● CVE — Medium
CVE-2020-11023
Vendordebian, fedoraproject, jquery, oracle, drupalProductdebian linux, fedora, jquery, business intelligence, jd edwards enterpriseone tools, application express, banking platform, communications interactive session recorder, communications services gatekeeper, healthcare translational research, drupal, communications eagle application processor, application testing suite, communications operations monitor, communications element manager, communications session report manager, communications session route manager, communications analytics, jd edwards enterpriseone orchestrator, hyperion financial reporting, banking enterprise collections, blockchain platform, financial services revenue management and billing analytics, health sciences inform, financial services regulatory reporting for de nederlandsche bankDiscoveredApr 29, 2020UpdatedNov 7, 2025
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.