Vulnerability Details : CVE-2015-9251
Potential exploit
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2015-9251
- cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdeveloper:12.1.3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:oss_support_tools:19.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:siebel_ui_framework:18.10:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:siebel_ui_framework:18.11:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_gateway:17.12:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_gateway:15.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:service_bus:12.1.3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_invoice_matching:15.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:real-time_scheduler:2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:hospitality_reporting_and_analytics:9.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:hospitality_cruise_fleet_management:9.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*
- Oracle » Financial Services Asset Liability ManagementVersions from including (>=) 8.0.4 and up to, including, (<=) 8.0.7cpe:2.3:a:oracle:financial_services_asset_liability_management:*:*:*:*:*:*:*:*
- Oracle » Financial Services Funds Transfer PricingVersions from including (>=) 8.0.4 and up to, including, (<=) 8.0.7cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:*:*:*:*:*:*:*:*
- Oracle » Financial Services Profitability ManagementVersions from including (>=) 8.0.4 and up to, including, (<=) 8.0.6cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:*
- Oracle » Financial Services Liquidity Risk ManagementVersions from including (>=) 8.0.2 and up to, including, (<=) 8.0.6cpe:2.3:a:oracle:financial_services_liquidity_risk_management:*:*:*:*:*:*:*:*
- Oracle » Financial Services Loan Loss Forecasting And ProvisioningVersions from including (>=) 8.0.2 and up to, including, (<=) 8.0.7cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:*
- Oracle » Financial Services Hedge Management And Ifrs ValuationsVersions from including (>=) 8.0.4 and up to, including, (<=) 8.0.7cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:*
- Oracle » Financial Services Analytical Applications InfrastructureVersions from including (>=) 8.0.0 and up to, including, (<=) 8.0.7cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*
- Oracle » Financial Services Analytical Applications InfrastructureVersions from including (>=) 7.3.3 and up to, including, (<=) 7.3.5cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_sales_audit:15.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_allocation:15.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_interactive_session_recorder:6.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_interactive_session_recorder:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_interactive_session_recorder:6.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:endeca_information_discovery_studio:3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_operations_monitor:3.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_operations_monitor:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:healthcare_foundation:7.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:healthcare_foundation:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:healthcare_translational_research:3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_workforce_management_software:1.60.9:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_workforce_management_software:1.64.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:utilities_mobile_workforce_management:2.3.0:*:*:*:*:*:*:*
- Oracle » Utilities FrameworkVersions from including (>=) 4.3.0.1 and up to, including, (<=) 4.3.0.4cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:*
- Oracle » Financial Services Data Integration HubVersions from including (>=) 8.0.5 and up to, including, (<=) 8.0.7cpe:2.3:a:oracle:financial_services_data_integration_hub:*:*:*:*:*:*:*:*
- cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*
Threat overview for CVE-2015-9251
Top countries where our scanners detected CVE-2015-9251
Top open port discovered on systems with this issue
80
IPs affected by CVE-2015-9251 750,520
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2015-9251!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2015-9251
0.87%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 82 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-9251
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
6.1
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST |
CWE ids for CVE-2015-9251
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-9251
-
http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
OctoberCMS Insecure Dependencies ≈ Packet Storm
-
https://www.oracle.com/security-alerts/cpujan2020.html
Oracle Critical Patch Update Advisory - January 2020
-
https://www.oracle.com/security-alerts/cpuoct2020.html
Oracle Critical Patch Update Advisory - October 2020
-
http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
dotCMS 5.1.1 Vulnerable Dependencies ≈ Packet Storm
-
https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@%3Cdev.flink.apache.org%3E
Apache flink 1.7.2 security issues - Pony Mail
-
https://ics-cert.us-cert.gov/advisories/ICSA-18-212-04
AVEVA InTouch Access Anywhere | CISAThird Party Advisory;US Government Resource
-
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
CPU Oct 2018Patch
-
https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@%3Cuser.flink.apache.org%3E
Re: Apache flink 1.7.2 security issues - Pony Mail
-
https://www.oracle.com/security-alerts/cpuapr2020.html
Oracle Critical Patch Update Advisory - April 2020
-
https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6@%3Ccommits.roller.apache.org%3E
[jira] [Created] (ROL-2150) Fix Js security vulnerabilities detected using retire js - Pony Mail
-
https://snyk.io/vuln/npm:jquery:20150627
Cross-site Scripting (XSS) in jquery | SnykPatch;Third Party Advisory
-
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Page not found | Oracle
-
https://www.oracle.com/security-alerts/cpujul2020.html
Oracle Critical Patch Update Advisory - July 2020
-
https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec126.pdf
Third Party Advisory
-
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Oracle Critical Patch Update - July 2019
-
https://access.redhat.com/errata/RHSA-2020:0729
RHSA-2020:0729 - Security Advisory - Red Hat Customer Portal
-
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
[jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities - Pony Mail
-
https://www.tenable.com/security/tns-2019-08
[R1] Nessus Network Monitor 5.11.0 Fixes Multiple Third-party Vulnerabilities - Security Advisory | Tenable®
-
https://github.com/jquery/jquery/pull/2588
Ajax: Mitigate possible XSS vulnerability by markelog · Pull Request #2588 · jquery/jquery · GitHubIssue Tracking;Patch;Third Party Advisory
-
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
Pulse Security Advisory: SA44601 - 2020-10: Security Bulletin: Multiple Vulnerabilities Resolved in Pulse Connect Secure / Pulse Policy Secure / Pulse Secure Desktop Client 9.1R9
-
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
[security-announce] openSUSE-SU-2020:0395-1: important: Recommended upda
-
https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@%3Cuser.flink.apache.org%3E
Apache flink 1.7.2 security issues - Pony Mail
-
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
Pony Mail!
-
https://github.com/jquery/jquery/pull/2588/commits/c254d308a7d3f1eac4d0b42837804cfffcba4bb2
Ajax: Mitigate possible XSS vulnerability by markelog · Pull Request #2588 · jquery/jquery · GitHubPatch;Third Party Advisory
-
http://seclists.org/fulldisclosure/2019/May/13
Full Disclosure: Re: dotCMS v5.1.1 HTML Injection & XSS Vulnerability
-
https://github.com/jquery/jquery/issues/2432
Inadequate/dangerous jQuery behavior for 3rd party text/javascript responses · Issue #2432 · jquery/jquery · GitHubIssue Tracking;Patch;Third Party Advisory
-
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Oracle Critical Patch Update - April 2019Patch
-
https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3Cuser.flink.apache.org%3E
Apache flink 1.7.2 security issues - Pony Mail
-
https://github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b0cc
Ajax: Mitigate possible XSS vulnerability · jquery/jquery@f60729f · GitHubPatch;Third Party Advisory
-
http://seclists.org/fulldisclosure/2019/May/10
Full Disclosure: dotCMS v5.1.1 Vulnerabilities
-
http://www.securityfocus.com/bid/105658
JQuery CVE-2015-9251 Cross Site Scripting VulnerabilityThird Party Advisory;VDB Entry
-
http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
RetireJS CORS Issue / Script Execution ≈ Packet Storm
-
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Oracle Critical Patch Update - January 2019Patch
-
https://access.redhat.com/errata/RHSA-2020:0481
RHSA-2020:0481 - Security Advisory - Red Hat Customer Portal
-
https://security.netapp.com/advisory/ntap-20210108-0004/
CVE-2015-9251 jQuery Vulnerability in NetApp Products | NetApp Product Security
-
https://seclists.org/bugtraq/2019/May/18
Bugtraq: dotCMS v5.1.1 Vulnerabilities
-
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
[jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities - Pony Mail
-
http://seclists.org/fulldisclosure/2019/May/11
Full Disclosure: dotCMS v5.1.1 HTML Injection & XSS Vulnerability
Jump to