CVEs-PoC/2015/CVE-2015-9251.md

CVE-2015-9251

Description

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

POC

Reference

• http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
• http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
• http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
• http://seclists.org/fulldisclosure/2019/May/13
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• https://github.com/jquery/jquery/pull/2588
• c254d308a7
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
• https://seclists.org/bugtraq/2019/May/18
• https://snyk.io/vuln/npm:jquery:20150627
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://www.oracle.com/security-alerts/cpujan2020.html
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
• https://www.tenable.com/security/tns-2019-08

Github

• https://github.com/20142995/nuclei-templates
• https://github.com/ARPSyndicate/cvemon
• https://github.com/Akhlaken07/WASCaseStudy1
• https://github.com/HansUXdev/OneArizona
• https://github.com/Leviticus-Triage/CVE_Exploit_Framework-s
• https://github.com/PuddinCat/GithubRepoSpider
• https://github.com/Rohan-flutterint/watchdog
• https://github.com/ZorvithonLeo/BiG7EXploits
• https://github.com/amakhu/cdp
• https://github.com/andrew-healey/canvas-lms-vuln
• https://github.com/andrew-healey/canvas-xss-poc
• https://github.com/catdever/watchdog
• https://github.com/ctcpip/jquery-security
• https://github.com/cyb3r-w0lf/nuclei-template-collection
• https://github.com/eotssa/ChromeScope
• https://github.com/eotssa/ChromeScope-v3
• https://github.com/faizhaffizudin/Case-Study-Hamsa
• https://github.com/flipkart-incubator/watchdog
• https://github.com/flyher/sheep
• https://github.com/hackgiver/CVE-2015-9251
• https://github.com/halkichi0308/CVE-2015-9251
• https://github.com/jquery-lts/jquery-lts
• https://github.com/kuppamjohari/advaya-gems-sql-injection-poc
• https://github.com/mahp/jQuery-with-XSS
• https://github.com/moften/CVE-2015-9251
• https://github.com/octane23/CASE-STUDY-1
• https://github.com/rohan-flutterint/watchdog
• https://github.com/rohankumardubey/watchdog
• https://github.com/rox-11/xss
• https://github.com/sho-h/pkgvulscheck
• https://github.com/spawnrider/obsidian-plugins-security-scanner
• https://github.com/wakefulblock262/CVE-2015-9251
• https://github.com/zema1/oracle-vuln-crawler