From 613142f1c505002d4865c5b6158c51c597fefd8c Mon Sep 17 00:00:00 2001 From: Tiago Mendo Date: Tue, 6 Oct 2026 23:38:40 +0100 Subject: [PATCH] feat: add jQuery Validation and GSAP library entries The app detects both (OVI-339 jQuery Validation, OVI-352 GSAP) but the knowledge base had no entry for either. Severity, CVSS vector, CWE and fix text follow the backend definitions (data migration 0340 for GSAP) and the other library entries; compliance mirrors the engine's standard lists for both OVIs, which match Lodash's. Co-Authored-By: Claude Opus 5.5 --- gsap-library-with-known-vulnerabilities.md | 28 +++++++++++++++++++ ...tion-library-with-known-vulnerabilities.md | 28 +++++++++++++++++++ 2 files changed, 56 insertions(+) create mode 100644 gsap-library-with-known-vulnerabilities.md create mode 100644 jquery-validation-library-with-known-vulnerabilities.md diff --git a/gsap-library-with-known-vulnerabilities.md b/gsap-library-with-known-vulnerabilities.md new file mode 100644 index 0000000..529e70a --- /dev/null +++ b/gsap-library-with-known-vulnerabilities.md @@ -0,0 +1,28 @@ +--- +name: GSAP library with known vulnerabilities +severity: low +cvss-score: 4.8 +cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component +compliance: + HIPAA: 164.306(a) + ISO 27001: A.8.9 + owasp10: A5, A6 + pci: '6.2' + PCI-DSS v4.0.1: 6.2.4, 6.3.3 + +--- + +The application uses an outdated version of the GSAP library, which has known vulnerabilities. + +## How to fix + +{% tabs gsap-library-with-known-vulnerabilities %} +{% tab gsap-library-with-known-vulnerabilities generic %} +To fix this issue, please update GSAP to the latest available version on its official website. + +Do not forget to update all the GSAP files you have on the server. +{% endtab %} + +{% endtabs %} diff --git a/jquery-validation-library-with-known-vulnerabilities.md b/jquery-validation-library-with-known-vulnerabilities.md new file mode 100644 index 0000000..1a64695 --- /dev/null +++ b/jquery-validation-library-with-known-vulnerabilities.md @@ -0,0 +1,28 @@ +--- +name: jQuery Validation library with known vulnerabilities +severity: low +cvss-score: 4.8 +cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component +compliance: + HIPAA: 164.306(a) + ISO 27001: A.8.9 + owasp10: A5, A6 + pci: '6.2' + PCI-DSS v4.0.1: 6.2.4, 6.3.3 + +--- + +The application uses an outdated version of the jQuery Validation library, which has known vulnerabilities. + +## How to fix + +{% tabs jquery-validation-library-with-known-vulnerabilities %} +{% tab jquery-validation-library-with-known-vulnerabilities generic %} +To fix this issue, please update jQuery Validation to the latest available version on its official website. + +Do not forget to update all the jQuery Validation files you have on the server. +{% endtab %} + +{% endtabs %}