Description
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | jquery | No fix yet | — |
| Ubuntu Pro 14.04 LTS | jquery | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | apache-commons-collections | 3.2.2-10.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | apache-commons-lang | 2.6-21.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | apache-commons-net | 3.6-3.module+el8.3.0+6805+72837426 | RHSA-2020:4847 |
| RHEL 8 | bea-stax +1 | 1.2.0-16.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | bind-dyndb-ldap | 11.3-1.module+el8.3.0+6993+104f8db0 | RHSA-2020:4670 |
| RHEL 8 | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2020:4670 |
| RHEL 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | glassfish-jaxb +3 | 2.2.11-11.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | ipa +9 | 4.8.7-12.module+el8.3.0+8223+6212645f | RHSA-2020:4670 |
| RHEL 8 | ipa-healthcheck +1 | 0.4-6.module+el8.3.0+7711+c4441980 | RHSA-2020:4670 |
| RHEL 8 | ipa-server +4 | 4.8.7-12.module+el8.3.0+8222+c1bff54a | RHSA-2020:4670 |
| RHEL 8 | jackson-core +2 | 2.10.0-1.module+el8.2.0+5059+3eb3af25 | RHSA-2020:4847 |
| RHEL 8 | jackson-jaxrs-providers +1 | 2.9.9-1.module+el8.1.0+3832+9784644d | RHSA-2020:4847 |
| RHEL 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | javassist +1 | 3.18.1-8.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | jss +1 | 4.7.3-1.module+el8.3.0+8058+d5cd4219 | RHSA-2020:4847 |
| RHEL 8 | ldapjdk +1 | 4.22.0-1.module+el8.3.0+6784+6e1e4c62 | RHSA-2020:4847 |
| RHEL 8 | opendnssec | 2.1.6-2.module+el8.3.0+6580+328a3362 | RHSA-2020:4670 |
| RHEL 8 | pki-ca +8 | 10.9.4-1.module+el8.3.0+8058+d5cd4219 | RHSA-2020:4847 |
| RHEL 8 | pki-servlet-engine +1 | 1:9.0.30-1.module+el8.3.0+6730+8f9c6254 | RHSA-2020:4847 |
| RHEL 8 | python-jwcrypto +1 | 0.5.0-1.module+el8.1.0+4107+4a66eb87 | RHSA-2020:4670 |
| RHEL 8 | python-kdcproxy +1 | 0.4-5.module+el8.2.0+4691+a05b2456 | RHSA-2020:4670 |
| RHEL 8 | python-nss +2 | 1.0.1-10.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | python-qrcode +2 | 5.1-12.module+el8.1.0+4107+4a66eb87 | RHSA-2020:4670 |
| RHEL 8 | python-yubico +1 | 1.3.2-9.module+el8.1.0+4107+4a66eb87 | RHSA-2020:4670 |
| RHEL 8 | pyusb +1 | 1.0.0-9.module+el8.1.0+4107+4a66eb87 | RHSA-2020:4670 |
| RHEL 8 | relaxngDatatype | 2011.1-7.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | resteasy | 3.0.26-3.module+el8.2.0+5723+4574fbff | RHSA-2020:4847 |
| RHEL 8 | slapi-nis | 0.56.5-4.module+el8.3.0+8222+c1bff54a | RHSA-2020:4670 |
| RHEL 8 | slf4j +1 | 1.7.25-4.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | softhsm +1 | 2.6.0-3.module+el8.3.0+6909+fb33717d | RHSA-2020:4670 |
| RHEL 8 | stax-ex | 1.7.7-8.module+el8.2.0+5723+4574fbff | RHSA-2020:4847 |
| RHEL 8 | tomcatjss | 7.5.0-1.module+el8.3.0+7355+c59bcbd9 | RHSA-2020:4847 |
| RHEL 8 | velocity | 1.7-24.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xalan-j2 | 2.7.1-38.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xerces-j2 | 2.11.0-34.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xml-commons-apis | 1.4.01-25.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xml-commons-resolver | 1.2-26.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xmlstreambuffer | 1.5.4-8.module+el8.2.0+5723+4574fbff | RHSA-2020:4847 |
| RHEL 8 | xsom | 0-19.20110809svn.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 7 | ipa +11 | 4.6.8-5.el7 | RHSA-2020:3936 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-apache-sshd | 2.9.2-1.redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.9.3-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.16-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-hibernate-search +5 | 5.10.13-3.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.10-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +10 | 2.12.7-1.redhat_00003.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-javaee-security-soteria +1 | 1.0.1-3.redhat_00003.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.49-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.3_spec | 3.0.0-6.SP07_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsp-api_2.3_spec | 2.0.0-3.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.27-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-24.Final_redhat_00023.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jettison | 1.5.2-1.redhat_00002.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.22-1.SP3_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.9-4.GA_redhat_00003.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.16-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-woodstox-core | 6.4.0-1.redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | custodia +1 | 0.6.0-3.module_el8.6.0+2881+2f24dc92 | ALSA-2020:4670 |
| AlmaLinux 8 | python3-jwcrypto | 0.5.0-1.module_el8.5.0+2641+983b221b | ALSA-2020:4670 |
| AlmaLinux 8 | python3-kdcproxy | 0.4-5.module_el8.6.0+2881+2f24dc92 | ALSA-2020:4670 |
| AlmaLinux 8 | python3-pyusb | 1.0.0-9.module_el8.5.0+2641+983b221b | ALSA-2020:4670 |
| AlmaLinux 8 | python3-qrcode +1 | 5.1-12.module_el8.5.0+2641+983b221b | ALSA-2020:4670 |
| AlmaLinux 8 | python3-yubico | 1.3.2-9.module_el8.5.0+2641+983b221b | ALSA-2020:4670 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | apache-commons-lang | 2.6-21.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | apache-commons-net | 3.6-3.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | bea-stax | 1.2.0-16.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | custodia | 0.6.0-3.module+el8.4.0+429+6bd33fea | RLSA-2020:4670 |
| Rocky Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | glassfish-jaxb | 2.2.11-11.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jackson-core +2 | 2.10.0-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jackson-jaxrs-providers | 2.9.9-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | javassist | 3.18.1-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | ldapjdk | 4.22.0-1.module+el8.4.0+418+b7ae1d4a | RLSA-2020:4847 |
| Rocky Linux 8 | pki-servlet-engine | 1:9.0.30-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | python-jwcrypto | 0.5.0-1.module+el8.4.0+429+6bd33fea | RLSA-2020:4670 |
| Rocky Linux 8 | python-kdcproxy | 0.4-5.module+el8.3.0+244+0b2ae752 | RLSA-2020:4670 |
| Rocky Linux 8 | python-nss | 1.0.1-10.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | python-qrcode | 5.1-12.module+el8.4.0+429+6bd33fea | RLSA-2020:4670 |
| Rocky Linux 8 | python-yubico | 1.3.2-9.module+el8.4.0+429+6bd33fea | RLSA-2020:4670 |
| Rocky Linux 8 | pyusb | 1.0.0-9.module+el8.4.0+429+6bd33fea | RLSA-2020:4670 |
| Rocky Linux 8 | relaxngDatatype | 2011.1-7.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | resteasy | 3.0.26-3.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | slf4j | 1.7.25-4.module+el8.3.0+74+855e3f5d | RLSA-2020:4847 |
| Rocky Linux 8 | stax-ex | 1.7.7-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | velocity | 1.7-24.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xalan-j2 | 2.7.1-38.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xerces-j2 | 2.11.0-34.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xml-commons-resolver | 1.2-26.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xsom | 0-19.20110809svn.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | ruby2.5 | 2.5.7-4.8.1 | SUSE-SU-2020:0737-1 |
| SLES 15 | ruby2.5 | 2.5.7-4.8.1 | SUSE-SU-2020:0737-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 | ruby2.5 | 2.5.7-4.8.1 | SUSE-SU-2020:0737-1 |
| SLE HPC 15 | ruby2.5 | 2.5.7-4.8.1 | SUSE-SU-2020:0737-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | ruby2.5 | 2.5.7-lp151.4.6.1 | openSUSE-SU-2020:0395-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | rabbitmq-server | 3.7.17-r0 | — |
| Alpine v3.23 | rabbitmq-server | 3.7.17-r0 | — |
| Alpine v3.22 | rabbitmq-server | 3.7.17-r0 | — |
| Alpine v3.21 | rabbitmq-server | 3.7.17-r0 | — |
| Alpine v3.20 | rabbitmq-server | 3.7.17-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.10 | ruby | 2.5.6-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | ipa-client +10 | 4.6.8-5.amzn2 | ALAS2-2020-1519 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ceph | 18.2.2-1 | — |
| Azure Linux 3 | python-blinker | 1.7.0-4 | — |
| Azure Linux 3 | python-httplib2 | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | apache-commons-lang | 2.6-21.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | apache-commons-net | 3.6-3.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | bea-stax-api | 1.2.0-16.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | bind-dyndb-ldap | 11.3-1.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | custodia +1 | 0.6.0-3.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | glassfish-jaxb-core +2 | 2.2.11-11.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | ipa-client +13 | 4.8.7-12.0.1.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | ipa-healthcheck +1 | 0.4-6.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | jackson-core +2 | 2.10.0-1.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | jackson-jaxrs-providers +1 | 2.9.9-1.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | javassist +1 | 3.18.1-8.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | jss +1 | 4.7.3-1.module+el8.3.0+7857+983338ee | ELSA-2020-4847 |
| Oracle Linux 8 | ldapjdk +1 | 4.22.0-1.module+el8.3.0+7857+983338ee | ELSA-2020-4847 |
| Oracle Linux 8 | opendnssec | 2.1.6-2.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | pki-ca +7 | 10.9.4-1.0.1.module+el8.3.0+7857+983338ee | ELSA-2020-4847 |
| Oracle Linux 8 | pki-servlet-engine +1 | 1:9.0.30-1.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | python3-jwcrypto | 0.5.0-1.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | python3-kdcproxy | 0.4-5.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | python3-nss +1 | 1.0.1-10.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | python3-pyusb | 1.0.0-9.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | python3-qrcode +1 | 5.1-12.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | python3-yubico | 1.3.2-9.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | relaxngDatatype | 2011.1-7.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | resteasy | 3.0.26-3.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | slapi-nis | 0.56.5-4.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | slf4j +1 | 1.7.25-4.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | softhsm +1 | 2.6.0-3.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | stax-ex | 1.7.7-8.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | tomcatjss | 7.5.0-1.module+el8.3.0+7857+983338ee | ELSA-2020-4847 |
| Oracle Linux 8 | velocity | 1.7-24.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | xalan-j2 | 2.7.1-38.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | xerces-j2 | 2.11.0-34.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | xml-commons-resolver | 1.2-26.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | xsom | 0-19.20110809svn.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 7 | ipa-client +10 | 4.6.8-5.0.1.el7 | ELSA-2020-3936 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 4 repositories
-
halkichi0308/CVE-2015-9251 ★ 9 · Dec 20, 2018
-
hackgiver/CVE-2015-9251 ★ 2 · Jan 8, 2025
This repository contains a Proof of Concept (PoC) for CVE-2015-9251, a vulnerability in jQuery versions prior to 3.0.0 that allows attackers to perform Cross-Site Scripting (XSS) attacks under certai…
-
moften/CVE-2015-9251 ★ 2 · Nov 1, 2024
PoC para CVE-2015-9251 jQuery menor a 3.0.0.
-
rox-11/xss ★ 0 · Jun 6, 2025
cve-2015-9251
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.webjars.npm:jquery | < 1.12.2 | 1.12.2 | GHSA-rmxg-73gg-4p98 |
| Maven | org.webjars.npm:jquery | >= 1.12.3, < 3.0.0 | 3.0.0 | GHSA-rmxg-73gg-4p98 |
| npm | jquery | < 1.12.2 | 1.12.2 | GHSA-rmxg-73gg-4p98 |
| npm | jquery | >= 1.12.3, < 3.0.0 | 3.0.0 | GHSA-rmxg-73gg-4p98 |
| NuGet | jQuery | < 1.12.2 | 1.12.2 | GHSA-rmxg-73gg-4p98 |
| NuGet | jQuery | >= 1.12.3, < 3.0.0 | 3.0.0 | GHSA-rmxg-73gg-4p98 |
| RubyGems | jquery-rails | < 4.2.0 | 4.2.0 | GHSA-rmxg-73gg-4p98 |
Advisories 28
- ALSA-2020:4670 Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2023:0554 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0552 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0553 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:4670 Red Hat Security Advisory: idm:DL1 and idm:client security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:3936 Red Hat Security Advisory: ipa security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2023-0239 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2026
- RHSA-2020:4847 Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- WID-SEC-2026-3721 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 4, 2026
- WID-SEC-2026-1752 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 31, 2026
- RLSA-2020:4847 Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2020:4670 Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2020:0395-1 Recommended update for ruby2.5 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1660 Oracle Utilities: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 28, 2025
- WID-SEC-2025-1212 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 2, 2025
- VDE-2019-009 PHOENIX CONTACT: Multiple Vulnerabilities in AXC F 2152 CERT@VDE · May 22, 2025
- VDE-2021-027 Pepperl+Fuchs: WirelessHART-Gateway - Vulnerability may allow remote attackers to cause a Denial Of Service CERT@VDE · May 14, 2025
- SUSE-SU-2020:0737-1 Recommended update for ruby2.5 SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-1872 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 15, 2024
- WID-SEC-2024-1682 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2024
- ICSA-22-097-01 Pepperl+Fuchs WirelessHART-Gateway CISA ICS & IT advisories · Apr 7, 2022
- ICSMA-21-187-01 Philips Vue PACS (Update B) CISA ICS & IT advisories · Apr 5, 2022
- ELSA-2020-4847 Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 10, 2020
- ELSA-2020-4670 Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 10, 2020
- ALAS2-2020-1519 Moderate: ipa security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 22, 2020
- ELSA-2020-3936 Moderate: ipa security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 6, 2020
- ICSA-19-155-01 PHOENIX CONTACT PLCNext AXC F 2152 CISA ICS & IT advisories · Jun 4, 2019
- ICSA-18-212-04 AVEVA InTouch Access Anywhere CISA ICS & IT advisories · Jul 31, 2018
References
- 105658 vdb-entry
- 20190509 dotCMS v5.1.1 Vulnerabilities mailing-list
- 20190510 dotCMS v5.1.1 HTML Injection & XSS Vulnerability mailing-list
- 20190510 dotCMS v5.1.1 Vulnerabilities mailing-list
- 20190510 Re: dotCMS v5.1.1 HTML Injection & XSS Vulnerability mailing-list
- [flink-user] 20190811 Apache flink 1.7.2 security issues mailing-list
- [flink-dev] 20190811 Apache flink 1.7.2 security issues mailing-list
- [flink-user] 20190813 Apache flink 1.7.2 security issues mailing-list
- [flink-user] 20190813 Re: Apache flink 1.7.2 security issues mailing-list
- [roller-commits] 20190820 [jira] [Created] (ROL-2150) Fix Js security vulnerabilities detected using retire js mailing-list
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- RHSA-2020:0481 vendor-advisory
- RHSA-2020:0729 vendor-advisory
- openSUSE-SU-2020:0395 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://github.com/jquery/jquery/issues/2432
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec126.pdf
- https://github.com/jquery/jquery/pull/2588/commits/c254d308a7d3f1eac4d0b42837804cfffcba4bb2
- https://snyk.io/vuln/npm:jquery:20150627
- https://github.com/jquery/jquery/pull/2588
- https://ics-cert.us-cert.gov/advisories/ICSA-18-212-04
- https://github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b0cc
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
- http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.tenable.com/security/tns-2019-08
- https://www.oracle.com/security-alerts/cpujan2020.html
- http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
- https://security.netapp.com/advisory/ntap-20210108-0004/