{"id":"CVE-2019-10785","aliases":["DEBIAN-CVE-2019-10785","DLA-2127-1","EUVD-2020-0309","GHSA-pg97-ww7h-5mjr","MGASA-2020-0126","UBUNTU-CVE-2019-10785","USN-7569-1"],"status":"published","title":"XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode","description":"dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01845,"percentile":0.79192,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-02-13T16:02:46Z","modified":"2026-10-20T10:51:36Z","fixes":[{"ecosystem":"npm","package":"dojox","fixed_in":["1.11.9","1.12.7","1.13.6","1.14.5","1.15.2","1.16.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"dojo","fixed_in":["1.15.2+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dojo","fixed_in":["1.15.2+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dojo","fixed_in":["1.15.2+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"dojo","fixed_in":["1.10.2+dfsg-1+deb8u2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"dojo","fixed_in":["1.14.5-1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dojo","fixed_in":["1.10.4+dfsg-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dojo","fixed_in":["1.15.0+dfsg1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"dojox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dojox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dojox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.13.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dojox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"fixed":"1.14.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dojox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.15.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dojox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"last_affected":"1.16.0"},{"fixed":"1.16.1"}]}],"versions":["1.16.0"]},{"source":"osv","ecosystem":"Debian:12","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2+dfsg-1+deb8u2"}]}],"versions":["1.10.2+dfsg-1","1.10.2+dfsg-1+deb8u1"]},{"source":"osv","ecosystem":"npm","package":"dojox","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.9"}]}]},{"source":"osv","ecosystem":"npm","package":"dojox","ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0"},{"fixed":"1.12.7"}]}]},{"source":"osv","ecosystem":"npm","package":"dojox","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.13.6"}]}]},{"source":"osv","ecosystem":"npm","package":"dojox","ranges":[{"type":"SEMVER","events":[{"introduced":"1.14.0"},{"fixed":"1.14.5"}]}]},{"source":"osv","ecosystem":"npm","package":"dojox","ranges":[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.15.2"}]}]},{"source":"osv","ecosystem":"npm","package":"dojox","ranges":[{"type":"SEMVER","events":[{"introduced":"1.16.0"},{"fixed":"1.16.1"}]}],"versions":["1.16.0"]},{"source":"osv","ecosystem":"Mageia:7","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4+dfsg-2ubuntu0.1~esm1"}]}],"versions":["1.10.4+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["1.14.2+dfsg1-1","1.15.0+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4+dfsg-2ubuntu0.1~esm1"}]}],"versions":["1.10.4+dfsg-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["1.14.2+dfsg1-1","1.15.0+dfsg1-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.4+dfsg1-1ubuntu0.1"}]}],"versions":["1.15.4+dfsg1-1"],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"dojo","product":"dojox"},{"vendor":"linuxfoundation","product":"dojox"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-DOJOX-548257%2C","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://github.com/dojo/dojox/security/advisories/GHSA-pg97-ww7h-5mjr","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/02/msg00033.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://github.com/dojo/dojox/pull/315","tags":["web"]},{"url":"https://github.com/dojo/dojox/commit/abd033a787c718abc1a390f480ac3ea61288e5ee","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10785","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-DOJOX-548257","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-DOJOX-548257,","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-pg97-ww7h-5mjr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-10785","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0126.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26287","tags":["report"]},{"url":"https://www.debian.org/lts/security/2020/dla-2127","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-10785","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10785","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7569-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-15494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-4051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23450","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-10785","description":"dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.","status":"published","published":"2020-02-13T16:02:46Z","modified":"2024-08-04T22:32:01.603Z","updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2020-0309","description":"dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.","status":"published","published":"2020-02-13T16:02:46Z","modified":"2024-08-04T22:32:01Z","updated_at":"2026-11-03T02:40:51.198112Z"}],"ghsa":[{"id":"GHSA-pg97-ww7h-5mjr","title":"XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode ","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nPotential XSS vulnerability for users of `dojox/xmpp` and `dojox/dtl`.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nYes, patches are available for the 1.11 through 1.16 versions. Users should upgrade to one of these versions of Dojo:\n\n* 1.16.1\n* 1.15.2\n* 1.14.5\n* 1.13.6\n* 1.12.7\n* 1.11.9\n\nUsers of Dojo 1.10.x and earlier should review this change and determine if it impacts them, and backport the change as appropriate.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThe change applied in https://github.com/dojo/dojox/pull/315 could get added separately as a patch.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [dojo/dojox](https://github.com/dojo/dojox/)","status":"published","published":"2020-02-13T22:21:06Z","modified":"2023-01-09T05:02:17Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:03.040255Z"}],"nvd":[{"id":"CVE-2019-10785","description":"dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.","status":"published","published":"2020-02-13T17:15:29.477Z","modified":"2026-06-17T02:11:40.14Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:43.875329Z"}],"osv":[{"id":"CVE-2019-10785","description":"dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.","status":"published","published":"2020-02-13T17:15:29.477Z","modified":"2026-10-20T10:51:36.922271528Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"DEBIAN-CVE-2019-10785","description":"dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.","status":"published","published":"2020-02-13T17:15:29.477Z","modified":"2026-09-21T07:00:36.526336162Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"GHSA-pg97-ww7h-5mjr","title":"XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode ","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nPotential XSS vulnerability for users of `dojox/xmpp` and `dojox/dtl`.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nYes, patches are available for the 1.11 through 1.16 versions. Users should upgrade to one of these versions of Dojo:\n\n* 1.16.1\n* 1.15.2\n* 1.14.5\n* 1.13.6\n* 1.12.7\n* 1.11.9\n\nUsers of Dojo 1.10.x and earlier should review this change and determine if it impacts them, and backport the change as appropriate.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThe change applied in https://github.com/dojo/dojox/pull/315 could get added separately as a patch.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [dojo/dojox](https://github.com/dojo/dojox/)","status":"published","published":"2020-02-13T22:21:06Z","modified":"2026-09-10T03:48:27.782778981Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"UBUNTU-CVE-2019-10785","description":"dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.","status":"published","published":"2020-02-13T17:15:00Z","modified":"2026-02-04T04:23:10.731113Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"DLA-2127-1","title":"dojo - security update","status":"published","published":"2020-02-29T00:00:00Z","modified":"2026-03-09T01:22:49.168617Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2020-0126","title":"Updated dojo packages fix security vulnerability","description":"Updated dojo package fixes security vulnerability:\n\ndojox was vulnerable to Cross-site Scripting. This was due to\ndojox.xmpp.util.xmlEncode only encoding the first occurrence of\neach character, not all of them (CVE-2019-10785).\n","status":"published","published":"2020-03-06T16:13:58Z","modified":"2026-04-16T04:42:53.922651186Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"USN-7569-1","title":"dojo vulnerabilities","description":"It was discovered that Dojo did not correctly handle DataGrids. An\nattacker could possibly use this issue to execute arbitrary code. This\nissue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. \n(CVE-2018-15494)\n\nIt was discovered that Dojo was vulnerable to prototype pollution. An\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2021-23450)\n\nJonathan Leitschuh discovered that Dojo did not correctly sanitize\ncertain inputs. An attacker could possibly use this issue to execute a\ncross-site scripting (XSS) attack. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. \n(CVE-2019-10785, CVE-2020-4051)","status":"published","published":"2025-06-16T02:55:56Z","modified":"2026-06-25T13:32:30.502422472Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}