Back to CVE records
Medium 6.1HealthcarePublished Jan 18, 2018
CVE-2015-9251jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Updated under an hour ago ()
Does this affect you?
It affects jquery and 46 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 29.73%, higher than 98% of scored CVEs. That is high: schedule it on your emergency patch path.
Do this next
Start free and add your stack
Free account, 1 product
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
- CVSS
- 6.1 MEDIUM (v3.0, NVD)CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 29.73% (percentile 98)
- Assigned by
- mitre
- NVD analysis
- Modified
- Record last updated
- Aug 6, 2024
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
jquery jquery jquery:jquery | before 3.0.0 | NVD |
oracle agile_product_lifecycle_management_for_process oracle:agile_product_lifecycle_management_for_process | 6.2.0.0; 6.2.1.0; 6.2.2.0; 6.2.3.0; 6.2.3.1 | NVD |
oracle banking_platform oracle:banking_platform | 2.6.0; 2.6.1; 2.6.2 | NVD |
oracle business_process_management_suite oracle:business_process_management_suite | 11.1.1.9.0; 12.1.3.0.0; 12.2.1.3.0 | NVD |
oracle communications_converged_application_server oracle:communications_converged_application_server | before 7.0.0.1 | NVD |
oracle communications_interactive_session_recorder oracle:communications_interactive_session_recorder | 6.0; 6.1; 6.2 | NVD |
oracle communications_services_gatekeeper oracle:communications_services_gatekeeper | before 6.1.0.4.0 | NVD |
oracle communications_webrtc_session_controller oracle:communications_webrtc_session_controller | before 7.2 | NVD |
oracle endeca_information_discovery_studio oracle:endeca_information_discovery_studio | 3.1.0; 3.2.0 | NVD |
oracle enterprise_manager_ops_center oracle:enterprise_manager_ops_center | 12.2.2; 12.3.3 | NVD |
oracle enterprise_operations_monitor oracle:enterprise_operations_monitor | 3.4; 4.0 | NVD |
oracle financial_services_analytical_applications_infrastructure oracle:financial_services_analytical_applications_infrastructure | from 7.3.3 through 7.3.5; from 8.0.0 through 8.0.7 | NVD |
oracle financial_services_asset_liability_management oracle:financial_services_asset_liability_management | from 8.0.4 through 8.0.7 | NVD |
oracle financial_services_data_integration_hub oracle:financial_services_data_integration_hub | from 8.0.5 through 8.0.7 | NVD |
oracle financial_services_funds_transfer_pricing oracle:financial_services_funds_transfer_pricing | from 8.0.4 through 8.0.7 | NVD |
oracle financial_services_hedge_management_and_ifrs_valuations oracle:financial_services_hedge_management_and_ifrs_valuations | from 8.0.4 through 8.0.7 | NVD |
oracle financial_services_liquidity_risk_management oracle:financial_services_liquidity_risk_management | from 8.0.2 through 8.0.6 | NVD |
oracle financial_services_loan_loss_forecasting_and_provisioning oracle:financial_services_loan_loss_forecasting_and_provisioning | from 8.0.2 through 8.0.7 | NVD |
oracle financial_services_market_risk_measurement_and_management oracle:financial_services_market_risk_measurement_and_management | 8.0.5; 8.0.6 | NVD |
oracle financial_services_profitability_management oracle:financial_services_profitability_management | from 8.0.4 through 8.0.6 | NVD |
oracle financial_services_reconciliation_framework oracle:financial_services_reconciliation_framework | 8.0.5; 8.0.6 | NVD |
oracle fusion_middleware_mapviewer oracle:fusion_middleware_mapviewer | 12.2.1.3.0 | NVD |
oracle healthcare_foundation oracle:healthcare_foundation | 7.1; 7.2 | NVD |
oracle healthcare_translational_research oracle:healthcare_translational_research | 3.1.0 | NVD |
oracle hospitality_cruise_fleet_management oracle:hospitality_cruise_fleet_management | 9.0.11 | NVD |
oracle hospitality_guest_access oracle:hospitality_guest_access | 4.2.0; 4.2.1 | NVD |
oracle hospitality_materials_control oracle:hospitality_materials_control | 18.1 | NVD |
oracle hospitality_reporting_and_analytics oracle:hospitality_reporting_and_analytics | 9.1.0 | NVD |
oracle insurance_insbridge_rating_and_underwriting oracle:insurance_insbridge_rating_and_underwriting | 5.2; 5.4; 5.5 | NVD |
oracle jd_edwards_enterpriseone_tools oracle:jd_edwards_enterpriseone_tools | 9.2 | NVD |
oracle jdeveloper oracle:jdeveloper | 11.1.1.9.0; 12.1.3.0.0; 12.2.1.3.0 | NVD |
oracle oss_support_tools oracle:oss_support_tools | 19.1 | NVD |
oracle peoplesoft_enterprise_peopletools oracle:peoplesoft_enterprise_peopletools | 8.55; 8.56; 8.57 | NVD |
oracle primavera_gateway oracle:primavera_gateway | 15.2; 16.2; 17.12 | NVD |
oracle primavera_unifier oracle:primavera_unifier | from 17.1 through 17.12; 16.1; 16.2; 18.8 | NVD |
oracle real-time_scheduler oracle:real-time_scheduler | 2.3.0 | NVD |
oracle retail_allocation oracle:retail_allocation | 15.0.2 | NVD |
oracle retail_customer_insights oracle:retail_customer_insights | 15.0; 16.0 | NVD |
oracle retail_invoice_matching oracle:retail_invoice_matching | 15.0 | NVD |
oracle retail_sales_audit oracle:retail_sales_audit | 15.0 | NVD |
oracle retail_workforce_management_software oracle:retail_workforce_management_software | 1.60.9; 1.64.0 | NVD |
oracle service_bus oracle:service_bus | 12.1.3.0.0; 12.2.1.3.0 | NVD |
oracle siebel_ui_framework oracle:siebel_ui_framework | 18.10; 18.11 | NVD |
oracle utilities_framework oracle:utilities_framework | from 4.3.0.1 through 4.3.0.4 | NVD |
oracle utilities_mobile_workforce_management oracle:utilities_mobile_workforce_management | 2.3.0 | NVD |
oracle webcenter_sites oracle:webcenter_sites | 11.1.1.8.0 | NVD |
oracle weblogic_server oracle:weblogic_server | 12.1.3.0; 12.2.1.3 | NVD |
References
- http://www.securityfocus.com/bid/105658vdb-entry, x-refsource-bid, third-party-advisory
- https://seclists.org/bugtraq/2019/May/18mailing-list, x-refsource-bugtraq
- http://seclists.org/fulldisclosure/2019/May/11mailing-list, x-refsource-fulldisc
- http://seclists.org/fulldisclosure/2019/May/10mailing-list, x-refsource-fulldisc
- http://seclists.org/fulldisclosure/2019/May/13mailing-list, x-refsource-fulldisc
- https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Emailing-list, x-refsource-mlist
- https://access.redhat.com/errata/RHSA-2020:0481vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2020:0729vendor-advisory, x-refsource-redhat
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.htmlvendor-advisory, x-refsource-suse
- https://www.oracle.com/security-alerts/cpuapr2020.htmlx-refsource-misc
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlx-refsource-confirm, patch
- https://www.oracle.com/security-alerts/cpujul2020.htmlx-refsource-misc
- https://github.com/jquery/jquery/issues/2432x-refsource-misc, issue-tracking, patch, third-party-advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlx-refsource-confirm
- https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec126.pdfx-refsource-misc
- https://github.com/jquery/jquery/pull/2588/commits/c254d308a7d3f1eac4d0b42837804cfffcba4bb2x-refsource-misc, patch, third-party-advisory
- https://snyk.io/vuln/npm:jquery:20150627x-refsource-misc
- https://github.com/jquery/jquery/pull/2588x-refsource-misc, issue-tracking, patch, third-party-advisory
- http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
- http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
- http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
- https://github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b0ccpatch, third-party-advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-18-212-04third-party-advisory, us-government-resource
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.