CVE-2019-14862
Summary
| CVE | CVE-2019-14862 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-01-02 15:15:00 UTC |
|---|
| Updated | 2022-06-07 18:41:00 UTC |
|---|
| Description | There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| 1763594 – (CVE-2019-14862) CVE-2019-14862 knockout: Cross-site Scripting (XSS) attacks due to not escaping the name attribute. |
CONFIRM |
bugzilla.redhat.com |
Issue Tracking, Patch, Third Party Advisory |
| Oracle Critical Patch Update Advisory - July 2020 |
MISC |
www.oracle.com |
|
| Oracle Critical Patch Update Advisory - April 2022 |
MISC |
www.oracle.com |
|
| Cross-site Scripting (XSS) in knockout | Snyk |
MISC |
snyk.io |
Exploit, Third Party Advisory |
| Oracle Critical Patch Update Advisory - January 2021 |
MISC |
www.oracle.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 982941 Nodejs (npm) Security Update for knockout (GHSA-vcjj-xf2r-mwvc)
