CVE-2020-7656
published 2020-05-19CVE-2020-7656: jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "" HTML tags that contain a…
medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "" HTML tags that contain a whitespace character, i.e: "", which results in the enclosed script logic to be executed.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jquery | jquery | < 1.9.0 | 1.9.0 |
| jquery | jquery | — | — |
| jquery | jquery | >= 1.2.1 < 1.9.0 | 1.9.0 |
| jquery | jquery | >= 1.2.1 < 1.9.0 | 1.9.0 |
| juniper | junos | — | — |
| netapp | oncommand_system_manager | 3.0.0 – 3.1.3 | — |
| oracle | peoplesoft_enterprise_peopletools | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM