CVE-2015-9251 Cross-Site Scripting (XSS) in jquery
MediumCVSS 6.1
EPSS 29.7%
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nuget jQuery(NuGet) | < 1.12.2 | 1.12.2 |
| nuget jQuery(NuGet) | >= 1.12.3, < 3.0.0 | 3.0.0 |
| npm jquery(npm) | < 1.12.2 | 1.12.2 |
| npm jquery(npm) | >= 1.12.3, < 3.0.0 | 3.0.0 |
| rubygems jquery-rails(RubyGems) | < 4.2.0 | 4.2.0 |
| org.webjars.npm/jquery(Maven) | < 1.12.2 | 1.12.2 |
| org.webjars.npm/jquery(Maven) | >= 1.12.3, < 3.0.0 | 3.0.0 |
| nuget jQuery(NuGet) | = 1.10.0 | No fix listed |
| nuget jQuery(NuGet) | = 1.10.0.1 | No fix listed |
| nuget jQuery(NuGet) | = 1.10.1 | No fix listed |
| nuget jQuery(NuGet) | = 1.10.2 | No fix listed |
| nuget jQuery(NuGet) | = 1.11.0 | No fix listed |
| nuget jQuery(NuGet) | = 1.11.1 | No fix listed |
| nuget jQuery(NuGet) | = 1.11.2 | No fix listed |
| nuget jQuery(NuGet) | = 1.11.3 | No fix listed |
| nuget jQuery(NuGet) | = 1.12.0 | No fix listed |
| nuget jQuery(NuGet) | = 1.12.1 | No fix listed |
| nuget jQuery(NuGet) | = 1.4.1 | No fix listed |
| nuget jQuery(NuGet) | = 1.4.2 | No fix listed |
| nuget jQuery(NuGet) | = 1.4.3 | No fix listed |
| nuget jQuery(NuGet) | = 1.4.4 | No fix listed |
| nuget jQuery(NuGet) | = 1.5.0 | No fix listed |
| nuget jQuery(NuGet) | = 1.5.1 | No fix listed |
| nuget jQuery(NuGet) | = 1.5.2 | No fix listed |
| nuget jQuery(NuGet) | = 1.6.0 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| nuget jQuery(NuGet) | = 1.6.1 | No fix listed |
| nuget jQuery(NuGet) | = 1.6.2 | No fix listed |
| nuget jQuery(NuGet) | = 1.6.3 | No fix listed |
| nuget jQuery(NuGet) | = 1.6.4 | No fix listed |
| nuget jQuery(NuGet) | = 1.7.0 | No fix listed |
| nuget jQuery(NuGet) | = 1.7.1 | No fix listed |
| nuget jQuery(NuGet) | = 1.7.1.1 | No fix listed |
| nuget jQuery(NuGet) | = 1.7.2 | No fix listed |
| nuget jQuery(NuGet) | = 1.8.0 | No fix listed |
| nuget jQuery(NuGet) | = 1.8.1 | No fix listed |
| nuget jQuery(NuGet) | = 1.8.2 | No fix listed |
| nuget jQuery(NuGet) | = 1.8.3 | No fix listed |
| nuget jQuery(NuGet) | = 1.9.0 | No fix listed |
| nuget jQuery(NuGet) | = 1.9.1 | No fix listed |
| nuget jQuery(NuGet) | = 1.12.3 | No fix listed |
| nuget jQuery(NuGet) | = 1.12.4 | No fix listed |
| nuget jQuery(NuGet) | = 2.0.0 | No fix listed |
| nuget jQuery(NuGet) | = 2.0.1 | No fix listed |
| nuget jQuery(NuGet) | = 2.0.1.1 | No fix listed |
| nuget jQuery(NuGet) | = 2.0.2 | No fix listed |
| nuget jQuery(NuGet) | = 2.0.3 | No fix listed |
| nuget jQuery(NuGet) | = 2.1.0 | No fix listed |
| nuget jQuery(NuGet) | = 2.1.1 | No fix listed |
| nuget jQuery(NuGet) | = 2.1.2 | No fix listed |
| nuget jQuery(NuGet) | = 2.1.3 | No fix listed |
| nuget jQuery(NuGet) | = 2.1.4 | No fix listed |
| nuget jQuery(NuGet) | = 2.2.0 | No fix listed |
| nuget jQuery(NuGet) | = 2.2.1 | No fix listed |
| nuget jQuery(NuGet) | = 2.2.2 | No fix listed |
| nuget jQuery(NuGet) | = 2.2.3 | No fix listed |
| nuget jQuery(NuGet) | = 2.2.4 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 0.1.1 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 0.1.2 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 0.1.3 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 0.2 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 0.2.1 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 0.2.2 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 0.2.3 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 0.2.4 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 0.2.5 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 0.2.6 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 0.2.7 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.1 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.10 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.11 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.12 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.13 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.14 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.15 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.16 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.17 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.18 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.19 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.2 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.3 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.4 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.5 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.6 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.7 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.8 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.9 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 1.0.rc | No fix listed |
| rubygems jquery-rails(RubyGems) | = 2.0.1 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 2.0.2 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 2.0.3 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 2.1.0 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 2.1.1 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 2.1.2 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 2.1.3 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 2.1.4 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 2.2.0 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 2.2.1 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 2.2.2 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 2.3.0 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 3.0.0 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 3.0.1 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 3.0.2 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 3.0.3 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 3.0.4 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 3.1.0 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 3.1.1 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 3.1.2 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 3.1.3 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 3.1.4 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 3.1.5 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 4.0.0 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 4.0.0.beta1 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 4.0.0.beta2 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 4.0.1 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 4.0.2 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 4.0.3 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 4.0.4 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 4.0.5 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 4.1.0 | No fix listed |
| rubygems jquery-rails(RubyGems) | = 4.1.1 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 1.11.0 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 1.11.1 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 1.11.3 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 1.12.1 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 1.7.2 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 1.7.3 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 1.8.2 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 1.8.3 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 1.9.1 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 1.12.3 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 1.12.4 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 2.1.0 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 2.1.1 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 2.1.1-rc1 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 2.1.1-rc2 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 2.1.3 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 2.1.4 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 2.2.0 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 2.2.1 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 2.2.2 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 2.2.3 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 2.2.4 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 3.0.0-alpha1 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 3.0.0-beta1 | No fix listed |
| org.webjars.npm/jquery(Maven) | = 3.0.0-rc1 | No fix listed |
| jquery | < 3.0.0 | 3.0.0 |
| oracle agile product lifecycle management for process | = 6.2.0.0 | No fix listed |
| oracle agile product lifecycle management for process | = 6.2.1.0 | No fix listed |
| oracle agile product lifecycle management for process | = 6.2.2.0 | No fix listed |
| oracle agile product lifecycle management for process | = 6.2.3.0 | No fix listed |
| oracle agile product lifecycle management for process | = 6.2.3.1 | No fix listed |
| oracle banking platform | = 2.6.0 | No fix listed |
| oracle banking platform | = 2.6.1 | No fix listed |
| oracle banking platform | = 2.6.2 | No fix listed |
| oracle business process management suite | = 11.1.1.9.0 | No fix listed |
| oracle business process management suite | = 12.1.3.0.0 | No fix listed |
| oracle business process management suite | = 12.2.1.3.0 | No fix listed |
| oracle communications converged application server | < 7.0.0.1 | 7.0.0.1 |
| oracle communications interactive session recorder | = 6.0 | No fix listed |
| oracle communications interactive session recorder | = 6.1 | No fix listed |
| oracle communications interactive session recorder | = 6.2 | No fix listed |
| oracle communications services gatekeeper | < 6.1.0.4.0 | 6.1.0.4.0 |
| oracle communications webrtc session controller | < 7.2 | 7.2 |
| oracle endeca information discovery studio | = 3.1.0 | No fix listed |
| oracle endeca information discovery studio | = 3.2.0 | No fix listed |
| oracle enterprise manager ops center | = 12.2.2 | No fix listed |
| oracle enterprise manager ops center | = 12.3.3 | No fix listed |
| oracle enterprise operations monitor | = 3.4 | No fix listed |
| oracle enterprise operations monitor | = 4.0 | No fix listed |
| oracle financial services analytical applications infrastructure | >= 7.3.3, <= 7.3.5 | No fix listed |
| oracle financial services analytical applications infrastructure | >= 8.0.0, <= 8.0.7 | No fix listed |
| oracle financial services asset liability management | >= 8.0.4, <= 8.0.7 | No fix listed |
| oracle financial services data integration hub | >= 8.0.5, <= 8.0.7 | No fix listed |
| oracle financial services funds transfer pricing | >= 8.0.4, <= 8.0.7 | No fix listed |
| oracle financial services hedge management and ifrs valuations | >= 8.0.4, <= 8.0.7 | No fix listed |
| oracle financial services liquidity risk management | >= 8.0.2, <= 8.0.6 | No fix listed |
| oracle financial services loan loss forecasting and provisioning | >= 8.0.2, <= 8.0.7 | No fix listed |
| oracle financial services market risk measurement and management | = 8.0.5 | No fix listed |
| oracle financial services market risk measurement and management | = 8.0.6 | No fix listed |
| oracle financial services profitability management | >= 8.0.4, <= 8.0.6 | No fix listed |
| oracle financial services reconciliation framework | = 8.0.5 | No fix listed |
| oracle financial services reconciliation framework | = 8.0.6 | No fix listed |
| oracle fusion middleware mapviewer | = 12.2.1.3.0 | No fix listed |
| oracle healthcare foundation | = 7.1 | No fix listed |
| oracle healthcare foundation | = 7.2 | No fix listed |
| oracle healthcare translational research | = 3.1.0 | No fix listed |
| oracle hospitality cruise fleet management | = 9.0.11 | No fix listed |
| oracle hospitality guest access | = 4.2.0 | No fix listed |
| oracle hospitality guest access | = 4.2.1 | No fix listed |
| oracle hospitality materials control | = 18.1 | No fix listed |
| oracle hospitality reporting and analytics | = 9.1.0 | No fix listed |
| oracle insurance insbridge rating and underwriting | = 5.2 | No fix listed |
| oracle insurance insbridge rating and underwriting | = 5.4 | No fix listed |
| oracle insurance insbridge rating and underwriting | = 5.5 | No fix listed |
| oracle JD Edwards EnterpriseOne Tools | = 9.2 | No fix listed |
| oracle jdeveloper | = 11.1.1.9.0 | No fix listed |
| oracle jdeveloper | = 12.1.3.0.0 | No fix listed |
| oracle jdeveloper | = 12.2.1.3.0 | No fix listed |
| oracle oss support tools | = 19.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com patch
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- RHSA-2020:0481 vendor-advisory
- RHSA-2020:0729 vendor-advisory
- ics-cert.us-cert.gov third-party-advisory us-government-resource
- kb.pulsesecure.net
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- 20190509 dotCMS v5.1.1 Vulnerabilities mailing-list
- security.netapp.com
- snyk.io patch third-party-advisory
- sw.aveva.com third-party-advisory
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com patch
- www.oracle.com patch
- www.oracle.com
- www.oracle.com
- www.tenable.com
- openSUSE-SU-2020:0395 vendor-advisory
- packetstormsecurity.com exploit
- packetstormsecurity.com exploit
- packetstormsecurity.com exploit
- 20190510 dotCMS v5.1.1 Vulnerabilities mailing-list
- 20190510 dotCMS v5.1.1 HTML Injection & XSS Vulnerability mailing-list
- 20190510 Re: dotCMS v5.1.1 HTML Injection & XSS Vulnerability mailing-list
- www.oracle.com patch
- security.snyk.io
- github.com
- github.com
- web.archive.org
- github.com
- github.com exploit
- github.com
- github.com product
- 105658 third-party-advisory vdb-entry
- [flink-dev] 20190811 Apache flink 1.7.2 security issues mailing-list
- [flink-user] 20190813 Apache flink 1.7.2 security issues mailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [flink-user] 20190813 Re: Apache flink 1.7.2 security issues mailing-list
- [flink-user] 20190811 Apache flink 1.7.2 security issues mailing-list
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [roller-commits] 20190820 [jira] [Created] (ROL-2150) Fix Js security vulnerabilities detected using retire js mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- security.alpinelinux.org vendor-advisory