CVE-2015-9251
mediumpriority · track · 44EPSS 0.297 · 98 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-23
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedphoenix_contact_psirt
Update to Firmware Release 2019.0 LTS or later. Update to PLCnext Engineer Release 2019.0 LTS or later. Update A, 30.08.2019 With Firmware Release 2019.6 an option was added to the web-based management that allows the user to permanently disable storage of configuration data to the SD-Card. The device can now be operated without SD-Card and ignores any inserted SD-Card. We recommend using this new configuration option for application scenarios where physical access to the device cannot be restricted effectively.
- FixedInTouch Access Anywherecisa_csaf_ot
AVEVA recommends users install update “InTouch Access Anywhere 2017 Update 2b�or later
https://softwaresupportsp.schneider-electric.com/#/producthub/details?id=5061 - FixedVulnerable versions of jQuery are thosecisa_csaf_ot
AVEVA recommends users install update “InTouch Access Anywhere 2017 Update 2b�or later
https://softwaresupportsp.schneider-electric.com/#/producthub/details?id=5061 - FixedAXC F 2152cisa_csaf_ot
Follow the advice concerning SD card usage in the manual “Art.-Nr. 107708: UM EN AXC F 2152 Installing, starting up, and operating the AXC F 2152 controller um_en_axc_f_2152_107708_en_02.pdf” that can be found on the product page below:
https://www.phoenixcontact.com/online/portal/us/?uri=pxc-oc-itemdetail:pid=2404267&library=usen&pcck=P-21-14-01&tab=1&selectedCategory=ALL - FixedVue Motioncisa_csaf_ot
Philips released Version 12.2.1.5 in June of 2020 for Vue Motion that remediates CWE-324 and recommends contacting support below.
- FixedVue MyVuecisa_csaf_ot
Philips released Version 12.2.1.5 in June of 2020 for MyVue that remediates CWE-693 and recommends contacting support below.
- FixedVue PACScisa_csaf_ot
Philips released Version 12.2.8.0 in May of 2021 for PACS that remediates CWE-20, CWE-119, CWE-287 and recommends contacting support below.
- FixedVue Speechcisa_csaf_ot
Philips released Version 12.2.8.0 in May of 2021 for Speech that remediates CWE-693, CWE-319, CWE-119, CWE-287, and CWE-1214 and recommends contacting support below.
- Mitigationpepperl_fuchs_psirt
An external protective measure is required. - Minimize network exposure for affected products and ensure that they are not accessible via the Internet. - Isolate affected products from the corporate network. - If remote access is required, use secure methods such as virtual private networks (VPNs).
- MitigationInTouch Access Anywherecisa_csaf_ot
AVEVA has published Security Bulletin LFSEC00000126.
https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec126.pdf - MitigationVulnerable versions of jQuery are thosecisa_csaf_ot
AVEVA has published Security Bulletin LFSEC00000126.
https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec126.pdf - MitigationAXC F 2152cisa_csaf_ot
Disable Basic128Rsa15 security policy in OPC Servers configuration. Use only Basic256 or higher.
- MitigationWHA-GW-F2D2-0-AS- Z2-ETHcisa_csaf_ot
If remote access is required, use secure methods such as virtual private networks (VPNs).
- MitigationWHA-GW-F2D2-0-AS- Z2-ETH.EIPcisa_csaf_ot
If remote access is required, use secure methods such as virtual private networks (VPNs).
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (4)
Public proof-of-concept and weaponised exploit code.
- halkichi0308/CVE-2015-9251halkichi0308/CVE-2015-9251PoC · poc_in_github
- moften/CVE-2015-9251PoC para CVE-2015-9251 jQuery menor a 3.0.0.PoC · poc_in_github
- rox-11/xsscve-2015-9251PoC · poc_in_github
affected products (223)
Products and version ranges known to be affected.
- Red Hat OpenShift container platform 4.0.51all versionscert_bundDEcpe:/a:redhat:openshift:container_platform_4.0.51
advisories (14)
Vendor and ecosystem advisories describing this.
- VDE-2019-009PHOENIX CONTACT: Multiple Vulnerabilities in AXC F 21522019-06-04csaf · phoenix_contact_psirtDE
Multiple vulnerabilities have been identified in PHOENIX CONTACT AXC F 2152 with firmware versions 1.x
- VDE-2021-027Pepperl+Fuchs: WirelessHART-Gateway - Vulnerability may allow remote attackers to cause a Denial Of Service2021-10-16csaf · pepperl_fuchs_psirtDE
Critical vulnerabilities have been discovered in the product and in the utilized components jQuery by jQuery Team and TLS Version 1.0/1.1. The impact of the vulnerabilities on the affected device may result in - denial of service - remote code execution - code exposure
- WID-SEC-W-2023-0239Red Hat JBoss Enterprise Application Platform: Mehrere SchwachstellenDeutsch2023-01-31csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um beliebigen Programmcode auszuführen, ein Cross-Site-Scritping-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2024-1682Oracle Retail Applications: Mehrere SchwachstellenDeutsch2019-04-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Oracle Retail Applications ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.
- WID-SEC-W-2024-1872IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2021-07-25csaf · cert_bundDE
Ein entfernter anonymer oder authentifizierter Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren, einen Denial-of-Service-Zustand auszulösen und einen Cross-Site-Scripting-Angriff durchzuführen.
- WID-SEC-W-2025-1212Oracle Communications Applications: Mehrere SchwachstellenDeutsch2019-04-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.
- WID-SEC-W-2025-1660Oracle Utilities: Mehrere SchwachstellenDeutsch2019-04-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Utilities ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- WID-SEC-W-2026-1752IBM Business Automation Workflow: Mehrere SchwachstellenDeutsch2026-05-31csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.
- WID-SEC-W-2026-3721IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2021-05-04csaf · cert_bundDE
Ein entfernter, anonymer, authentifizierter, lokaler oder benachbarter Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen oder einen Denial of Service Zustand auszulösen.
- GHSA-rmxg-73gg-4p98Cross-Site Scripting (XSS) in jquery2018-01-22ghsa · osvUS
Affected versions of `jquery` interpret `text/javascript` responses from cross-origin ajax requests, and automatically execute the contents in `jQuery.globalEval`, even when the ajax request doesn't contain the `dataType` option. ## Recommendation Update to version 3.0.0 or later.
- ICSA-18-212-04AVEVA InTouch Access Anywhere2018-07-31icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability may allow attackers to obtain sensitive information and/or execute Javascript or HTML code.
- ICSA-19-155-01PHOENIX CONTACT PLCNext AXC F 21522019-06-04icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to decrypt passwords, bypass authentication, and deny service to the device. In addition, these vulnerabilities could interact with third-party vulnerabilities to cause other impacts to integrity, confidentiality, and availability.
- ICSA-22-097-01Pepperl+Fuchs WirelessHART-Gateway2022-04-07icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may result in a denial-of-service condition, code execution, and code exposure.
- ICSMA-21-187-01Philips Vue PACS (Update B)2021-07-06icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an unauthorized person or process to eavesdrop, view or modify data, gain system access, perform code execution, install unauthorized software, or affect system data integrity in such a way as to negatively impact the confidentiality, integrity, or availability of the system.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (168)
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.htmlcnnvd
- http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.htmlcnnvd
- http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.htmlcnnvd
- http://seclists.org/fulldisclosure/2019/May/10cnnvd
- http://seclists.org/fulldisclosure/2019/May/11cnnvd
- http://seclists.org/fulldisclosure/2019/May/13cnnvd
- http://www-01.ibm.com/support/docview.wss?uid=ibm10874666cnnvd
- http://www.ibm.com/support/docview.wss?uid=ibm10874666cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan