| Package | Affected versions | Patched versions |
|---|---|---|
| org.webjars.npm:jquery | ≥ 1.2.1, < 1.9.0 | 1.9.0 |
| jQuery | ≥ 1.2.1, < 1.9.0 | 1.9.0 |
| jquery-rails | < 2.2.0 | 2.2.0 |
| jquery | < 1.9.0 | 1.9.0 |
| oncommand system manager | ≥ 3.0.0, ≤ 3.1.3 | |
| peoplesoft enterprise peopletools | = 8.58 | |
| jquery | ≥ 1.2.1, < 1.9.0 | 1.9.0 |
Versions of jquery prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove <script> HTML tags that contain a whitespace character, i.e: </script >, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.
Upgrade to version 1.9.0 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free