Read the docs
TI-2015-07630 Aliases CVE-2015-9251GHSA-rmxg-73gg-4p98

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a…

Priority MEDIUM 51CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 14 fixed, 13 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Why it matters now

EPSS 0.29726 98th percentileScored 2026-11-07
Fix Partial jquery (npm): 1.12.2, 3.0.0jQuery (NuGet): 1.12.2, 3.0.0+2 more productsRed Hat: 10 advisoriesRed Hat: 14 fixed, 13 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—jquery (npm)before 1.12.21.12.2Patch availableGHSA-rmxg-73gg-4p98
—jQuery (NuGet)before 1.12.21.12.2Patch availableGHSA-rmxg-73gg-4p98
—jQuery (NuGet)1.12.3 to before 3.0.03.0.0Patch availableGHSA-rmxg-73gg-4p98
—jquery (npm)1.12.3 to before 3.0.03.0.0Patch availableGHSA-rmxg-73gg-4p98
—jquery-rails (RubyGems)before 4.2.04.2.0Patch availableGHSA-rmxg-73gg-4p98
—org.webjars.npm:jquery (Maven)before 1.12.21.12.2Patch availableGHSA-rmxg-73gg-4p98
—org.webjars.npm:jquery (Maven)1.12.3 to before 3.0.03.0.0Patch availableGHSA-rmxg-73gg-4p98
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • jquery (npm) Vendor— Affected before 1.12.2 Fixed in 1.12.2 Patch available GHSA-rmxg-73gg-4p98
  • jQuery (NuGet) Vendor— Affected before 1.12.2 Fixed in 1.12.2 Patch available GHSA-rmxg-73gg-4p98
  • jQuery (NuGet) Vendor— Affected 1.12.3 to before 3.0.0 Fixed in 3.0.0 Patch available GHSA-rmxg-73gg-4p98
  • jquery (npm) Vendor— Affected 1.12.3 to before 3.0.0 Fixed in 3.0.0 Patch available GHSA-rmxg-73gg-4p98
  • jquery-rails (RubyGems) Vendor— Affected before 4.2.0 Fixed in 4.2.0 Patch available GHSA-rmxg-73gg-4p98
  • org.webjars.npm:jquery (Maven) Vendor— Affected before 1.12.2 Fixed in 1.12.2 Patch available GHSA-rmxg-73gg-4p98
  • org.webjars.npm:jquery (Maven) Vendor— Affected 1.12.3 to before 3.0.0 Fixed in 3.0.0 Patch available GHSA-rmxg-73gg-4p98

CPE configurations NVD · 80

CPEVersionsRoleVendor
cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*before 3.0.0VulnerableJQuery
cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:*6.2.0.0VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.1.0:*:*:*:*:*:*:*6.2.1.0VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.2.0:*:*:*:*:*:*:*6.2.2.0VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.0:*:*:*:*:*:*:*6.2.3.0VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.1:*:*:*:*:*:*:*6.2.3.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*2.6.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*2.6.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*2.6.2VulnerableOracle
cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:*:*:*:*:*:*:*11.1.1.9.0VulnerableOracle
  • cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* Versions before 3.0.0 Vulnerable ·JQuery
  • cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:* Versions 6.2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.1.0:*:*:*:*:*:*:* Versions 6.2.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.2.0:*:*:*:*:*:*:* Versions 6.2.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.0:*:*:*:*:*:*:* Versions 6.2.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.1:*:*:*:*:*:*:* Versions 6.2.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
Show 70 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:*before 7.0.0.1VulnerableOracle
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.0:*:*:*:*:*:*:*6.0VulnerableOracle
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.1:*:*:*:*:*:*:*6.1VulnerableOracle
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.2:*:*:*:*:*:*:*6.2VulnerableOracle
cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:*before 6.1.0.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:*before 7.2VulnerableOracle
cpe:2.3:a:oracle:endeca_information_discovery_studio:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableOracle
cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*12.2.2VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*12.3.3VulnerableOracle
cpe:2.3:a:oracle:enterprise_operations_monitor:3.4:*:*:*:*:*:*:*3.4VulnerableOracle
cpe:2.3:a:oracle:enterprise_operations_monitor:4.0:*:*:*:*:*:*:*4.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*7.3.3 – 7.3.5; 8.0.0 – 8.0.7VulnerableOracle
cpe:2.3:a:oracle:financial_services_asset_liability_management:*:*:*:*:*:*:*:*8.0.4 – 8.0.7VulnerableOracle
cpe:2.3:a:oracle:financial_services_data_integration_hub:*:*:*:*:*:*:*:*8.0.5 – 8.0.7VulnerableOracle
cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:*:*:*:*:*:*:*:*8.0.4 – 8.0.7VulnerableOracle
cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:*8.0.4 – 8.0.7VulnerableOracle
cpe:2.3:a:oracle:financial_services_liquidity_risk_management:*:*:*:*:*:*:*:*8.0.2 – 8.0.6VulnerableOracle
cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:*8.0.2 – 8.0.7VulnerableOracle
cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.5:*:*:*:*:*:*:*8.0.5VulnerableOracle
cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*8.0.6VulnerableOracle
cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:*8.0.4 – 8.0.6VulnerableOracle
cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.5:*:*:*:*:*:*:*8.0.5VulnerableOracle
cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.6:*:*:*:*:*:*:*8.0.6VulnerableOracle
cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:healthcare_foundation:7.1:*:*:*:*:*:*:*7.1VulnerableOracle
cpe:2.3:a:oracle:healthcare_foundation:7.2:*:*:*:*:*:*:*7.2VulnerableOracle
cpe:2.3:a:oracle:healthcare_translational_research:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableOracle
cpe:2.3:a:oracle:hospitality_cruise_fleet_management:9.0.11:*:*:*:*:*:*:*9.0.11VulnerableOracle
cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableOracle
cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*4.2.1VulnerableOracle
cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:*18.1VulnerableOracle
cpe:2.3:a:oracle:hospitality_reporting_and_analytics:9.1.0:*:*:*:*:*:*:*9.1.0VulnerableOracle
cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.2:*:*:*:*:*:*:*5.2VulnerableOracle
cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.4:*:*:*:*:*:*:*5.4VulnerableOracle
cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.5:*:*:*:*:*:*:*5.5VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*9.2VulnerableOracle
cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:*11.1.1.9.0VulnerableOracle
cpe:2.3:a:oracle:jdeveloper:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:oss_support_tools:19.1:*:*:*:*:*:*:*19.1VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*8.55VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*8.56VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*8.57VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:15.2:*:*:*:*:*:*:*15.2VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:*16.2VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:17.12:*:*:*:*:*:*:*17.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*17.1 – 17.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*16.1VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*16.2VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:real-time_scheduler:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_allocation:15.0.2:*:*:*:*:*:*:*15.0.2VulnerableOracle
cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_invoice_matching:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_sales_audit:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_workforce_management_software:1.60.9:*:*:*:*:*:*:*1.60.9VulnerableOracle
cpe:2.3:a:oracle:retail_workforce_management_software:1.64.0:*:*:*:*:*:*:*1.64.0VulnerableOracle
cpe:2.3:a:oracle:service_bus:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:siebel_ui_framework:18.10:*:*:*:*:*:*:*18.10VulnerableOracle
cpe:2.3:a:oracle:siebel_ui_framework:18.11:*:*:*:*:*:*:*18.11VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*4.3.0.1 – 4.3.0.4VulnerableOracle
cpe:2.3:a:oracle:utilities_mobile_workforce_management:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:*11.1.1.8.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:*12.1.3.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*12.2.1.3VulnerableOracle
  • cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:* Versions before 7.0.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_interactive_session_recorder:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_interactive_session_recorder:6.1:*:*:*:*:*:*:* Versions 6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_interactive_session_recorder:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:* Versions before 6.1.0.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:* Versions before 7.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:endeca_information_discovery_studio:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:* Versions 12.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* Versions 12.3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_operations_monitor:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_operations_monitor:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 7.3.3 – 7.3.5; 8.0.0 – 8.0.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_asset_liability_management:*:*:*:*:*:*:*:* Versions 8.0.4 – 8.0.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_data_integration_hub:*:*:*:*:*:*:*:* Versions 8.0.5 – 8.0.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:*:*:*:*:*:*:*:* Versions 8.0.4 – 8.0.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:* Versions 8.0.4 – 8.0.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_liquidity_risk_management:*:*:*:*:*:*:*:* Versions 8.0.2 – 8.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:* Versions 8.0.2 – 8.0.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.5:*:*:*:*:*:*:* Versions 8.0.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:* Versions 8.0.4 – 8.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.5:*:*:*:*:*:*:* Versions 8.0.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_foundation:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_foundation:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_translational_research:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_cruise_fleet_management:9.0.11:*:*:*:*:*:*:* Versions 9.0.11 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* Versions 18.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_reporting_and_analytics:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.2:*:*:*:*:*:*:* Versions 5.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.4:*:*:*:*:*:*:* Versions 5.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.5:*:*:*:*:*:*:* Versions 5.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdeveloper:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oss_support_tools:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:* Versions 8.55 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* Versions 8.56 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:17.12:*:*:*:*:*:*:* Versions 17.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.1 – 17.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:real-time_scheduler:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_allocation:15.0.2:*:*:*:*:*:*:* Versions 15.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_invoice_matching:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_sales_audit:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_workforce_management_software:1.60.9:*:*:*:*:*:*:* Versions 1.60.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_workforce_management_software:1.64.0:*:*:*:*:*:*:* Versions 1.64.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:service_bus:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_ui_framework:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_ui_framework:18.11:*:*:*:*:*:*:* Versions 18.11 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:* Versions 4.3.0.1 – 4.3.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_mobile_workforce_management:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:* Versions 11.1.1.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:* Versions 12.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:* Versions 12.2.1.3 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-rmxg-73gg-4p98 jquery (npm) Fixed in 1.12.2 Advisory →
  • Fix · GHSA-rmxg-73gg-4p98 jQuery (NuGet) Fixed in 1.12.2 Advisory →
  • Fix · GHSA-rmxg-73gg-4p98 jQuery (NuGet) Fixed in 3.0.0 Advisory →
  • Fix · GHSA-rmxg-73gg-4p98 jquery (npm) Fixed in 3.0.0 Advisory →
  • Fix · GHSA-rmxg-73gg-4p98 jquery-rails (RubyGems) Fixed in 4.2.0 Advisory →
  • Fix · GHSA-rmxg-73gg-4p98 org.webjars.npm:jquery (Maven) Fixed in 1.12.2 Advisory →
  • Fix · GHSA-rmxg-73gg-4p98 org.webjars.npm:jquery (Maven) Fixed in 3.0.0 Advisory →

Red Hat 10 advisories

  • RHSA-2023:0556 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss Enterprise Application Platform 7.4.9 com.fasterxml.jackson.core.jackson-databind-2.12.7.redhat-00003.jar, com.fasterxml.woodstox.woodstox-core-6.4.0.redhat-00001.jar, org.apache.cxf.cxf-core-3.4.10.redhat-00001.jar +4
  • RHSA-2023:0554 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el9eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el9eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el9eap +44
  • RHSA-2023:0552 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd-2.9.2-1.redhat_00001.1.el7eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el7eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el7eap +46
Show 7 more Red Hat advisories
  • RHSA-2023:0553 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el8eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el8eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el8eap +44
  • RHSA-2020:4847 Released 2020-11-04 · Red Hat rating Moderate
    pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
  • RHSA-2020:4670 Released 2020-11-04 · Red Hat rating Moderate
    idm:DL1 and idm:client security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.aarch64::idm:DL1, bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.ppc64le::idm:DL1, bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.s390x::idm:DL1 +47
  • RHSA-2020:3936 Released 2020-09-29 · Red Hat rating Moderate
    ipa security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Client (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +4
    • Red Hat Enterprise Linux Client Optional (v. 7) ipa-server-4.6.8-5.el7, ipa-server-common-4.6.8-5.el7, ipa-server-dns-4.6.8-5.el7 +2
    • Red Hat Enterprise Linux ComputeNode (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +4
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server-4.6.8-5.el7, ipa-server-common-4.6.8-5.el7, ipa-server-dns-4.6.8-5.el7 +2
    • Red Hat Enterprise Linux Server (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +9
    • Red Hat Enterprise Linux Workstation (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +9
  • RHSA-2020:0983 Released 2020-03-26 · Red Hat rating Important
    Red Hat Fuse 7.6.0 security update
    • Red Hat Fuse 7.6.0
  • RHSA-2020:0729 Released 2020-03-05 · Red Hat rating Important
    Red Hat Data Grid 7.3.5 security update
    • Red Hat Data Grid 7.3.5
  • RHSA-2020:0481 Released 2020-02-12 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.3 R15 security and bug fix update
    • Red Hat Fuse 6.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 6 (Juno)AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 6 (Juno) InstallerAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)AffectedNo fix planned: Will not fix
Red Hat OpenShift Enterprise 2AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 11 (Ocata)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 8 (Liberty)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 9 (Mitaka)AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Subscription Asset ManagerAffectedNo fix planned: Will not fix
Red Hat Data Grid 7.3.5Fixed RHSA-2020:0729
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4670, RHSA-2020:4847
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:3936
Red Hat Fuse 6.3Fixed RHSA-2020:0481
Red Hat Fuse 7.6.0Fixed RHSA-2020:0983
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:0552
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:0553
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:0554
Red Hat JBoss Enterprise Application Platform 7.4.9Fixed RHSA-2023:0556
Not affected: 6 products
  • Red Hat Enterprise Linux 7
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 7.4.9
  • Red Hat Quay 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-9251
  2. 2026-10-03 Alias added: GHSA-rmxg-73gg-4p98

References

Patch 7

Advisory 6

Other 41

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences