Staging Environment: Content and features may be unstable or change without notice.

Advisory Package Curation

GHSA-rmxg-73gg-4p98

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-rmxg-73gg-4p98

Cross-Site Scripting (XSS) in jquery Affected versions of `jquery` interpret `text/javascript` responses from cross-origin ajax requests, and automatically execute the contents in `jQuery.globalEval`, even when the ajax request doesn't contain the `dataType` option. ## Recommendation Update to version 3.0.0 or later.

gitlab/gem/jquery-rails/CVE-2015-9251

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

gitlab/maven/org.webjars.npm/jquery/CVE-2015-9251

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

gitlab/npm/jquery/CVE-2015-9251

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

gitlab/nuget/jQuery/CVE-2015-9251

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

ruby_advisory_db/gems/jquery-rails/CVE-2015-9251

Cross-Site Scripting (XSS) in jquery Affected versions of `jquery` interpret `text/javascript` responses from cross-origin ajax requests, and automatically execute the contents in `jQuery.globalEval`, even when the ajax request doesn't contain the `dataType` option.