Snyk
security.snyk.io › snyk vulnerability database › npm
jquery | Snyk
Security vulnerabilities and package health score for npm package jquery
Snyk
security.snyk.io › snyk vulnerability database › npm › jquery
jquery 3.2.1 | Snyk
Security vulnerabilities and package health score for npm package jquery 3.2.1
HackerOne
hackerone.com › reports › 454365
Node.js third-party modules disclosed on HackerOne: Prototype...
I would like to report prototype pollution in jQuery. It allows an attacker to inject properties on Object.prototype. # Module **module name:** jquery **version:** 3.3.1 **npm page:** `https://www.npmjs.com/package/jquery` ## Module Description jQuery is a fast, small, and feature-rich JavaScript library.
Rapid7
rapid7.com › db › vulnerabilities › jquery-cve-2019-11358
jQuery Vulnerability: CVE-2019-11358
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution.
Exploit-DB
exploit-db.com › exploits › 52141
jQuery 3.3.1 - Prototype Pollution & XSS Exploit - Multiple webapps Exploit
April 8, 2025 - # PoC (Proof of Concept): # ------------------------------------ /* * Exploit for CVE-2020-7656 and CVE-2019-11358 * Injects malicious JavaScript into a vulnerable page using jQuery <3.4.X */ COPY ALL PAYLOAD AND INSERT ON SITE AND IN BROWSER CONSOLE (F12) // 1. Load vulnerable jQuery (version 3.3.1) const script = document.createElement('script'); script.src = "https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"; document.head.appendChild(script); // 2.
Medium
medium.com › @hninja049 › writeup-hack-the-box-hdc-web-category-7d060b3fc114
Writeup Hack the box HDC [web category] | by NŪBSΞC | Medium
July 17, 2019 - there are two parameters that we can use, namely name1 and name2, then open jquery-3.2.1.js to get a username and password.
GitHub
github.com › jquery › jquery › issues › 3677
Location.Hash exploit cross site script JQuery all version · Issue #3677 · jquery/jquery
May 27, 2017 - This is the code for exploiting (location.hash) JQuery for Cross Site Scripting Browser : Chrome · <html> <head> <title>Jquery XSS</title> <script type="text/javascript" src="https://code.jquery.com/jquery-3.2.1.min.js"> </script> <script> $(location.hash.split('#')[1]); </script> </head> <body> Jquery DOM XSS </body> </html> xss.html#<video><source/onerror=alert(1)> Result : A alert popup was shown.
Published May 27, 2017
Author raminfp
Cybersecurity Help
cybersecurity-help.cz › vdb › soft › jquery › jquery › 3.2.1
Known vulnerabilities in The jQuery Team jQuery 3.2.1
List of known security vulnerabilities in The jQuery Team jQuery 3.2.1
Exploit-DB
exploit-db.com › exploits › 36124
jQuery - jui_filter_rules PHP Code Execution - PHP remote Exploit
February 19, 2015 - Proof of Concept ================ Using the demo application from the git repository: Executing shell_exec('cat /etc/passwd') Request: POST /ajax_create_sql.dist.php HTTP/1.0 host: http://www.example.com X-Requested-With: XMLHttpRequest Content-Type: application/x-www-form-urlencoded Content-Length: 471 a_rules[0][filter_value_conversion_server_side][function_name]=she ll_exec&a_rules[0][condition][filterValue]=&a_rules[0][filte r_value_conversion_server_side][args][0][value]=cat+/etc/pas swd&pst_placeholder=question_mark&a_rules[0][element_rule_id]=foo&use_ ps=yes&a_rules[0][condition][field]
Veracode
sourceclear.com › vulnerability-database › security › cross-site-scripting-xss- › javascript › sid-2250
Cross-site Scripting (XSS) Vulnerability in the jquery library ...
We cannot provide a description for this page right now
CVE Details
cvedetails.com › vulnerability-list › vendor_id-6538 › Jquery.html
Jquery : Security vulnerabilities, CVEs
.html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. Source: GitHub, Inc. ... In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.
GitHub
github.com › OSWeekends › curratelo › issues › 68
CVE-2020-11022 (Medium) detected in jquery-3.2.1.min.js · Issue #68 · OSWeekends/curratelo
May 1, 2020 - In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. Publish Date: 2020-04-29 · URL: CVE-2020-11022 · CVSS 3 Score Details (6.1) Base Score Metrics: Exploitability Metrics: Attack Vector: Network ·
Author mend-bolt-for-github
Exploit-DB
exploit-db.com › exploits › 51121
rukovoditel 3.2.1 - Cross-Site Scripting (XSS) - PHP webapps Exploit
March 28, 2023 - Data is read from `location.hash` and passed to `jQuery.parseHTML`. The attacker can use this vulnerability to create an unlimited number of accounts on this system until it crashed.
Cybersecurity Help
cybersecurity-help.cz › vdb › SB2019032804
Prototype pollution in jQuery
March 28, 2019 - Update to version 3.4.0. Vulnerable ...b58c9f722cd0808619b1b https://snyk.io/vuln/SNYK-JS-JQUERY-174006 ... Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet....
IBM
ibm.com › support › pages › security-bulletin-ibm®-engineering-lifecycle-engineering-product-using-jquery-321-vulnerable-cross-site-scripting-cve-2019-11358
Security Bulletin: The IBM® Engineering Lifecycle Engineering product using jQuery 3.2.1 is vulnerable to Cross Site Scripting - CVE-2019-11358
October 4, 2023 - Applications using jQuery before 3.4.0 are vulnerable cross site scripting for CVE-2019-11358. Following IBM® Engineering Lifecycle Engineering product is vulnerable to this attack, it has been addressed in this bulletin: IBM Jazz Reporting Service
Exploit-DB
exploit-db.com › exploits › 49766
jQuery 1.2 - Cross-Site Scripting (XSS) - Multiple webapps Exploit
April 14, 2021 - # Exploit Title: jQuery 1.2 - Cross-Site Scripting (XSS) # Date: 04/29/2020 # Exploit Author: Central InfoSec # Version: jQuery versions greater than or equal to 1.2 and before 3.5.0 # CVE : CVE-2020-11022 # Proof of Concept 1: <option><style></option></select><img src=x onerror=alert(1)></style>
GitHub
github.com › TIBCOSoftware › labs-air › issues › 37
CVE-2019-11358 (Medium) detected in jquery-2.1.3.min.js · Issue #37 · TIBCOSoftware/labs-air
January 27, 2020 - CVE-2019-11358 - Medium Severity Vulnerability Vulnerable Library - jquery-2.1.3.min.js JavaScript library for DOM operations Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js Path to dependency file: /...
Author mend-for-github-com
Tenable
tenable.com › plugins › nessus › 136929
JQuery 1.2 < 3.5.0 Multiple XSS<!-- --> | Tenable®
May 28, 2020 - According to the self-reported ... of JQuery hosted on the remote web server is greater than or equal to 1.2 and prior to 3.5.0. It is, therefore, affected by multiple cross site scripting vulnerabilities. Note, the vulnerabilities referenced in this plugin have no security impact on PAN-OS, and/or the scenarios required for successful exploitation do not exist ...
GitHub
github.com › opentok › opentok-elearning-samples › issues › 25
jquery-3.2.1.min.js: 3 vulnerabilities (highest severity is: 6.9) · Issue #25 · opentok/opentok-elearning-samples
June 9, 2022 - ❌ jquery-3.2.1.min.js (Vulnerable Library) Found in base branch: main · In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. Publish Date: 2020-04-29 · URL: CVE-2020-11023 · Exploit Maturity: Proof of concept ·
Author mend-for-github-com
CVE Details
cvedetails.com › version-list › 6538 › 11031 › 1 › Jquery-Jquery.html
Jquery Jquery versions and number of CVEs, vulnerabilities
Jquery Jquery versions. Detailed list of versions with known security vulnerabilities, CVEs.