third-party-advisory, advisory
-
github.com
/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fc
web
-
oracle.com
/security-alerts/cpuApr2021.html
web, patch, third-party-advisory, advisory
-
oracle.com
/security-alerts/cpuapr2022.html
web, patch, third-party-advisory, advisory
-
oracle.com
/security-alerts/cpujan2022.html
web, patch, third-party-advisory, advisory
-
oracle.com
/security-alerts/cpuoct2021.html
web, patch, third-party-advisory, advisory
-
oracle.com
//security-alerts/cpujul2021.html
web, patch, third-party-advisory, advisory
-
packetstormsecurity.com
/files/162159/jQuery-1.2-Cross-Site-Scripting.html
exploit, third-party-advisory, vdb-entry, advisory
-
security.gentoo.org
/glsa/202007-03
vendor-advisory, web, third-party-advisory, advisory
-
debian.org
/security/2020/dsa-4693
vendor-advisory, web, advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/
vendor-advisory, web
-
lists.opensuse.org
/opensuse-security-announce/2020-07/msg00067.html
vendor-advisory, web
-
lists.opensuse.org
/opensuse-security-announce/2020-07/msg00085.html
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/
vendor-advisory, web
-
lists.opensuse.org
/opensuse-security-announce/2020-11/msg00039.html
vendor-advisory, web
-
blog.jquery.com
/2020/04/10/jquery-3-5-0-released/
release-notes, vendor-advisory, advisory
-
jquery.com
/upgrade-guide/3.5/
mitigation, vendor-advisory, advisory
-
github.com
/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
web, mitigation, third-party-advisory, advisory
-
github.com
/maximebf/php-debugbar/issues/447
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W
web
-
lists.opensuse.org
/opensuse-security-announce/2020-07/msg00067.html
web
-
lists.opensuse.org
/opensuse-security-announce/2020-07/msg00085.html
web
-
lists.opensuse.org
/opensuse-security-announce/2020-11/msg00039.html
web
-
packetstormsecurity.com
/files/162159/jQuery-1.2-Cross-Site-Scripting.html
web
-
drupal.org
/sa-core-2020-002
web, advisory
-
oracle.com
/security-alerts/cpujan2021.html
web, advisory
-
oracle.com
/security-alerts/cpujul2020.html
web, advisory
- oracle.com /security-alerts/cpujul2021.html
-
oracle.com
/security-alerts/cpujul2022.html
web
-
oracle.com
/security-alerts/cpuoct2020.html
web, advisory
-
tenable.com
/security/tns-2020-10
web
-
tenable.com
/security/tns-2020-11
web
-
tenable.com
/security/tns-2021-02
web
-
tenable.com
/security/tns-2021-10
web
-
blog.jquery.com
/2020/04/10/jquery-3-5-0-released
web
-
github.com
/jquery/jquery/releases/tag/3.5.0
web
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-11022.yml
web
-
jquery.com
/upgrade-guide/3.5
web
-
lists.apache.org
/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36@%3Cissues.flink.apache.org%3E
web
-
lists.apache.org
/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48@%3Cissues.flink.apache.org%3E
web
-
lists.apache.org
/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae@%3Cissues.flink.apache.org%3E
web
-
nvd.nist.gov
/vuln/detail/CVE-2020-11022
advisory
-
github.com
/Athlon1600/youtube-downloader/releases/tag/v4.0.1
web
-
github.com
/jquery/jquery
package
-
lists.apache.org
/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760@%3Cissues.flink.apache.org%3E
web
-
lists.apache.org
/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d@%3Cissues.flink.apache.org%3E
web
-
lists.apache.org
/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c@%3Cissues.flink.apache.org%3E
web
-
lists.apache.org
/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67@%3Cdev.flink.apache.org%3E
web
-
lists.apache.org
/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133@%3Ccommits.airflow.apache.org%3E
web
- security.netapp.com /advisory/ntap-20200511-0006
- lists.apache.org /thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108@%3Cissues.flink.apache.org%3E
- lists.apache.org /thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4@%3Cissues.flink.apache.org%3E
- lists.apache.org /thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2@%3Cissues.flink.apache.org%3E
-
lists.debian.org
/debian-lts-announce/2021/03/msg00033.html
mailing-list, third-party-advisory, advisory
-
lists.debian.org
/debian-lts-announce/2023/08/msg00040.html
web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K
Sources
- CVE List CVE-2020-11022
- GitHub Advisory GHSA-gxr4-xjj5-5px2
- NVD CVE-2020-11022
- OSV BIT-drupal-2020-11022
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.