jQuery vulnerable to Cross-Site Scripting (XSS)
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2011-4969US | medium4.3 | — | ||
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a c… | ||||
02
references
External citations — patches, advisories, analysis.
- http://blog.jquery.com/2011/09/01/jquery-1-6-3-releasedWEB
- http://blog.mindedsecurity.com/2011/07/jquery-is-sink.htmlWEB
- http://bugs.jquery.com/ticket/9521WEB
- http://www.openwall.com/lists/oss-security/2013/01/31/3WEB
- http://www.ubuntu.com/usn/USN-1722-1WEB
- https://github.com/jquery/jqueryPACKAGE
- https://github.com/jquery/jquery/commit/db9e023e62c1ff5d8f21ed9868ab6878da2005e9WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2011-4969.ymlWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan