Hi, as part of our project requirements, we need to run the owasp dependency check and resolve all findings. The check returned 3 medium vulnerabilities on bootstrap and jquery. 

is it possible to upgrade these dependencies? 

Hi Aleksandar, 

I'm sharing the generated OWASP dependency check report (is a html file, renamed to txt). Would you be able to advised how these 11 medium findings are mitigated in wp-datatables (e.g. the functionality is not used, hence its a false positive)?

I need to get the findings mitigated before I am able to go live with this plugin. 

Thanks!

Hi Aleksandar, 

Sorry for the delay in response. Yes, would you be able to provide the information to us by today?

Hi Aleksandar, 

Thanks for the reply. Just to confirm my understanding:

1. The below 2 files are sample data from the phpoffice library and are not being used by wpDataTables and hence can be safely ignored

\wpdatatables\lib\phpoffice\phpspreadsheet\samples\bootstrap\js\bootstrap.min.js
\wpdatatables\lib\phpoffice\phpspreadsheet\samples\bootstrap\js\jquery.min.js

2. For \wpdatatables\assets\js\bootstrap\noconf.bootstrap.min.js the 4 data attributes below are not being used by the wpDataTables for any purpose and can also be ignored. 

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.