cve/2015/CVE-2015-9251.md

CVE-2015-9251

Description

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

POC

Reference

• http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
• http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
• http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
• http://seclists.org/fulldisclosure/2019/May/13
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• https://github.com/jquery/jquery/pull/2588
• c254d308a7
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
• https://seclists.org/bugtraq/2019/May/18
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://www.oracle.com/security-alerts/cpujan2020.html
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
• https://www.tenable.com/security/tns-2019-08

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/HansUXdev/OneArizona
• https://github.com/andrew-healey/canvas-lms-vuln
• https://github.com/andrew-healey/canvas-xss-poc
• https://github.com/catdever/watchdog
• https://github.com/ctcpip/jquery-security
• https://github.com/eotssa/ChromeScope
• https://github.com/faizhaffizudin/Case-Study-Hamsa
• https://github.com/flipkart-incubator/watchdog
• https://github.com/flyher/sheep
• https://github.com/halkichi0308/CVE-2015-9251
• https://github.com/octane23/CASE-STUDY-1
• https://github.com/rohankumardubey/watchdog
• https://github.com/sho-h/pkgvulscheck
• https://github.com/zema1/oracle-vuln-crawler