CVE-2019-14862
There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.
- Score
- CVSS 3.1 6.1 Medium
- Status
- Modified - secalert@redhat.com
- Published
- 2020-01-02
- Last modified
- 2024-08-05
- Weaknesses
- CWE-79
Affected products
- Knockout (Knockoutjs)
- Business Intelligence (Oracle)
- Goldengate (Oracle)
- Knockout (Red Hat)
- Decision Manager (Redhat)
- Process Automation (Redhat)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14862
- https://snyk.io/vuln/npm:knockout:20180213
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujul2020.html
