Most recent entries from all

bdu:2023-07702

certfr-2019-avi-163 — De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Elles permettent à un attaquant de provoque…

certfr-2019-avi-163

cnvd-2018-02374

EUVD-2026-113646

fkie_cve-2012-6708

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

GHSA-2pqj-h3vj-pqgw — Cross-Site Scripting in jquery

Affected: npm: jquery, Maven: org.webjars.npm:jquery, NuGet: jQuery, RubyGems: jquery-rails

Affected versions of `jquery` are vulnerable to cross-site scripting. This occurs because the main `jquery` function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. The result is that `jquery` may interpret HTML as selectors when given certain inputs, allowing for client side code execution.

## Proof of Concept ``` $("#log").html( $("element[attribute='<img src=\"x\" onerror=\"alert(1)\" />']").html() ); ```

## Recommendation

Update to version 1.9.0 or later.

gsd-2012-6708

ICSA-22-097-01 — Pepperl+Fuchs WirelessHART-Gateway

The affected product allows active SSH and telnet services with hard-coded credentials.CVE-2021-34565 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). jQuery 3.0.0-rc.1 is vulnerable to a denial-of-service condition due to removing a logic a lowercased attribute names. Any attribute using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.CVE-2016-10707 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). If the application is not externally accessible or uses IP-based access restrictions, attackers can use DNS rebinding to bypass any IP or firewall-based access restrictions by proxying through their target's browser. This vulnerability only affects Versions 3.0.7 through 3.0.8.CVE-2021-34561 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). The filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability only affects Version 3.0.7.CVE-2021-33555 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). jQuery Version 1.4.2 allows…

msrc_CVE-2012-6708 — jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differe…

msrc_CVE-2012-6708

openSUSE-SU-2020:0395-1 — Recommended update for ruby2.5

Recommended update for ruby2.5

SUSE-SU-2020:0737-1 — Recommended update for ruby2.5

Recommended update for ruby2.5

UBUNTU-CVE-2012-6708

Affected: Ubuntu:Pro:14.04:LTS: jquery

VDE-2021-027 — Pepperl+Fuchs: WirelessHART-Gateway - Vulnerability may allow remote attackers to cause a Denial Of Service

Critical vulnerabilities have been discovered in the product and in the utilized components jQuery by jQuery Team and TLS Version 1.0/1.1.

The impact of the vulnerabilities on the affected device may result in

- denial of service - remote code execution - code exposure

VDE-2025-024 — Wiesemann & Theis: Multiple products from Wiesemann & Theis support deprecated jQuery version

Multiple W&T devices are shipped with a jQuery version with a known XSS vulnerability.

WID-SEC-W-2026-1752 — IBM Business Automation Workflow: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.