CVSS: 10.0EPSS: 2%CPEs: 18EXPL: 0CVE-2010-2276
https://notcve.org/view.php?id=CVE-2010-2276
The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 has the copyTests=true and mini=false options, which makes it easier for remote attackers to have an unspecified impact via a request to a (1) test or (2) demo component. La configuración por defecto del proceso de generación en Dojo v0.4.x antes de v0.4.4, v1.0.x antes de v1.0.3, v1.1.x antes de v1.1.2, v1.2.x antes de v1.2.4, v1.3.x antes de v1.3.3, y v1.4.x antes de v1.4.2 tiene las opciones copyTests = true y mini opciones = false, lo que facilita a los atacantes remotos tener un impacto no especificado a través de una solicitud a (1) una prueba o (2) una demo. • http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory http://secunia.com/advisories/38964 http://secunia.com/advisories/40007 http://www-01.ibm.com/support/docview.wss?uid=swg21431472 http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833 http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849 http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856 http://www-1.ibm.com/support/docview.wss? • CWE-16: Configuration •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2010-2274
https://notcve.org/view.php?id=CVE-2010-2274
Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, util/buildscripts/jslib/buildUtil.js, and util/doh/runner.html. Múltiples vulnerabilidades de redirección abierta en Dojo 1.0.x en versiones anteriores a la 1.0.3, 1.1.x en versiones anteriores a la 1.1.2, 1.2.x en versiones anteriores a la 1.2.4, 1.3.x en versiones anteriores a la 1.3.3 y 1.4.x en versiones anteriores a la 1.4.2 permiten a atacantes remotos redirigir usuarios a sitios web de su elección y realizar ataques de phising mediante vectores desconocidos, posiblemente relacionados con dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, util/buildscripts/jslib/buildUtil.js y util/doh/runner.html. • http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory http://secunia.com/advisories/38964 http://secunia.com/advisories/40007 http://www-01.ibm.com/support/docview.wss?uid=swg21431472 http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833 http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849 http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856 http://www-1.ibm.com/support/docview.wss? •
CVSS: 4.3EPSS: 1%CPEs: 26EXPL: 3CVE-2010-2275 – Dojo Toolkit 1.4.1 - '/dijit/tests/_testCommon.js?theme' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2010-2275
Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the theme parameter, as demonstrated by an attack against dijit/tests/form/test_Button.html. Vulnerabilidad de ejecución de secuencias en sitios cruzados(XSS) en Dijit/tests/_testCommon.js en Dojo Toolkit SDK antes de v1.4.2 permite a atacantes remotos inyectar HTML o secuencias de comandos web a través del parámetro 'theme', como lo demuestra un ataque contra Dijit/tests/form/test_Button.html. • https://www.exploit-db.com/exploits/33764 http://bugs.dojotoolkit.org/ticket/10773 http://secunia.com/advisories/38964 http://secunia.com/advisories/40007 http://www-01.ibm.com/support/docview.wss?uid=swg21431472 http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833 http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849 http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856 http://www-1.ibm.com/support/docview.wss? • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •