CVE-2015-9251

mediumPriorität · verfolgen · 44EPSS 0.297 · 98. PerzentilExploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

4 exploits · PoC

Likely / severe?

29.7% (98th) EPSS

CVSS 4.3 · medium

Is it mine?

223 products

Prüfe deine Angriffsfläche

Who says so?

8 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-23

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenphoenix_contact_psirt
Update to Firmware Release 2019.0 LTS or later. Update to PLCnext Engineer Release 2019.0 LTS or later. Update A, 30.08.2019 With Firmware Release 2019.6 an option was added to the web-based management that allows the user to permanently disable storage of configuration data to the SD-Card. The device can now be operated without SD-Card and ignores any inserted SD-Card. We recommend using this new configuration option for application scenarios where physical access to the device cannot be restricted effectively.
BehobenInTouch Access Anywherecisa_csaf_ot
AVEVA recommends users install update “InTouch Access Anywhere 2017 Update 2b�or later
https://softwaresupportsp.schneider-electric.com/#/producthub/details?id=5061
BehobenVulnerable versions of jQuery are thosecisa_csaf_ot
AVEVA recommends users install update “InTouch Access Anywhere 2017 Update 2b�or later
https://softwaresupportsp.schneider-electric.com/#/producthub/details?id=5061
BehobenAXC F 2152cisa_csaf_ot
Follow the advice concerning SD card usage in the manual “Art.-Nr. 107708: UM EN AXC F 2152 Installing, starting up, and operating the AXC F 2152 controller um_en_axc_f_2152_107708_en_02.pdf” that can be found on the product page below:
https://www.phoenixcontact.com/online/portal/us/?uri=pxc-oc-itemdetail:pid=2404267&library=usen&pcck=P-21-14-01&tab=1&selectedCategory=ALL
BehobenVue Motioncisa_csaf_ot
Philips released Version 12.2.1.5 in June of 2020 for Vue Motion that remediates CWE-324 and recommends contacting support below.
BehobenVue MyVuecisa_csaf_ot
Philips released Version 12.2.1.5 in June of 2020 for MyVue that remediates CWE-693 and recommends contacting support below.
BehobenVue PACScisa_csaf_ot
Philips released Version 12.2.8.0 in May of 2021 for PACS that remediates CWE-20, CWE-119, CWE-287 and recommends contacting support below.
BehobenVue Speechcisa_csaf_ot
Philips released Version 12.2.8.0 in May of 2021 for Speech that remediates CWE-693, CWE-319, CWE-119, CWE-287, and CWE-1214 and recommends contacting support below.
Mitigationpepperl_fuchs_psirt
An external protective measure is required. - Minimize network exposure for affected products and ensure that they are not accessible via the Internet. - Isolate affected products from the corporate network. - If remote access is required, use secure methods such as virtual private networks (VPNs).
MitigationInTouch Access Anywherecisa_csaf_ot
AVEVA has published Security Bulletin LFSEC00000126.
https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec126.pdf
MitigationVulnerable versions of jQuery are thosecisa_csaf_ot
AVEVA has published Security Bulletin LFSEC00000126.
https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec126.pdf
MitigationAXC F 2152cisa_csaf_ot
Disable Basic128Rsa15 security policy in OPC Servers configuration. Use only Basic256 or higher.
MitigationWHA-GW-F2D2-0-AS- Z2-ETHcisa_csaf_ot
If remote access is required, use secure methods such as virtual private networks (VPNs).
MitigationWHA-GW-F2D2-0-AS- Z2-ETH.EIPcisa_csaf_ot
If remote access is required, use secure methods such as virtual private networks (VPNs).

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 2.9

v3.06.1mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 2.7

v3.06.1mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · OSV

v3.06.1mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · Phoenix Contact PSIRT DE

v3.06.1mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · Pepperl+Fuchs PSIRT DE

v3.06.1mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Hsecondary · CVSS-BT (t0sche)

v3.06.1mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · CISA US

v3.16.1mediumAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-79USprimärCWE-707USCWE-79USCWE-79USCWE-79USCWE-79USCWE-79US

Exploits (4)

Öffentlicher Proof-of-Concept- und Exploit-Code.

hackgiver/CVE-2015-9251This repository contains a Proof of Concept (PoC) for CVE-2015-9251, a vulnerability in jQuery versions prior to 3.0.0 that allows attackers to perform Cross-Site Scripting (XSS) attacks under certain conditions.PoC · poc_in_github
halkichi0308/CVE-2015-9251halkichi0308/CVE-2015-9251PoC · poc_in_github
moften/CVE-2015-9251PoC para CVE-2015-9251 jQuery menor a 3.0.0.PoC · poc_in_github
rox-11/xsscve-2015-9251PoC · poc_in_github

betroffene Produkte (223)

Betroffene Produkte und Versionsbereiche.

Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
F5 BIG-IPalle Versionencert_bundDEcpe:/a:f5:big-ip:-
Hitachi Ops Centeralle Versionencert_bundDEcpe:/a:hitachi:ops_center:-
Hitachi Ops Center <Common Services 10.9.3-00alle Versionencert_bundDE
IBM SPSSalle Versionencert_bundDEcpe:/a:ibm:spss:modeler
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat JBoss A-MQ Streams <2.4.0alle Versionencert_bundDE
Red Hat JBoss Enterprise Application Platform <7.1.9alle Versionencert_bundDE
Red Hat JBoss Enterprise Application Platform <7.3.12alle Versionencert_bundDE
Red Hat JBoss Enterprise Application Platform <7.3.13alle Versionencert_bundDE
Red Hat JBoss Enterprise Application Platform <7.4.9alle Versionencert_bundDE
Red Hat OpenShift container platform 4.0.51alle Versionencert_bundDEcpe:/a:redhat:openshift:container_platform_4.0.51
Hitachi Ops Center< Common Services 10.9.3-00cert_bundDE
Red Hat JBoss A-MQ≤ Streams <2.4.0cert_bundDE
Red Hat JBoss Enterprise Application Platform< 7.1.9cert_bundDE
Red Hat JBoss Enterprise Application Platform< 7.3.12cert_bundDE
Red Hat JBoss Enterprise Application Platform< 7.3.13cert_bundDE
Red Hat JBoss Enterprise Application Platform< 7.4.9cert_bundDE
Vue Motion: Versions 12.2.1.5 and prioralle Versionencisa_csaf_otUS
Vue MyVue: Versions 12.2.x.x and prioralle Versionencisa_csaf_otUS

20 von 223 angezeigt

Advisories (14)

Hersteller- und Ökosystem-Meldungen dazu.

VDE-2019-009PHOENIX CONTACT: Multiple Vulnerabilities in AXC F 21522019-06-04csaf · phoenix_contact_psirtDE
Multiple vulnerabilities have been identified in PHOENIX CONTACT AXC F 2152 with firmware versions 1.x
VDE-2021-027Pepperl+Fuchs: WirelessHART-Gateway - Vulnerability may allow remote attackers to cause a Denial Of Service2021-10-16csaf · pepperl_fuchs_psirtDE
Critical vulnerabilities have been discovered in the product and in the utilized components jQuery by jQuery Team and TLS Version 1.0/1.1. The impact of the vulnerabilities on the affected device may result in - denial of service - remote code execution - code exposure
WID-SEC-W-2023-0239Red Hat JBoss Enterprise Application Platform: Mehrere SchwachstellenDeutsch2023-01-31csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um beliebigen Programmcode auszuführen, ein Cross-Site-Scritping-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.
WID-SEC-W-2024-1682Oracle Retail Applications: Mehrere SchwachstellenDeutsch2019-04-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Oracle Retail Applications ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.
WID-SEC-W-2024-1872IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2021-07-25csaf · cert_bundDE
Ein entfernter anonymer oder authentifizierter Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren, einen Denial-of-Service-Zustand auszulösen und einen Cross-Site-Scripting-Angriff durchzuführen.
WID-SEC-W-2025-1212Oracle Communications Applications: Mehrere SchwachstellenDeutsch2019-04-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.
WID-SEC-W-2025-1660Oracle Utilities: Mehrere SchwachstellenDeutsch2019-04-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Utilities ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
WID-SEC-W-2026-1752IBM Business Automation Workflow: Mehrere SchwachstellenDeutsch2026-05-31csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.
WID-SEC-W-2026-3721IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2021-05-04csaf · cert_bundDE
Ein entfernter, anonymer, authentifizierter, lokaler oder benachbarter Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen oder einen Denial of Service Zustand auszulösen.
GHSA-rmxg-73gg-4p98Cross-Site Scripting (XSS) in jquery2018-01-22ghsa · osvUS
Affected versions of `jquery` interpret `text/javascript` responses from cross-origin ajax requests, and automatically execute the contents in `jQuery.globalEval`, even when the ajax request doesn't contain the `dataType` option. ## Recommendation Update to version 3.0.0 or later.
ICSA-18-212-04AVEVA InTouch Access Anywhere2018-07-31icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability may allow attackers to obtain sensitive information and/or execute Javascript or HTML code.
ICSA-19-155-01PHOENIX CONTACT PLCNext AXC F 21522019-06-04icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to decrypt passwords, bypass authentication, and deny service to the device. In addition, these vulnerabilities could interact with third-party vulnerabilities to cause other impacts to integrity, confidentiality, and availability.
ICSA-22-097-01Pepperl+Fuchs WirelessHART-Gateway2022-04-07icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may result in a denial-of-service condition, code execution, and code exposure.
ICSMA-21-187-01Philips Vue PACS (Update B)2021-07-06icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an unauthorized person or process to eavesdrop, view or modify data, gain system access, perform code execution, install unauthorized software, or affect system data integrity in such a way as to negatively impact the confidentiality, integrity, or availability of the system.

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund cisa_csaf_ot phoenix_contact_psirt pepperl_fuchs_psirt osv NVD CVE.org MITRE

veröffentlicht 2018-01-18geändert 2026-06-17

verwandt (52,889)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-42897US	medium6.1OT kritisch	0.52% (43rd)	KEV	2026-05-14
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network…
CVE-2025-66376US	medium6.1OT kritisch	20.2% (97th)	KEV	2026-01-05
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
CVE-2025-68461US	medium6.1OT kritisch	26.8% (98th)	KEV	2025-12-18
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
CVE-2025-48700US	—OT kritisch	1.71% (77th)	KEV	2025-06-23
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to exec…
CVE-2025-27915US	—OT kritisch	4.06% (91st)	KEV	2025-03-12
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient…

+52884 weitere

Referenzen (168)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan