CVE-2015-9251
50Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actepss 30%
from disclosure to weapon336 days
Published on NVDJan 18
1st PoC+336d
VulnCheck+1099d
exploitation probability
30%top 2% of all CVEs
observed exploitation
yesVulnCheck
4 public exploit(s)
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Affected products
n/a · n/apublic PoCs found — 4
vulncheckvulncheck.com/xdb/381aa158770eunverifiedvulncheckvulncheck.com/xdb/4880bf89722aunverifiedvulncheckvulncheck.com/xdb/f369e87c8fddunverifiedvulncheckvulncheck.com/xdb/f57a9b0742b1unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.htmlhttp://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.htmlhttp://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.htmlhttp://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.htmlhttps://access.redhat.com/errata/RHSA-2020:0481https://access.redhat.com/errata/RHSA-2020:0729http://seclists.org/fulldisclosure/2019/May/10http://seclists.org/fulldisclosure/2019/May/11http://seclists.org/fulldisclosure/2019/May/13https://github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b0cchttps://github.com/jquery/jquery/issues/2432https://github.com/jquery/jquery/pull/2588