← back
CVE-2015-9251

CVE-2015-9251

EPSS 30.2%
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Affected products
n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.htmlhttp://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.htmlhttp://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.htmlhttp://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.htmlhttps://access.redhat.com/errata/RHSA-2020:0481https://access.redhat.com/errata/RHSA-2020:0729http://seclists.org/fulldisclosure/2019/May/10http://seclists.org/fulldisclosure/2019/May/11http://seclists.org/fulldisclosure/2019/May/13https://github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b0cchttps://github.com/jquery/jquery/issues/2432https://github.com/jquery/jquery/pull/2588