CVE-2019-14862 – knockout: Cross-site Scripting (XSS) attacks due to not escaping the name attribute.

https://notcve.org/view.php?id=CVE-2019-14862

There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it. Hay una vulnerabilidad en knockout versiones anteriores a la versión 3.5.0-beta, donde después de escapar del contexto de la aplicación web, la aplicación web entrega datos a sus usuarios junto con otro contenido dinámico seguro, sin comprobarlo. • https://github.com/ossf-cve-benchmark/CVE-2019-14862 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14862 https://snyk.io/vuln/npm:knockout:20180213 https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujan2021.html https://www.oracle.com/security-alerts/cpujul2020.html https://access.redhat.com/security/cve/CVE-2019-14862 https://bugzilla.redhat.com/show_bug.cgi?id=1763594 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •