CVE-2014-6071 @ Npm-jquery-1.6.4

[smaguilarcx]

Vulnerable Package issue exists @ Npm-jquery-1.6.4 in branch master

jQuery can potentially allow remote attackers to conduct Cross-site scripting (XSS) attacks when using methods such as jQuery(), append() and after(). These methods accept an HTML string and can, by design, execute code. This can be avoided by sanitizing inputs when obtained from untrusted sources. This is a usage vulnerability, meaning it exists only when the user is doing something wrong in the usage of the package, but the package doesn't restrict it. It exists in all jquery versions.

Namespace: CxDemoInABoxRepos
Repository: BodgeitIssue
Repository Url: https://github.com/CxDemoInABoxRepos/BodgeitIssue
CxAST-Project: CxDemoInABoxRepos/BodgeitIssue
CxAST platform scan: eed07198-d1ae-46bb-80fc-88cbc7cbac3c
Branch: master
Application: BodgeitIssue
Severity: MEDIUM
State: NOT_IGNORED
Status: NEW
CWE: CWE-79

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: LOW
Availability impact: NONE
Remediation Upgrade Recommendation: 3.6.1

---

References
Disclosure
Advisory