Priority CRITICAL 88KEV
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.
CVSS 3.1MEDIUM 6.9· Network · No auth · User interaction · EPSS 0.84887 · Published 2020-04-29 · Partial fix · 3.5.0, 4.4.0 CWE-79
Priority HIGH 75
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.
CVSS 3.1MEDIUM 6.9· Network · No auth · User interaction · EPSS 0.99215 · Published 2020-04-29 · Partial fix · 3.5.0, 4.4.0 +2 CWE-79
Priority HIGH 69
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.8682 · Published 2019-04-19 · Partial fix · 3.4.0, 4.3.4 +3 CWE-1321
Priority MEDIUM 60
jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0269 · Published 2022-07-20 · Partial fix · 1.13.2, 8.0.0 CWE-79
Priority MEDIUM 57
jQuery-UI is the official jQuery user interface library.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.40768 · Published 2021-10-26 · Partial fix · 1.13.0, 7.0.0 CWE-79
Priority MEDIUM 56
jQuery-UI is the official jQuery user interface library.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.39361 · Published 2021-10-26 · Partial fix · 1.13.0, 7.0.0 CWE-79
Priority MEDIUM 51
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.29726 · Published 2018-01-18 · Partial fix · 1.12.2, 3.0.0 +1 CWE-79
Priority MEDIUM 40
jQuery-UI is the official jQuery user interface library.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.08533 · Published 2021-10-26 · Partial fix · 1.13.0, 7.0.0 CWE-79
Priority LOW 39
jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03232 · Published 2018-01-18 · Fixed in 3.0.0 CWE-674
Priority LOW 39
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.08632 · Published 2018-01-18 · Partial fix · 1.9.0, 2.2.0 CWE-79
Priority LOW 38
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.19191 · Published 2013-03-08 · Partial fix · 1.6.3, 1.0.16 CWE-79
Priority LOW 37
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.06428 · Published 2020-05-19 · Partial fix · 1.9.0, 2.2.0 CWE-79
Priority LOW 32
jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02338 · Published 2018-01-16 · No fix listed CWE-79
Priority LOW 31
jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01661 · Published 2020-04-22 · Will not fix CWE-79
Priority LOW 28
The jQuery framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL i…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.02771 · Published 2007-04-30 · No fix listed CWE-200
THREATIST.IORead the docs