jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions jQuery only deems the input to be HTML if it explicitly starts with the '<' character limiting exploitability only to attackers who can control the beginning of a string which is far less common.

...

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option causing text/javascript responses to be executed.

...

CVE-2019-11358

...

AZL-49149 CVE-2024-45590 affecting package js-jquery 3.5.0-4

body-parser is Node.js body parsing middleware. body-parser 1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in...

AZL-49103 CVE-2024-45296 affecting package js-jquery 3.5.0-4

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...

AZL-49158 CVE-2024-45296 affecting package js-jquery 3.5.0-4

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...

K000141005: jQuery vulnerability CVE-2020-7656

Security Advisory Description jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "", which results in the enclosed script logic to be executed. CVE-2020-7656 Impact There is no impact; F5 products are not affected by this...

Security Bulletin: Vulnerabilities in Apache Ant affect IBM Operations Analytics - Log Analysis (CVE-2020-11023, CVE-2020-23064, CVE-2020-11022)

Summary There are multple cross site scripting vulnerabilities in Apache Ant that effect IBM Operations Analytics - Log Analysis. These have been addressed. Vulnerability Details CVEID:CVE-2020-11023 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of...

CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4

CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4. A patched version of the package is available...

School Log Management System 1.0 SQL Injection / Code Execution

============================================================================================================================================= | Title : School Log Management System 1.0 WYSIWYG Settings Management Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser :...

Simple College Website 1.0 SQL Injection / Code Execution

============================================================================================================================================= | Title : Simple College Website 1.0 WYSIWYG Settings Management Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla...

CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4

CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4. A patched version of the package is available...

Hotel Management System 1.0 Arbitrary File Upload

============================================================================================================================================= | Title : Hotel Management System 1.0 Remote File Upload Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...

MAL-2024-7743 Malicious code in jquery-ui-dialog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f1ac81ca06088c1af7f942bcd5c3e05a81ee19ded09f4417b8eea369da63f3c3 The OpenSSF Package Analysis project identified 'jquery-ui-dialog' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in jquery-ui-dialog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f1ac81ca06088c1af7f942bcd5c3e05a81ee19ded09f4417b8eea369da63f3c3 The OpenSSF Package Analysis project identified 'jquery-ui-dialog' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in atlassian-plugins-jquery (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fa70e76a995c21512e5537f8ba45c8143816593a98f504f5ac88ad3e752d9eaa The OpenSSF Package Analysis project identified 'atlassian-plugins-jquery' @ 0.0.0-dev npm as malicious. It is considered malicious because: - T...

MAL-2024-7732 Malicious code in atlassian-plugins-jquery (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fa70e76a995c21512e5537f8ba45c8143816593a98f504f5ac88ad3e752d9eaa The OpenSSF Package Analysis project identified 'atlassian-plugins-jquery' @ 0.0.0-dev npm as malicious. It is considered malicious because: - T...

OPENSUSE-SU-2024:14169-1 ruby3.3-rubygem-jquery-rails-4.6.0-1.5 on GA media

These are all security issues fixed in the ruby3.3-rubygem-jquery-rails-4.6.0-1.5 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:14131-1 python310-XStatic-jquery-ui-1.13.0.1-1.15 on GA media

These are all security issues fixed in the python310-XStatic-jquery-ui-1.13.0.1-1.15 package on the GA media of openSUSE Tumbleweed...

CVE-2024-32753 TYCO Illustra Pro Gen 4 - JQuery version

Under certain circumstances the camera may be susceptible to known vulnerabilities associated with the JQuery versions prior to 3.5.0 third-party component...