jquery jquery vulnerabilities and exploits

(subscribe to this query)

Cross-site scripting (XSS) vulnerability in jQuery prior to 1.6.3, when using location.hash to select elements, allows remote malicious users to inject arbitrary web script or HTML via a crafted tag.

Jquery Jquery Jquery Jquery 1.6 Jquery Jquery 1.6.1

1 Github repository

In Wicket jQuery UI 6.28.0 and previous versions, 7.9.1 and previous versions, and 8.0.0-M8 and previous versions, a security issue has been discovered in the WYSIWYG editor that allows an malicious user to submit arbitrary JS code to WYSIWYG editor.

Wicket-jquery-ui Project Wicket-jquery-ui Wicket-jquery-ui Project Wicket-jquery-ui 7.0.0 Wicket-jquery-ui Project Wicket-jquery-ui 7.0.1 Wicket-jquery-ui Project Wicket-jquery-ui 7.0.2 Wicket-jquery-ui Project Wicket-jquery-ui 7.1.0 Wicket-jquery-ui Project Wicket-jquery-ui 7.2.0 Wicket-jquery-ui Project Wicket-jquery-ui 7.2.1 Wicket-jquery-ui Project Wicket-jquery-ui 7.3.0 Wicket-jquery-ui Project Wicket-jquery-ui 7.3.1 Wicket-jquery-ui Project Wicket-jquery-ui 7.4.0 Wicket-jquery-ui Project Wicket-jquery-ui 7.5.0 Wicket-jquery-ui Project Wicket-jquery-ui 7.6.0

In Apache wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display.

Wicket-jquery-ui Project Wicket-jquery-ui Wicket-jquery-ui Project Wicket-jquery-ui 7.0.0 Wicket-jquery-ui Project Wicket-jquery-ui 8.0.0

jQuery prior to 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' char...

1 Github repository

jQuery 1.4.2 allows remote malicious users to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after.

Jquery Jquery 1.4.2

jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry

Jquery Jquery 2.2.2

jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.

Jquery Jquery 3.0.0

2 Github repositories

The jQuery framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote malicious users to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures t...

Jquery Jquery -Netapp Snapcenter -

jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6.

Jquery-minicolors Project Jquery-minicolors

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-sparkle 1.5.2-beta allows a malicious user to inject properties into Object.prototype.

Jquery-sparkle Project Jquery-sparkle 1.5.2

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook