jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-pyusbUpgrade python3-kdcproxyUpgrade python3-qrcodeUpgrade python3-qrcode-coreUpgrade python3-jwcryptoUpgrade custodiaUpgrade python3-yubicoUpgrade python3-custodia | May 4, 2022 | Apr 20, 2019 |
| Alpine Linux | — | Upgrade rabbitmq-serverUpgrade drupal7 | Jun 21, 2019 | Apr 19, 2019 |
| Amazon Linux Ami 2 | — | Upgrade ipa-python-compatUpgrade ipa-server-commonUpgrade python2-ipaclientUpgrade python2-ipaserverUpgrade ipa-server-trust-adUpgrade python2-ipalibUpgrade ipa-debuginfoUpgrade pcs-snmpUpgrade pcs-debuginfoUpgrade ipa-server-dnsUpgrade ipa-serverUpgrade ipa-commonUpgrade ipa-clientUpgrade ipa-client-commonUpgrade pcs | Oct 28, 2020 | Apr 20, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 19, 2019 |
| Centos_linux | — | Upgrade python3-nssUpgrade jackson-databindUpgrade pki-baseUpgrade jssUpgrade custodiaUpgrade ipa-server-trust-adUpgrade python3-custodiaUpgrade ipa-healthcheck-coreUpgrade ipa-client-epnUpgrade bind-dyndb-ldapUpgrade pcs-snmpUpgrade python3-pkiUpgrade pki-symkey-debuginfoUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade softhsm-develUpgrade xml-commons-apisUpgrade ipa-commonUpgrade bind-dyndb-ldap-debuginfoUpgrade xalan-j2Upgrade jackson-jaxrs-json-providerUpgrade slapi-nis-debugsourceUpgrade ldapjdk-javadocUpgrade python3-jwcryptoUpgrade ipa-healthcheckUpgrade ipa-serverUpgrade jss-javadocUpgrade ipa-selinuxUpgrade jackson-coreUpgrade pki-caUpgrade jackson-annotationsUpgrade stax-exUpgrade ipa-server-trust-ad-debuginfoUpgrade tomcatjssUpgrade slapi-nis-debuginfoUpgrade python2-ipaserverUpgrade ipa-client-sambaUpgrade python3-yubicoUpgrade jss-debugsourceUpgrade pki-kraUpgrade jackson-module-jaxb-annotationsUpgrade velocityUpgrade ipa-clientUpgrade pki-serverUpgrade pki-base-javaUpgrade python3-ipaserverUpgrade python3-ipaclientUpgrade python3-nss-debuginfoUpgrade pki-toolsUpgrade resteasyUpgrade softhsm-debuginfoUpgrade python-nss-debugsourceUpgrade slf4jUpgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade xsomUpgrade apache-commons-langUpgrade bind-dyndb-ldap-debugsourceUpgrade pki-servlet-engineUpgrade pcs-debuginfoUpgrade python3-ipalibUpgrade python-nss-docUpgrade python3-kdcproxyUpgrade slapi-nisUpgrade ldapjdkUpgrade pcsUpgrade javassistUpgrade ipa-client-commonUpgrade xerces-j2Upgrade ipa-server-dnsUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-txw2Upgrade pki-symkeyUpgrade ipa-client-debuginfoUpgrade javassist-javadocUpgrade ipa-server-commonUpgrade ipa-python-compatUpgrade python3-qrcodeUpgrade ipa-server-debuginfoUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-runtimeUpgrade python3-pyusbUpgrade jss-debuginfoUpgrade python3-qrcode-coreUpgrade opendnssec-debuginfoUpgrade python2-ipaclientUpgrade xml-commons-resolverUpgrade ipa-debuginfoUpgrade opendnssecUpgrade opendnssec-debugsourceUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-apiUpgrade apache-commons-netUpgrade bea-stax-apiUpgrade python2-ipalibUpgrade xmlstreambufferUpgrade ipa-debugsourceUpgrade pki-core-debugsourceUpgrade softhsmUpgrade glassfish-jaxb-coreUpgrade softhsm-debugsourceUpgrade pki-core-debuginfoUpgrade pki-servlet-4.0-api | Oct 1, 2020 | Apr 20, 2019 |
| Debian | — | Upgrade otrs2Upgrade node-jqueryUpgrade mediawiki | Apr 22, 2019 | Apr 19, 2019 |
| Drupal | — | Upgrade to drupal version 8.6.1Upgrade to drupal version 7.66Upgrade to drupal version 8.5.1 | Apr 23, 2019 | Apr 19, 2019 |
| Freebsd | — | Upgrade py35-django21Upgrade py35-django22Upgrade py37-django22Upgrade py27-django111Upgrade mediawiki132Upgrade py37-django21Upgrade py37-django111Upgrade py35-django111Upgrade py36-django22Upgrade py36-django111Upgrade py36-django21Upgrade mediawiki131 | Jul 5, 2019 | Jul 5, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-kraUpgrade pki-toolsUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-ca | Feb 22, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-baseUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-symkeyUpgrade pki-caUpgrade pki-toolsUpgrade pki-kra | Apr 30, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-symkeyUpgrade pki-caUpgrade pki-toolsUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-kraUpgrade pki-base | Dec 16, 2020 | Apr 20, 2019 |
| Jquery | — | Upgrade jQuery to version 3.4.0 | Apr 24, 2019 | Apr 20, 2019 |
| Oracle Solaris | — | Upgrade library/python-2/django-27 to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4Upgrade network/amqp/rabbitmq to version 3.8.3-11.4.24.0.1.75.1 on Solaris 11.4Upgrade library/python/django-37 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python/django-34 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python-2/django-26 to version 1.4.22-11.4.0.0.0.13.0 on Solaris 11.4Upgrade consolidation/osnet/osnet-incorporation to version 11.4-11.4.24.0.1.75.3 on Solaris 11.4Upgrade library/python/django-27 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python/django-26 to version 1.4.22-11.4.0.0.1.9.0 on Solaris 11.4Upgrade legacy/library/python/django-35 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade legacy/library/python/django-34 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade legacy/library/python/django-27 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-35 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python/django to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python-2/django to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4 | Oct 16, 2019 | Apr 20, 2019 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 30386660 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 30108725 for version 12.1.3.0.0. | Oct 17, 2019 | Apr 20, 2019 |
| Oracle_linux | — | Upgrade pki-kraUpgrade pki-symkeyUpgrade jackson-databindUpgrade python3-kdcproxyUpgrade xerces-j2Upgrade ipa-healthcheckUpgrade custodiaUpgrade python3-ipaclientUpgrade xsomUpgrade glassfish-jaxb-runtimeUpgrade pki-caUpgrade python3-nssUpgrade ipa-healthcheck-coreUpgrade pki-servlet-4.0-apiUpgrade xmlstreambufferUpgrade jackson-coreUpgrade jssUpgrade pcs-snmpUpgrade stax-exUpgrade xml-commons-apisUpgrade jackson-jaxrs-json-providerUpgrade pki-baseUpgrade slf4j-jdk14Upgrade ipa-selinuxUpgrade python3-qrcodeUpgrade python2-ipaserverUpgrade jackson-jaxrs-providersUpgrade pki-toolsUpgrade xml-commons-resolverUpgrade ipa-client-epnUpgrade python-nss-docUpgrade glassfish-fastinfosetUpgrade slapi-nisUpgrade python2-ipaclientUpgrade glassfish-jaxb-txw2Upgrade ldapjdkUpgrade python3-pyusbUpgrade javassist-javadocUpgrade ipa-server-trust-adUpgrade softhsmUpgrade jackson-annotationsUpgrade tomcatjssUpgrade python2-ipalibUpgrade velocityUpgrade slf4jUpgrade python3-pkiUpgrade pki-servlet-engineUpgrade python3-qrcode-coreUpgrade pki-base-javaUpgrade python3-jwcryptoUpgrade ipa-server-commonUpgrade ipa-client-sambaUpgrade softhsm-develUpgrade pki-serverUpgrade relaxngDatatypeUpgrade bind-dyndb-ldapUpgrade apache-commons-netUpgrade apache-commons-collectionsUpgrade pcsUpgrade glassfish-jaxb-apiUpgrade javassistUpgrade ipa-server-dnsUpgrade python3-custodiaUpgrade glassfish-jaxb-coreUpgrade jackson-module-jaxb-annotationsUpgrade jakarta-commons-httpclientUpgrade ipa-python-compatUpgrade python3-yubicoUpgrade ipa-serverUpgrade python3-ipaserverUpgrade jss-javadocUpgrade xalan-j2Upgrade bea-stax-apiUpgrade ipa-clientUpgrade python3-ipalibUpgrade opendnssecUpgrade ipa-commonUpgrade ipa-client-commonUpgrade resteasyUpgrade ldapjdk-javadocUpgrade apache-commons-lang | Oct 7, 2020 | Mar 27, 2019 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 9.1R9 | Oct 28, 2020 | Apr 20, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 27, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Apr 20, 2019 |
| Redhat Openshift | — | Upgrade atomic-openshift-node-problem-detectorUpgrade cri-oUpgrade atomic-openshift-cluster-autoscalerUpgrade openshift-kuryrUpgrade atomic-openshiftUpgrade atomic-openshift-web-consoleUpgrade atomic-openshift-deschedulerUpgrade golang-github-prometheus-prometheusUpgrade atomic-openshift-metrics-serverUpgrade jenkins-2-pluginsUpgrade openshift-enterprise-cluster-capacityUpgrade atomic-enterprise-service-catalogUpgrade golang-github-openshift-oauth-proxyUpgrade golang-github-prometheus-alertmanagerUpgrade atomic-openshift-dockerregistryUpgrade openshift-enterprise-autohealUpgrade jenkinsUpgrade golang-github-prometheus-node_exporterUpgrade atomic-openshift-service-idlerUpgrade openshift-ansible | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade xsomUpgrade python3-ipalibUpgrade ipa-client-sambaUpgrade python3-ipaclientUpgrade pki-baseUpgrade apache-commons-netUpgrade ipa-server-commonUpgrade ipa-server-trust-ad-debuginfoUpgrade apache-commons-collectionsUpgrade pki-kraUpgrade slf4jUpgrade pki-serverUpgrade pki-servlet-4.0-apiUpgrade pki-symkeyUpgrade jackson-coreUpgrade ipa-debugsourceUpgrade python3-nssUpgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade pki-toolsUpgrade softhsm-debuginfoUpgrade python3-kdcproxyUpgrade jss-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade python3-nss-debuginfoUpgrade ipa-healthcheckUpgrade pki-caUpgrade python3-qrcodeUpgrade jackson-databindUpgrade jssUpgrade jss-debugsourceUpgrade custodiaUpgrade pcs-debuginfoUpgrade python-nss-docUpgrade relaxngDatatypeUpgrade python-nss-debugsourceUpgrade bind-dyndb-ldap-debugsourceUpgrade pcsUpgrade pki-core-debugsourceUpgrade bind-dyndb-ldapUpgrade ipa-healthcheck-coreUpgrade pki-core-debuginfoUpgrade python2-ipaserverUpgrade jackson-annotationsUpgrade xalan-j2Upgrade ipa-selinuxUpgrade opendnssec-debugsourceUpgrade xml-commons-resolverUpgrade glassfish-jaxb-runtimeUpgrade ipa-server-debuginfoUpgrade python3-jwcryptoUpgrade xml-commons-apisUpgrade ipa-server-trust-adUpgrade opendnssec-debuginfoUpgrade ipa-client-epnUpgrade slapi-nis-debuginfoUpgrade python3-pyusbUpgrade ipa-client-debuginfoUpgrade xerces-j2Upgrade slf4j-jdk14Upgrade tomcatjssUpgrade resteasyUpgrade ipa-commonUpgrade softhsm-debugsourceUpgrade pcs-snmpUpgrade pki-base-javaUpgrade softhsmUpgrade ldapjdk-javadocUpgrade opendnssecUpgrade bind-dyndb-ldap-debuginfoUpgrade ldapjdkUpgrade slapi-nis-debugsourceUpgrade ipa-python-compatUpgrade python3-qrcode-coreUpgrade python3-pkiUpgrade pki-servlet-engineUpgrade ipa-server-dnsUpgrade ipa-debuginfoUpgrade ipa-clientUpgrade velocityUpgrade slapi-nisUpgrade softhsm-develUpgrade pki-tools-debuginfoUpgrade glassfish-fastinfosetUpgrade python3-ipaserverUpgrade xmlstreambufferUpgrade bea-stax-apiUpgrade python3-yubicoUpgrade stax-exUpgrade jss-javadocUpgrade jackson-module-jaxb-annotationsUpgrade javassistUpgrade python2-ipalibNo solution existsUpgrade pki-symkey-debuginfoUpgrade jackson-jaxrs-providersUpgrade python2-ipaclientUpgrade python3-custodiaUpgrade ipa-client-commonUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade ipa-server | Oct 1, 2020 | Apr 20, 2019 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade pcs-snmpUpgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade pcsUpgrade python3-nss | Mar 12, 2024 | Apr 20, 2019 |
| Suse | — | Upgrade python3-django | Aug 9, 2019 | Apr 19, 2019 |
| Ubuntu | — | Upgrade libjs-jquery (Ubuntu Pro) | Jun 26, 2025 | Apr 20, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub