CVE-2019-10785

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 13, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-107869.8network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument.CVE-2019-107879.8im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js CVE-2019-107889.8im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary CVE-2019-107899.8All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without CVE-2019-10796.5An information disclosure vulnerability exists when Visual Studio improperly parses XML input in certain settings files, aka 'Visual Studio CVE-2019-107907.5taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-i CVE-2019-107919.8promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be CVE-2019-107926.3bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Obje CVE-2019-107936.3dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Objec CVE-2019-107946.3All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties CVE-2019-107956.3undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object CVE-2019-107969.8rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of