Vulnerability found when using sonatype Vulnerability Scanner

Nobody has claimed this yet.

**sonatype-2019-0115**
The jquery package is vulnerable to Prototype Pollution. The jQuery.extend and jQuery.fn.extend functions defined in many files allow an untrusted object to extend Object.prototype. An attacker can modify and add prototype properties to JavaScript objects and can potentially leverage those changes to crash the application or execute remote code.

NOTE: This vulnerability has been assigned CVE-2019-11358.

Advisory Deviation Notice: The Sonatype security research team has assessed the CVSS score for this vulnerability to be 9.8 given the nature of prototype pollution and the high potential for damage in this particular case, as opposed to a score of 6.1 reported by NVD.

**sonatype-2014-0026**
The jQuery package is vulnerable to Cross-Site Scripting (XSS). The parseHTML() function in the parseHTML.js, jquery.js files allow JavaScript to be executed immediately when it's embedded within the event attributes. An attacker can exploit this vulnerability by injecting malicious JavaScript containing events handlers which, when rendered, results in the execution of arbitrary script.

**sonatype-2016-0107**
The jQuery library is vulnerable to Cross-Site Scripting (XSS) when no explicit data type is provided within an AJAX request. The ajaxSetup() method in script.js allows execution of responses from third-party origins by default. A remote attacker can exploit this vulnerability by sending a malicious response to an AJAX request, resulting in the execution of the Cross Origin response.

NOTE: This vulnerability has been assigned CVE-2015-9251.

it seems some jsbarcode's dependencies using the old version of jQuery

Inspect the project's dependency declarations and dependency tree to identify which JsBarcode dependencies bring in the vulnerable jQuery versions. Update the affected dependencies where possible, then rerun the Sonatype vulnerability scan and verify that the listed CVEs are no longer reported.

Written by the indexing model from the issue text.