CVE Feed

    Dashboard / CVE / CVE-2019-11358

    CVE-2019-11358

    jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

    Published:Mar 27, 2019
    Last Modified:Nov 21, 2024
    EPS:Apr 19, 2019
    EPSS Score:0.05394
    CVSS Score:6.1

    Affected Products

    Vendor
    Backdropcms
    Product
    Backdrop
    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    Drupal
    Product
    Drupal
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Joomla
    Product
    Joomla\!
    Vendor
    Jquery
    Product
    Jquery
    Vendor
    Juniper
    Product
    Junos
    Vendor
    Netapp
    Product
    Oncommand System Manager
    Vendor
    Netapp
    Product
    Snapcenter
    Vendor
    Opensuse
    Product
    Backports Sle
    Vendor
    Opensuse
    Product
    Leap
    Vendor
    Oracle
    Product
    Agile Product Lifecycle Management For Process
    Vendor
    Oracle
    Product
    Application Express
    Vendor
    Oracle
    Product
    Application Service Level Management
    Vendor
    Oracle
    Product
    Application Testing Suite
    Vendor
    Oracle
    Product
    Banking Digital Experience
    Vendor
    Oracle
    Product
    Banking Enterprise Collections
    Vendor
    Oracle
    Product
    Banking Platform
    Vendor
    Oracle
    Product
    Bi Publisher
    Vendor
    Oracle
    Product
    Big Data Discovery
    Vendor
    Oracle
    Product
    Business Process Management Suite
    Vendor
    Oracle
    Product
    Communications Analytics
    Vendor
    Oracle
    Product
    Communications Application Session Controller
    Vendor
    Oracle
    Product
    Communications Billing And Revenue Management
    Vendor
    Oracle
    Product
    Communications Diameter Signaling Router
    Vendor
    Oracle
    Product
    Communications Eagle Application Processor
    Vendor
    Oracle
    Product
    Communications Element Manager
    Vendor
    Oracle
    Product
    Communications Interactive Session Recorder
    Vendor
    Oracle
    Product
    Communications Operations Monitor
    Vendor
    Oracle
    Product
    Communications Services Gatekeeper
    Vendor
    Oracle
    Product
    Communications Session Report Manager
    Vendor
    Oracle
    Product
    Communications Session Route Manager
    Vendor
    Oracle
    Product
    Communications Unified Inventory Management
    Vendor
    Oracle
    Product
    Communications Webrtc Session Controller
    Vendor
    Oracle
    Product
    Diagnostic Assistant
    Vendor
    Oracle
    Product
    Enterprise Manager Ops Center
    Vendor
    Oracle
    Product
    Enterprise Session Border Controller
    Vendor
    Oracle
    Product
    Financial Services Analytical Applications Infrastructure
    Vendor
    Oracle
    Product
    Financial Services Analytical Applications Reconciliation Framework
    Vendor
    Oracle
    Product
    Financial Services Asset Liability Management
    Vendor
    Oracle
    Product
    Financial Services Balance Sheet Planning
    Vendor
    Oracle
    Product
    Financial Services Basel Regulatory Capital Basic
    Vendor
    Oracle
    Product
    Financial Services Basel Regulatory Capital Internal Ratings Based Approach
    Vendor
    Oracle
    Product
    Financial Services Data Foundation
    Vendor
    Oracle
    Product
    Financial Services Data Governance For Us Regulatory Reporting
    Vendor
    Oracle
    Product
    Financial Services Data Integration Hub
    Vendor
    Oracle
    Product
    Financial Services Enterprise Financial Performance Analytics
    Vendor
    Oracle
    Product
    Financial Services Funds Transfer Pricing
    Vendor
    Oracle
    Product
    Financial Services Hedge Management And Ifrs Valuations
    Vendor
    Oracle
    Product
    Financial Services Institutional Performance Analytics
    Vendor
    Oracle
    Product
    Financial Services Liquidity Risk Management
    Vendor
    Oracle
    Product
    Financial Services Liquidity Risk Measurement And Management
    Vendor
    Oracle
    Product
    Financial Services Loan Loss Forecasting And Provisioning
    Vendor
    Oracle
    Product
    Financial Services Market Risk Measurement And Management
    Vendor
    Oracle
    Product
    Financial Services Price Creation And Discovery
    Vendor
    Oracle
    Product
    Financial Services Profitability Management
    Vendor
    Oracle
    Product
    Financial Services Regulatory Reporting For De Nederlandsche Bank
    Vendor
    Oracle
    Product
    Financial Services Regulatory Reporting For European Banking Authority
    Vendor
    Oracle
    Product
    Financial Services Regulatory Reporting For Us Federal Reserve
    Vendor
    Oracle
    Product
    Financial Services Retail Customer Analytics
    Vendor
    Oracle
    Product
    Financial Services Retail Performance Analytics
    Vendor
    Oracle
    Product
    Financial Services Revenue Management And Billing
    Vendor
    Oracle
    Product
    Fusion Middleware Mapviewer
    Vendor
    Oracle
    Product
    Healthcare Foundation
    Vendor
    Oracle
    Product
    Healthcare Translational Research
    Vendor
    Oracle
    Product
    Hospitality Guest Access
    Vendor
    Oracle
    Product
    Hospitality Materials Control
    Vendor
    Oracle
    Product
    Hospitality Simphony
    Vendor
    Oracle
    Product
    Identity Manager
    Vendor
    Oracle
    Product
    Insurance Accounting Analyzer
    Vendor
    Oracle
    Product
    Insurance Allocation Manager For Enterprise Profitability
    Vendor
    Oracle
    Product
    Insurance Data Foundation
    Vendor
    Oracle
    Product
    Insurance Ifrs 17 Analyzer
    Vendor
    Oracle
    Product
    Insurance Insbridge Rating And Underwriting
    Vendor
    Oracle
    Product
    Insurance Performance Insight
    Vendor
    Oracle
    Product
    Jd Edwards Enterpriseone Tools
    Vendor
    Oracle
    Product
    Jdeveloper
    Vendor
    Oracle
    Product
    Jdeveloper And Adf
    Vendor
    Oracle
    Product
    Knowledge
    Vendor
    Oracle
    Product
    Peoplesoft Enterprise Peopletools
    Vendor
    Oracle
    Product
    Policy Automation
    Vendor
    Oracle
    Product
    Policy Automation Connector For Siebel
    Vendor
    Oracle
    Product
    Policy Automation For Mobile Devices
    Vendor
    Oracle
    Product
    Primavera Gateway
    Vendor
    Oracle
    Product
    Primavera Unifier
    Vendor
    Oracle
    Product
    Real-time Scheduler
    Vendor
    Oracle
    Product
    Rest Data Services
    Vendor
    Oracle
    Product
    Retail Back Office
    Vendor
    Oracle
    Product
    Retail Central Office
    Vendor
    Oracle
    Product
    Retail Customer Insights
    Vendor
    Oracle
    Product
    Retail Customer Management And Segmentation Foundation
    Vendor
    Oracle
    Product
    Retail Point-of-service
    Vendor
    Oracle
    Product
    Retail Returns Management
    Vendor
    Oracle
    Product
    Service Bus
    Vendor
    Oracle
    Product
    Siebel Mobile Applications
    Vendor
    Oracle
    Product
    Siebel Ui Framework
    Vendor
    Oracle
    Product
    Storagetek Tape Analytics Sw Tool
    Vendor
    Oracle
    Product
    System Utilities
    Vendor
    Oracle
    Product
    Tape Library Acsls
    Vendor
    Oracle
    Product
    Transportation Management
    Vendor
    Oracle
    Product
    Utilities Mobile Workforce Management
    Vendor
    Oracle
    Product
    Webcenter Sites
    Vendor
    Oracle
    Product
    Weblogic Server
    Vendor
    Redhat
    Product
    Cloudforms
    Vendor
    Redhat
    Product
    Cloudforms Managementengine
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform
    Vendor
    Redhat
    Product
    Jboss Single Sign On
    Vendor
    Redhat
    Product
    Openshift
    Vendor
    Redhat
    Product
    Openstack
    Vendor
    Redhat
    Product
    Red Hat Single Sign On
    Vendor
    Redhat
    Product
    Rhev Manager
    Vendor
    Redhat
    Product
    Rhosemc
    Vendor
    Redhat
    Product
    Virtualization Manager

    Exploits

    https://snyk.io/vuln/SNYK-JS-JQUERY-174006https://snyk.io/vuln/SNYK-JS-JQUERY-174006https://www.exploit-db.com/exploits/52141https://github.com/bitnesswise/jquery-prototype-pollution-fixhttps://github.com/chrisneagu/FTC-Skystone-Dark-Angels-Romania-2020https://github.com/DanielRuf/snyk-js-jquery-174006https://github.com/DanielRuf/snyk-js-jquery-565129https://github.com/isacaya/CVE-2019-11358https://github.com/Snorlyd/https-nj.gov---CVE-2019-11358

    Related CVEs

    CVE-2025-25063 (CVSS 4.4) — An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not suffici…
    CVE-2024-41709 (CVSS 4.8) — Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they ar…
    CVE-2022-42094 (CVSS 4.8) — Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via th…
    CVE-2022-42097 (CVSS 4.8) — Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'C…
    CVE-2022-24590 (CVSS 5.4) — A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attac…
    CVE-2021-45268 (CVSS 8.8) — A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers t…
    CVE-2019-14769 (CVSS 6.1) — Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying …

    References

    http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
    http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
    http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
    http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
    http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
    http://seclists.org/fulldisclosure/2019/May/10
    http://seclists.org/fulldisclosure/2019/May/11
    http://seclists.org/fulldisclosure/2019/May/13
    http://www.openwall.com/lists/oss-security/2019/06/03/2
    http://www.securityfocus.com/bid/108023
    https://access.redhat.com/errata/RHBA-2019:1570
    https://access.redhat.com/errata/RHSA-2019:1456
    https://access.redhat.com/errata/RHSA-2019:2587
    https://access.redhat.com/errata/RHSA-2019:3023
    https://access.redhat.com/errata/RHSA-2019:3024
    https://backdropcms.org/security/backdrop-sa-core-2019-009
    https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
    https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b
    https://github.com/jquery/jquery/pull/4333
    https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
    https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E
    https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
    https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
    https://lists.apache.org/thread.html/r2041a75d3fc09dec55adfd95d598b38d22715303f65c997c054844c9%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r2baacab6e0acb5a2092eb46ae04fd6c3e8277b4fd79b1ffb7f3254fa%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r38f0d1aa3c923c22977fe7376508f030f22e22c1379fbb155bf29766%40%3Cdev.syncope.apache.org%3E
    https://lists.apache.org/thread.html/r41b5bfe009c845f67d4f68948cc9419ac2d62e287804aafd72892b08%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r7aac081cbddb6baa24b75e74abf0929bf309b176755a53e3ed810355%40%3Cdev.flink.apache.org%3E
    https://lists.apache.org/thread.html/r7d64895cc4dff84d0becfc572b20c0e4bf9bfa7b10c6f5f73e783734%40%3Cdev.storm.apache.org%3E
    https://lists.apache.org/thread.html/r7e8ebccb7c022e41295f6fdb7b971209b83702339f872ddd8cf8bf73%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
    https://lists.debian.org/debian-lts-announce/2019/05/msg00006.html
    https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html
    https://lists.debian.org/debian-lts-announce/2020/02/msg00024.html
    https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5/
    https://seclists.org/bugtraq/2019/Apr/32
    https://seclists.org/bugtraq/2019/Jun/12
    https://seclists.org/bugtraq/2019/May/18
    https://security.netapp.com/advisory/ntap-20190919-0001/
    https://snyk.io/vuln/SNYK-JS-JQUERY-174006
    https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1
    https://www.debian.org/security/2019/dsa-4434
    https://www.debian.org/security/2019/dsa-4460
    https://www.drupal.org/sa-core-2019-006
    https://www.oracle.com//security-alerts/cpujul2021.html
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpuapr2020.html
    https://www.oracle.com/security-alerts/cpujan2020.html
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpujan2022.html
    https://www.oracle.com/security-alerts/cpujul2020.html
    https://www.oracle.com/security-alerts/cpuoct2020.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
    https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
    https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/
    https://www.synology.com/security/advisory/Synology_SA_19_19
    https://www.tenable.com/security/tns-2019-08
    https://www.tenable.com/security/tns-2020-02
    http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
    http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
    http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
    http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
    http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
    http://seclists.org/fulldisclosure/2019/May/10
    http://seclists.org/fulldisclosure/2019/May/11
    http://seclists.org/fulldisclosure/2019/May/13
    http://www.openwall.com/lists/oss-security/2019/06/03/2
    http://www.securityfocus.com/bid/108023
    https://access.redhat.com/errata/RHBA-2019:1570
    https://access.redhat.com/errata/RHSA-2019:1456
    https://access.redhat.com/errata/RHSA-2019:2587
    https://access.redhat.com/errata/RHSA-2019:3023
    https://access.redhat.com/errata/RHSA-2019:3024
    https://backdropcms.org/security/backdrop-sa-core-2019-009
    https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
    https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b
    https://github.com/jquery/jquery/pull/4333
    https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
    https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E
    https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
    https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
    https://lists.apache.org/thread.html/r2041a75d3fc09dec55adfd95d598b38d22715303f65c997c054844c9%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r2baacab6e0acb5a2092eb46ae04fd6c3e8277b4fd79b1ffb7f3254fa%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r38f0d1aa3c923c22977fe7376508f030f22e22c1379fbb155bf29766%40%3Cdev.syncope.apache.org%3E
    https://lists.apache.org/thread.html/r41b5bfe009c845f67d4f68948cc9419ac2d62e287804aafd72892b08%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r7aac081cbddb6baa24b75e74abf0929bf309b176755a53e3ed810355%40%3Cdev.flink.apache.org%3E
    https://lists.apache.org/thread.html/r7d64895cc4dff84d0becfc572b20c0e4bf9bfa7b10c6f5f73e783734%40%3Cdev.storm.apache.org%3E
    https://lists.apache.org/thread.html/r7e8ebccb7c022e41295f6fdb7b971209b83702339f872ddd8cf8bf73%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
    https://lists.debian.org/debian-lts-announce/2019/05/msg00006.html
    https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html
    https://lists.debian.org/debian-lts-announce/2020/02/msg00024.html
    https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5/
    https://seclists.org/bugtraq/2019/Apr/32
    https://seclists.org/bugtraq/2019/Jun/12
    https://seclists.org/bugtraq/2019/May/18
    https://security.netapp.com/advisory/ntap-20190919-0001/
    https://snyk.io/vuln/SNYK-JS-JQUERY-174006
    https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1
    https://www.debian.org/security/2019/dsa-4434
    https://www.debian.org/security/2019/dsa-4460
    https://www.drupal.org/sa-core-2019-006
    https://www.oracle.com//security-alerts/cpujul2021.html
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpuapr2020.html
    https://www.oracle.com/security-alerts/cpujan2020.html
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpujan2022.html
    https://www.oracle.com/security-alerts/cpujul2020.html
    https://www.oracle.com/security-alerts/cpuoct2020.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
    https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
    https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/
    https://www.synology.com/security/advisory/Synology_SA_19_19
    https://www.tenable.com/security/tns-2019-08
    https://www.tenable.com/security/tns-2020-02

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High