CVE Feed

    Dashboard / CVE / CVE-2015-9251

    CVE-2015-9251

    jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

    Published:Jun 27, 2015
    Last Modified:Nov 21, 2024
    EPS:Jan 18, 2018
    EPSS Score:0.11287
    CVSS Score:6.1

    Affected Products

    Vendor
    Jquery
    Product
    Jquery
    Vendor
    Oracle
    Product
    Agile Product Lifecycle Management For Process
    Vendor
    Oracle
    Product
    Banking Platform
    Vendor
    Oracle
    Product
    Business Process Management Suite
    Vendor
    Oracle
    Product
    Communications Converged Application Server
    Vendor
    Oracle
    Product
    Communications Interactive Session Recorder
    Vendor
    Oracle
    Product
    Communications Services Gatekeeper
    Vendor
    Oracle
    Product
    Communications Webrtc Session Controller
    Vendor
    Oracle
    Product
    Endeca Information Discovery Studio
    Vendor
    Oracle
    Product
    Enterprise Manager Ops Center
    Vendor
    Oracle
    Product
    Enterprise Operations Monitor
    Vendor
    Oracle
    Product
    Financial Services Analytical Applications Infrastructure
    Vendor
    Oracle
    Product
    Financial Services Asset Liability Management
    Vendor
    Oracle
    Product
    Financial Services Data Integration Hub
    Vendor
    Oracle
    Product
    Financial Services Funds Transfer Pricing
    Vendor
    Oracle
    Product
    Financial Services Hedge Management And Ifrs Valuations
    Vendor
    Oracle
    Product
    Financial Services Liquidity Risk Management
    Vendor
    Oracle
    Product
    Financial Services Loan Loss Forecasting And Provisioning
    Vendor
    Oracle
    Product
    Financial Services Market Risk Measurement And Management
    Vendor
    Oracle
    Product
    Financial Services Profitability Management
    Vendor
    Oracle
    Product
    Financial Services Reconciliation Framework
    Vendor
    Oracle
    Product
    Fusion Middleware Mapviewer
    Vendor
    Oracle
    Product
    Healthcare Foundation
    Vendor
    Oracle
    Product
    Healthcare Translational Research
    Vendor
    Oracle
    Product
    Hospitality Cruise Fleet Management
    Vendor
    Oracle
    Product
    Hospitality Guest Access
    Vendor
    Oracle
    Product
    Hospitality Materials Control
    Vendor
    Oracle
    Product
    Hospitality Reporting And Analytics
    Vendor
    Oracle
    Product
    Insurance Insbridge Rating And Underwriting
    Vendor
    Oracle
    Product
    Jd Edwards Enterpriseone Tools
    Vendor
    Oracle
    Product
    Jdeveloper
    Vendor
    Oracle
    Product
    Oss Support Tools
    Vendor
    Oracle
    Product
    Peoplesoft Enterprise Peopletools
    Vendor
    Oracle
    Product
    Primavera Gateway
    Vendor
    Oracle
    Product
    Primavera Unifier
    Vendor
    Oracle
    Product
    Real-time Scheduler
    Vendor
    Oracle
    Product
    Retail Allocation
    Vendor
    Oracle
    Product
    Retail Customer Insights
    Vendor
    Oracle
    Product
    Retail Invoice Matching
    Vendor
    Oracle
    Product
    Retail Sales Audit
    Vendor
    Oracle
    Product
    Retail Workforce Management Software
    Vendor
    Oracle
    Product
    Service Bus
    Vendor
    Oracle
    Product
    Siebel Ui Framework
    Vendor
    Oracle
    Product
    Utilities Framework
    Vendor
    Oracle
    Product
    Utilities Mobile Workforce Management
    Vendor
    Oracle
    Product
    Webcenter Sites
    Vendor
    Oracle
    Product
    Weblogic Server
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Jboss Data Grid
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform
    Vendor
    Redhat
    Product
    Jboss Fuse

    Exploits

    https://github.com/hackgiver/CVE-2015-9251https://github.com/halkichi0308/CVE-2015-9251https://github.com/moften/CVE-2015-9251https://github.com/rox-11/xsshttps://github.com/wakefulblock262/CVE-2015-9251

    Related CVEs

    CVE-2020-7656 (CVSS 6.1) — jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recogn…
    CVE-2020-11023 (CVSS 6.9) — In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements …
    CVE-2020-11022 (CVSS 6.9) — In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing i…
    CVE-2018-18405 (CVSS 6.1) — jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been …
    CVE-2019-11358 (CVSS 6.1) — jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, .…
    CVE-2016-10707 (CVSS 7.5) — jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute n…
    CVE-2012-6708 (CVSS 6.1) — jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does no…
    CVE-2014-6071 (CVSS 6.1) — jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use …
    CVE-2011-4969 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, …
    CVE-2007-2379 (CVSS 5) — The jQuery framework exchanges data using JavaScript Object Notation (JSON) without an associated protection s…

    References

    http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
    http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
    http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
    http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
    http://seclists.org/fulldisclosure/2019/May/10
    http://seclists.org/fulldisclosure/2019/May/11
    http://seclists.org/fulldisclosure/2019/May/13
    http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
    http://www.securityfocus.com/bid/105658
    https://access.redhat.com/errata/RHSA-2020:0481
    https://access.redhat.com/errata/RHSA-2020:0729
    https://github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b0cc
    https://github.com/jquery/jquery/issues/2432
    https://github.com/jquery/jquery/pull/2588
    https://github.com/jquery/jquery/pull/2588/commits/c254d308a7d3f1eac4d0b42837804cfffcba4bb2
    https://ics-cert.us-cert.gov/advisories/ICSA-18-212-04
    https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
    https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E
    https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E
    https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E
    https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E
    https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E
    https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
    https://seclists.org/bugtraq/2019/May/18
    https://security.netapp.com/advisory/ntap-20210108-0004/
    https://snyk.io/vuln/npm:jquery:20150627
    https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec126.pdf
    https://www.oracle.com/security-alerts/cpuapr2020.html
    https://www.oracle.com/security-alerts/cpujan2020.html
    https://www.oracle.com/security-alerts/cpujul2020.html
    https://www.oracle.com/security-alerts/cpuoct2020.html
    https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
    https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
    https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
    https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
    https://www.tenable.com/security/tns-2019-08
    http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
    http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
    http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
    http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
    http://seclists.org/fulldisclosure/2019/May/10
    http://seclists.org/fulldisclosure/2019/May/11
    http://seclists.org/fulldisclosure/2019/May/13
    http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
    http://www.securityfocus.com/bid/105658
    https://access.redhat.com/errata/RHSA-2020:0481
    https://access.redhat.com/errata/RHSA-2020:0729
    https://github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b0cc
    https://github.com/jquery/jquery/issues/2432
    https://github.com/jquery/jquery/pull/2588
    https://github.com/jquery/jquery/pull/2588/commits/c254d308a7d3f1eac4d0b42837804cfffcba4bb2
    https://ics-cert.us-cert.gov/advisories/ICSA-18-212-04
    https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
    https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E
    https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E
    https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E
    https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E
    https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E
    https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
    https://seclists.org/bugtraq/2019/May/18
    https://security.netapp.com/advisory/ntap-20210108-0004/
    https://snyk.io/vuln/npm:jquery:20150627
    https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec126.pdf
    https://www.oracle.com/security-alerts/cpuapr2020.html
    https://www.oracle.com/security-alerts/cpujan2020.html
    https://www.oracle.com/security-alerts/cpujul2020.html
    https://www.oracle.com/security-alerts/cpuoct2020.html
    https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
    https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
    https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
    https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
    https://www.tenable.com/security/tns-2019-08

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High