First published: Wed Mar 27 2019(Updated: )
A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/ansible-tower | <0:3.5.2-1.el7a | 0:3.5.2-1.el7a |
redhat/cfme | <0:5.10.9.1-1.el7cf | 0:5.10.9.1-1.el7cf |
redhat/cfme-amazon-smartstate | <0:5.10.9.1-1.el7cf | 0:5.10.9.1-1.el7cf |
redhat/cfme-appliance | <0:5.10.9.1-1.el7cf | 0:5.10.9.1-1.el7cf |
redhat/cfme-gemset | <0:5.10.9.1-1.el7cf | 0:5.10.9.1-1.el7cf |
redhat/ovirt-ansible-hosted-engine-setup | <0:1.0.23-1.el7e | 0:1.0.23-1.el7e |
redhat/ovirt-ansible-roles | <0:1.1.7-1.el7e | 0:1.1.7-1.el7e |
redhat/ovirt-ansible-vm-infra | <0:1.1.19-1.el7e | 0:1.1.19-1.el7e |
redhat/v2v-conversion-host | <0:1.14.2-1.el7e | 0:1.14.2-1.el7e |
redhat/ipa | <0:4.6.8-5.el7 | 0:4.6.8-5.el7 |
redhat/pcs | <0:0.9.169-3.el7_9.3 | 0:0.9.169-3.el7_9.3 |
redhat/pcs | <0:0.10.10-4.el8 | 0:0.10.10-4.el8 |
redhat/eap7-hal-console | <0:3.3.16-1.Final_redhat_00001.1.el8ea | 0:3.3.16-1.Final_redhat_00001.1.el8ea |
redhat/eap7-hal-console | <0:3.3.16-1.Final_redhat_00001.1.el9ea | 0:3.3.16-1.Final_redhat_00001.1.el9ea |
redhat/eap7-hal-console | <0:3.3.16-1.Final_redhat_00001.1.el7ea | 0:3.3.16-1.Final_redhat_00001.1.el7ea |
redhat/atomic-enterprise-service-catalog | <1:3.11.170-1.git.1.91db82e.el7 | 1:3.11.170-1.git.1.91db82e.el7 |
redhat/atomic-openshift | <0:3.11.170-1.git.0.00cac56.el7 | 0:3.11.170-1.git.0.00cac56.el7 |
redhat/atomic-openshift-cluster-autoscaler | <0:3.11.170-1.git.1.0a0df6a.el7 | 0:3.11.170-1.git.1.0a0df6a.el7 |
redhat/atomic-openshift-descheduler | <0:3.11.170-1.git.1.9ad83f2.el7 | 0:3.11.170-1.git.1.9ad83f2.el7 |
redhat/atomic-openshift-dockerregistry | <0:3.11.170-1.git.1.55fab05.el7 | 0:3.11.170-1.git.1.55fab05.el7 |
redhat/atomic-openshift-metrics-server | <0:3.11.170-1.git.1.357f177.el7 | 0:3.11.170-1.git.1.357f177.el7 |
redhat/atomic-openshift-node-problem-detector | <0:3.11.170-1.git.1.b1f90a6.el7 | 0:3.11.170-1.git.1.b1f90a6.el7 |
redhat/atomic-openshift-service-idler | <0:3.11.170-1.git.1.8328979.el7 | 0:3.11.170-1.git.1.8328979.el7 |
redhat/atomic-openshift-web-console | <0:3.11.170-1.git.1.3d64e8b.el7 | 0:3.11.170-1.git.1.3d64e8b.el7 |
redhat/cri-o | <0:1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7 | 0:1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7 |
redhat/golang-github-openshift-oauth-proxy | <0:3.11.170-1.git.1.b49be83.el7 | 0:3.11.170-1.git.1.b49be83.el7 |
redhat/golang-github-prometheus-alertmanager | <0:3.11.170-1.git.1.61d7960.el7 | 0:3.11.170-1.git.1.61d7960.el7 |
redhat/golang-github-prometheus-prometheus | <0:3.11.170-1.git.1.227bc98.el7 | 0:3.11.170-1.git.1.227bc98.el7 |
redhat/jenkins | <0:2.204.2.1580891656-1.el7 | 0:2.204.2.1580891656-1.el7 |
redhat/jenkins | <2-plugins-0:3.11.1579107288-1.el7 | 2-plugins-0:3.11.1579107288-1.el7 |
redhat/openshift-ansible | <0:3.11.170-2.git.5.8802564.el7 | 0:3.11.170-2.git.5.8802564.el7 |
redhat/openshift-enterprise-autoheal | <0:3.11.170-1.git.1.dfe6c52.el7 | 0:3.11.170-1.git.1.dfe6c52.el7 |
redhat/openshift-enterprise-cluster-capacity | <0:3.11.170-1.git.1.661684b.el7 | 0:3.11.170-1.git.1.661684b.el7 |
redhat/openshift-kuryr | <0:3.11.170-1.git.1.7265da1.el7 | 0:3.11.170-1.git.1.7265da1.el7 |
redhat/rh-sso7-keycloak | <0:18.0.6-1.redhat_00001.1.el7 | 0:18.0.6-1.redhat_00001.1.el7 |
redhat/rh-sso7-keycloak | <0:18.0.6-1.redhat_00001.1.el8 | 0:18.0.6-1.redhat_00001.1.el8 |
redhat/rh-sso7-keycloak | <0:18.0.6-1.redhat_00001.1.el9 | 0:18.0.6-1.redhat_00001.1.el9 |
redhat/ovirt-engine-api-explorer | <0:0.0.5-1.el7e | 0:0.0.5-1.el7e |
redhat/ovirt-engine-ui-extensions | <0:1.0.10-1.el7e | 0:1.0.10-1.el7e |
redhat/ovirt-web-ui | <0:1.6.0-1.el7e | 0:1.6.0-1.el7e |
jQuery JavaScript library | =3.4.0 | |
debian/jquery | <=3.1.1-2<=3.3.1~dfsg-1 | 3.3.1~dfsg-2 3.1.1-2+deb9u1 |
redhat/jquery | <3.4.0 | 3.4.0 |
redhat/drupal | <7.66 | 7.66 |
OSIsoft Applications using PI Asset Framework (AF) Client versions prior to and including PI AF Client 2018 SP3 Patch 1, Version 2.10.7.283 | ||
OSIsoft Applications using PI Software Development Kit (SDK) versions prior to and including PI SDK 2018 SP1, Version 1.4.7.602 | ||
OSIsoft PI API for Windows Integrated Security versions prior to and including 2.0.2.5, | ||
OSIsoft PI API versions prior to and including 1.6.8.26 | ||
OSIsoft PI Buffer Subsystem versions prior to and including 4.8.0.18 | ||
OSIsoft PI Connector for BACnet, versions prior to and including 1.2.0.6 | ||
OSIsoft PI Connector for CygNet, versions prior to and including 1.4.0.17 | ||
OSIsoft PI Connector for DC Systems RTscada, versions prior to and including 1.2.0.42 | ||
OSIsoft PI Connector for Ethernet/IP, versions prior to and including 1.1.0.10 | ||
OSIsoft PI Connector for HART-IP, versions prior to and including 1.3.0.1 | ||
OSIsoft PI Connector for Ping, versions prior to and including 1.0.0.54 | ||
OSIsoft PI Connector for Wonderware Historian, versions prior to and including 1.5.0.88 | ||
OSIsoft PI Connector Relay, versions prior to and including 2.5.19.0 | ||
OSIsoft PI Data Archive versions prior to and including PI Data Archive 2018 SP3, Version 3.4.430.460 | ||
OSIsoft PI Data Collection Manager, versions prior to and including 2.5.19.0 | ||
OSIsoft PI Integrator for Business Analytics versions prior to and including 2018 R2 SP1, Version 2.2.0.183 | ||
OSIsoft PI Interface Configuration Utility (ICU) versions prior to and including 1.5.0.7 | ||
OSIsoft PI to OCS versions prior to and including 1.1.36.0 | ||
composer/maximebf/debugbar | <1.19.0 | 1.19.0 |
maven/org.webjars.npm:jquery | >=1.1.4<3.4.0 | 3.4.0 |
nuget/jQuery | >=1.1.4<3.4.0 | 3.4.0 |
npm/jquery | >=1.1.4<3.4.0 | 3.4.0 |
pip/django | >=2.2a1<2.2.2 | 2.2.2 |
pip/django | >=2.0a1<2.1.9 | 2.1.9 |
rubygems/jquery-rails | <4.3.4 | 4.3.4 |
debian/mediawiki | 1:1.35.13-1+deb11u2 1:1.35.13-1+deb11u3 1:1.39.10-1~deb12u1 1:1.39.10-1 | |
debian/node-jquery | 3.5.1+dfsg+~3.5.5-7 3.6.1+dfsg+~3.5.14-1 | |
debian/otrs2 | 6.0.32-6 | |
IBM Cognos Analytics | <=12.0.0-12.0.3 | |
IBM Cognos Analytics | <=11.2.0-11.2.4 FP4 | |
Jquery Jquery | <3.4.0 | |
Debian Debian Linux | =8.0 | |
Debian Debian Linux | =9.0 | |
Debian Debian Linux | =10.0 | |
Drupal Drupal | >=7.0<7.66 | |
Drupal Drupal | >=8.5.0<8.5.15 | |
Drupal Drupal | >=8.6.0<8.6.15 | |
Backdrop CMS | >=1.11.0<1.11.9 | |
Backdrop CMS | >=1.12.0<1.12.6 | |
Fedoraproject Fedora | =28 | |
Fedoraproject Fedora | =29 | |
Fedoraproject Fedora | =30 | |
openSUSE Backports SLE | =15.0-sp1 | |
openSUSE Leap | =15.1 | |
NetApp OnCommand System Manager | >=3.0<=3.1.3 | |
Netapp Snapcenter | ||
Redhat Cloudforms | =4.7 | |
Red Hat Enterprise Virtualization Manager | =4.3 | |
Oracle Agile Product Lifecycle Management for Process | =6.1 | |
Oracle Agile Product Lifecycle Management for Process | =6.2.0.0 | |
Oracle Agile Product Lifecycle Management for Process | =6.2.1.0 | |
Oracle Agile Product Lifecycle Management for Process | =6.2.2.0 | |
Oracle Agile Product Lifecycle Management for Process | =6.2.3.0 | |
Oracle Application Express | <19.1 | |
Oracle Application Service Level Management | =13.2.0.0 | |
Oracle Application Service Level Management | =13.3.0.0 | |
Oracle Application Testing Suite | =12.5.0.3 | |
Oracle Application Testing Suite | =13.1.0.1 | |
Oracle Application Testing Suite | =13.2 | |
Oracle Application Testing Suite | =13.2.0.1 | |
Oracle Application Testing Suite | =13.3 | |
Oracle Application Testing Suite | =13.3.0.1 | |
Oracle Banking Digital Experience | =18.1 | |
Oracle Banking Digital Experience | =18.2 | |
Oracle Banking Digital Experience | =18.3 | |
Oracle Banking Digital Experience | =19.1 | |
Oracle Banking Digital Experience | =19.2 | |
Oracle Banking Digital Experience | =20.1 | |
Oracle Banking Enterprise Collections | >=2.7.0<=2.8.0 | |
Oracle Banking Platform | >=2.4.0<=2.10.0 | |
Oracle BI Publisher | =5.5.0.0.0 | |
Oracle BI Publisher | =12.2.1.3.0 | |
Oracle BI Publisher | =12.2.1.4.0 | |
Oracle Big Data Discovery | =1.6 | |
Oracle Business Process Management Suite | =12.2.1.3.0 | |
Oracle Business Process Management Suite | =12.2.1.4.0 | |
Oracle Communications Analytics | =12.1.1 | |
Oracle Communications Application Session Controller | =3.8m0 | |
Oracle Communications Billing and Revenue Management | =7.5 | |
Oracle Communications Billing and Revenue Management | =7.5.0.23.0 | |
Oracle Communications Billing and Revenue Management | =12.0 | |
Oracle Communications Billing and Revenue Management | =12.0.0.3.0 | |
Oracle Communications Diameter Signaling Router | =8.0.0 | |
Oracle Communications Diameter Signaling Router | =8.1 | |
Oracle Communications Diameter Signaling Router | =8.2 | |
Oracle Communications Diameter Signaling Router | =8.2.1 | |
Oracle Communications EAGLE Application Processor | >=16.1.0<=16.4.0 | |
Oracle Communications Element Manager | =8.1.1 | |
Oracle Communications Element Manager | =8.2.0 | |
Oracle Communications Element Manager | =8.2.1 | |
Oracle Communications Interactive Session Recorder | >=6.0<=6.4 | |
Oracle Communications Operations Monitor | >=4.1<=4.3 | |
Oracle Communications Operations Monitor | =3.4 | |
Oracle Communications Operations Monitor | =4.0 | |
Oracle Communications Operations Monitor | =4.1.0 | |
Oracle Communications Services Gatekeeper | =7.0 | |
Oracle Communications Session Report Manager | =8.1.1 | |
Oracle Communications Session Report Manager | =8.2.0 | |
Oracle Communications Session Report Manager | =8.2.1 | |
Oracle Communications Session Route Manager | =8.1.1 | |
Oracle Communications Session Route Manager | =8.2.0 | |
Oracle Communications Session Route Manager | =8.2.1 | |
Oracle Communications Unified Inventory Management | =7.3 | |
Oracle Communications Unified Inventory Management | =7.4.0 | |
Oracle WebRTC Session Controller | =7.2 | |
Oracle Diagnostic Assistant | =2.12.36 | |
Oracle Enterprise Manager Ops Center | =12.3.3 | |
Oracle Enterprise Manager Ops Center | =12.4.0 | |
Oracle Enterprise Manager Ops Center | =12.4.0.0 | |
Oracle Enterprise Session Border Controller | =8.4 | |
Oracle Financial Services Analytical Applications Infrastructure | >=7.3.3<=7.3.5 | |
Oracle Financial Services Analytical Applications Infrastructure | >=8.0.2<=8.1.0 | |
Oracle Financial Services Analytical Applications Reconciliation Framework | >=8.0.4<=8.0.7 | |
Oracle Financial Services Analytical Applications Reconciliation Framework | =8.1.0 | |
Oracle Financial Services Asset Liability Management | >=8.0.4<=8.0.7 | |
Oracle Financial Services Asset Liability Management | =8.1.0 | |
Oracle Financial Services Balance Sheet Planning | =8.0.8 | |
Oracle Financial Services Basel Regulatory Capital Basic | >=8.0.4<=8.0.7 | |
Oracle Financial Services Basel Regulatory Capital Basic | =8.1.0 | |
Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach | >=8.0.4<=8.0.7 | |
Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach | =8.1.0 | |
Oracle Financial Services Data Foundation | >=8.0.4<=8.0.8 | |
Oracle Financial Services Data Governance For Us Regulatory Reporting | >=8.0.6<=8.0.9 | |
Oracle Financial Services Data Integration Hub | >=8.0.5<=8.0.7 | |
Oracle Financial Services Data Integration Hub | =8.1.0 | |
Oracle Financial Services Enterprise Financial Performance Analytics | =8.0.6 | |
Oracle Financial Services Enterprise Financial Performance Analytics | =8.0.7 | |
Oracle Financial Services Funds Transfer Pricing | >=8.0.4<=8.0.7 | |
Oracle Financial Services Funds Transfer Pricing | =8.1.0 | |
Oracle Financial Services Hedge Management and IFRS Valuations | >=8.0.4<=8.0.7 | |
Oracle Financial Services Hedge Management and IFRS Valuations | =8.1.0 | |
Oracle Financial Services Institutional Performance Analytics | >=8.0.4<=8.0.7 | |
Oracle Financial Services Institutional Performance Analytics | =8.1.0 | |
Oracle Financial Services Liquidity Risk Management | =8.0.0.1.0 | |
Oracle Financial Services Liquidity Risk Management | =8.0.2 | |
Oracle Financial Services Liquidity Risk Management | =8.0.4.0.0 | |
Oracle Financial Services Liquidity Risk Management | =8.0.5.0.0 | |
Oracle Financial Services Liquidity Risk Management | =8.0.6 | |
Oracle Financial Services Liquidity Risk Measurement and Management | =8.0.7 | |
Oracle Financial Services Liquidity Risk Measurement and Management | =8.0.8 | |
Oracle Financial Services Liquidity Risk Measurement and Management | =8.1.0 | |
Oracle Financial Services Loan Loss Forecasting and Provisioning | >=8.0.2<=8.0.7 | |
Oracle Financial Services Loan Loss Forecasting and Provisioning | =8.1.0 | |
Oracle Financial Services Market Risk Measurement and Management | =8.0.5 | |
Oracle Financial Services Market Risk Measurement and Management | =8.0.6 | |
Oracle Financial Services Market Risk Measurement and Management | =8.0.8 | |
Oracle Financial Services Price Creation and Discovery | >=8.0.4<=8.0.7 | |
Oracle Financial Services Profitability Management | >=8.0.4<=8.0.7 | |
Oracle Financial Services Profitability Management | =8.1.0 | |
Oracle Financial Services Regulatory Reporting For De Nederlandsche Bank | =8.0.4 | |
Oracle Financial Services Regulatory Reporting For European Banking Authority | =8.0.6 | |
Oracle Financial Services Regulatory Reporting For European Banking Authority | =8.0.7 | |
Oracle Financial Services Regulatory Reporting For Us Federal Reserve | >=8.0.4<=8.0.7 | |
Oracle Financial Services Retail Customer Analytics | >=8.0.4<=8.0.6 | |
Oracle Financial Services Retail Performance Analytics | =8.0.6 | |
Oracle Financial Services Retail Performance Analytics | =8.0.7 | |
Oracle Financial Services Revenue Management and Billing | =2.4.0.0 | |
Oracle Financial Services Revenue Management and Billing | =2.4.0.1 | |
Oracle Fusion Middleware MapViewer | =12.2.1.3.0 | |
Oracle Healthcare Foundation | =7.1.1 | |
Oracle Healthcare Foundation | =7.2.0 | |
Oracle Healthcare Foundation | =7.2.2 | |
Oracle Healthcare Foundation | =7.3.0 | |
Oracle Healthcare Translational Research | =3.1.0 | |
Oracle Healthcare Translational Research | =3.2.1 | |
Oracle Healthcare Translational Research | =3.3.1 | |
Oracle Healthcare Translational Research | =3.3.2 | |
Oracle Healthcare Translational Research | =3.4.0 | |
Oracle Hospitality Guest Access | =4.2.0 | |
Oracle Hospitality Guest Access | =4.2.1 | |
Oracle Hospitality Materials Control | =18.1 | |
Oracle Hospitality Simphony | >=19.1.0<=19.1.2 | |
Oracle Hospitality Simphony | =18.1 | |
Oracle Hospitality Simphony | =18.2 | |
Oracle Identity Manager | =12.2.1.3.0 | |
Oracle Insurance Accounting Analyzer | =8.0.9 | |
Oracle Insurance Allocation Manager For Enterprise Profitability | =8.0.8 | |
Oracle Insurance Allocation Manager For Enterprise Profitability | =8.1.0 | |
Oracle Insurance Data Foundation | >=8.0.4<=8.0.7 | |
Oracle Insurance Ifrs 17 Analyzer | =8.0.6 | |
Oracle Insurance Ifrs 17 Analyzer | =8.0.7 | |
Oracle Insurance Insbridge Rating And Underwriting | >=5.0.0.0<=5.6.0.0 | |
Oracle Insurance Insbridge Rating And Underwriting | =5.6.1.0 | |
Oracle Insurance Performance Insight | =8.0.7 | |
Oracle Jd Edwards Enterpriseone Tools | =9.2 | |
Oracle JDeveloper | =11.1.1.9.0 | |
Oracle JDeveloper | =12.2.1.3.0 | |
Oracle JDeveloper | =12.2.1.4.0 | |
Oracle Jdeveloper And Adf | =11.1.1.9.0 | |
Oracle Jdeveloper And Adf | =12.1.3.0.0 | |
Oracle Jdeveloper And Adf | =12.2.1.3.0 | |
Oracle Knowledge | >=8.6.0<=8.6.3 | |
Oracle PeopleSoft Enterprise PeopleTools | =8.55 | |
Oracle PeopleSoft Enterprise PeopleTools | =8.56 | |
Oracle PeopleSoft Enterprise PeopleTools | =8.57 | |
Oracle PeopleSoft Enterprise PeopleTools | =8.58 | |
Oracle Policy Automation | >=12.2.0<=12.2.15 | |
Oracle Policy Automation | =10.4.7 | |
Oracle Policy Automation | =12.1.0 | |
Oracle Policy Automation | =12.1.1 | |
Oracle Policy Automation Connector For Siebel | =10.4.6 | |
Oracle Policy Automation For Mobile Devices | >=12.2.0<=12.2.15 | |
Oracle Primavera Gateway | >=16.2.0<=16.2.11 | |
Oracle Primavera Gateway | >=17.12.0<=17.12.7 | |
Oracle Primavera Gateway | >=18.8.0<=18.8.9 | |
Oracle Primavera Gateway | >=19.12.0<=19.12.4 | |
Oracle Primavera Gateway | =15.2.18 | |
Oracle Primavera Unifier | >=17.7<=17.12 | |
Oracle Primavera Unifier | =16.1 | |
Oracle Primavera Unifier | =16.2 | |
Oracle Primavera Unifier | =18.8 | |
Oracle Real-Time Scheduler | >=2.3.0.1<=2.3.0.3 | |
Oracle REST Data Services | =11.2.0.4 | |
Oracle REST Data Services | =12.1.0.2 | |
Oracle REST Data Services | =12.2.0.1 | |
Oracle REST Data Services | =18c | |
Oracle REST Data Services | =19c | |
Oracle Retail Back Office | =14.0 | |
Oracle Retail Back Office | =14.1 | |
Oracle Retail Central Office | =14.0 | |
Oracle Retail Central Office | =14.1 | |
Oracle Retail Customer Insights | =15.0 | |
Oracle Retail Customer Insights | =16.0 | |
Oracle Retail Customer Management and Segmentation Foundation | =18.0 | |
Oracle Retail Customer Management and Segmentation Foundation | =19.0 | |
Oracle Retail Point-of-Service | =14.0 | |
Oracle Retail Point-of-Service | =14.1 | |
Oracle Retail Returns Management | =14.0 | |
Oracle Retail Returns Management | =14.1 | |
Oracle Service Bus | =11.1.1.9.0 | |
Oracle Service Bus | =12.1.3.0.0 | |
Oracle Service Bus | =12.2.1.3.0 | |
Oracle Siebel Mobile Applications | <=19.8 | |
Oracle Siebel Ui Framework | =20.8 | |
Oracle Storagetek Tape Analytics Sw Tool | =2.3.0 | |
Oracle System Utilities | =19.1 | |
Oracle Tape Library Acsls | =8.5 | |
Oracle Tape Library Acsls | =8.5.1 | |
Oracle Transportation Management | =1.4.3 | |
Oracle Utilities Mobile Workforce Management | >=2.3.0.1<=2.3.0.3 | |
Oracle WebCenter Sites | =12.2.1.3.0 | |
Oracle WebLogic Server | =10.3.6.0.0 | |
Oracle WebLogic Server | =12.1.3.0.0 | |
Oracle WebLogic Server | =12.2.1.3.0 | |
Oracle WebLogic Server | =12.2.1.4.0 | |
Oracle WebLogic Server | =14.1.1.0.0 | |
Joomla Joomla\! | >=3.0.0<=3.9.4 | |
Juniper JUNOS | =21.2 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)