Cross-Site Scripting (XSS) in jquery

Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn't contain the dataType option. Recommendation Update to version 3.0.0 or later...

com.novocode:ornate_2.11 (>=0.3 <=0.5), com.novocode:ornate_2.12 (=0.6) +66 more potentially affected by CVE-2015-9251 via org.webjars.npm:jquery (>=1.12.3 <=3.0.0-rc1)

org.webjars.npm:jquery MAVEN version =1.12.3, =0.3, =0.2.0, =2.0.9, =1.0.4, =1.3.2, =5.0.3, =5.1.3 and more Source cves: CVE-2015-9251 Source advisory: OSV:GHSA-RMXG-73GG-4P98...

000demo (>=1.0.0 <=1.1.0), 03-npm-abc (>=1.0.0 <=1.1.0) +5128 more potentially affected by CVE-2015-9251 via jquery (>=1.12.3 <=2.2.4)

jquery NPM version =1.12.3, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.2.1, =0.1.75, =0.3.0, =1.0.0, =4.13.7-rc4, =0.65.0, =0.17.0, =0.24.2 and more Source cves: CVE-2015-9251 Source advisory: OSV:GHSA-RMXG-73GG-4P98...

0624zmj (=1.0.0), 192.168.0.172 (=4.6.1) +322 more potentially affected by CVE-2015-9251 via jquery (>=1.11.0 <=1.12.1)

jquery NPM version =1.11.0, =0.0.3, =0.0.6, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2 and more Source cves: CVE-2015-9251 Source advisory: OSV:GHSA-RMXG-73GG-4P98...

Cross-Site Scripting (XSS) in jquery

Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn't contain the dataType option...

Cross site scripting

jQuery before 3.0.0 is vulnerable to Cross-site Scripting XSS attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed...

ALPINE-CVE-2015-9251

jQuery before 3.0.0 is vulnerable to Cross-site Scripting XSS attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed...

AZL-40951 CVE-2012-6708 affecting package ceph for versions less than 18.2.2-1

jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '' character anywhere in the string, giving...

Stack overflow

jQuery 3.0.0-rc.1 is vulnerable to Denial of Service DoS due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit...

CVE-2016-10707

jQuery 3.0.0-rc.1 is vulnerable to Denial of Service DoS due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit...

ALPINE-CVE-2012-6708

jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '' character anywhere in the string, giving...

Cross site scripting

jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '' character anywhere in the string, giving...

CVE-2012-6708

jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '' character anywhere in the string, giving...

CVE-2016-10707

jQuery 3.0.0-rc.1 is vulnerable to Denial of Service DoS due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit...

AZL-43897 CVE-2012-6708 affecting package python-httplib2 0.20.3-3

jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '' character anywhere in the string, giving...

AZL-44730 CVE-2012-6708 affecting package python-httplib2 0.20.3-3

jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '' character anywhere in the string, giving...

CVE-2015-9251

jQuery before 3.0.0 is vulnerable to Cross-site Scripting XSS attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed...

AZL-45099 CVE-2015-9251 affecting package python-blinker for versions less than 1.7.0-4

jQuery before 3.0.0 is vulnerable to Cross-site Scripting XSS attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed...

AZL-44937 CVE-2012-6708 affecting package python-blinker for versions less than 1.7.0-4

jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '' character anywhere in the string, giving...

CVE-2016-10707

jQuery 3.0.0-rc.1 is vulnerable to Denial of Service DoS due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit...