CVE-2015-9251
Medium
Description
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
SeverityMedium
CVSS6.1
Exploit probability98. percentile29.7%
Product
Jquery
PublishedJan 18, 2018
How to fix
Update
- jquery jquery3.0.0 or later
- oracle communications_converged_application_server7.0.0.1 or later
- oracle communications_services_gatekeeper6.1.0.4.0 or later
- oracle communications_webrtc_session_controller7.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jquery jquery | v < 3.0.0 | 3.0.0 |
| oracle agile_product_lifecycle_management_for_process | 6.2.0.0, 6.2.1.0, 6.2.2.0, 6.2.3.0, 6.2.3.1 | — |
| oracle banking_platform | 2.6.0, 2.6.1, 2.6.2 | — |
| oracle business_process_management_suite | 11.1.1.9.0, 12.1.3.0.0, 12.2.1.3.0 | — |
| oracle communications_converged_application_server | v < 7.0.0.1 | 7.0.0.1 |
| oracle communications_interactive_session_recorder | 6.0, 6.1, 6.2 | — |
| oracle communications_services_gatekeeper | v < 6.1.0.4.0 | 6.1.0.4.0 |
| oracle communications_webrtc_session_controller | v < 7.2 | 7.2 |
| oracle endeca_information_discovery_studio | 3.1.0, 3.2.0 | — |
| oracle enterprise_manager_ops_center | 12.2.2, 12.3.3 | — |
| oracle enterprise_operations_monitor | 3.4, 4.0 | — |
| oracle financial_services_analytical_applications_infrastructure | 7.3.3 ≤ v ≤ 7.3.5, 8.0.0 ≤ v ≤ 8.0.7 | — |
| oracle financial_services_asset_liability_management | 8.0.4 ≤ v ≤ 8.0.7 | — |
| oracle financial_services_data_integration_hub | 8.0.5 ≤ v ≤ 8.0.7 | — |
| oracle financial_services_funds_transfer_pricing | 8.0.4 ≤ v ≤ 8.0.7 | — |
| oracle financial_services_hedge_management_and_ifrs_valuations | 8.0.4 ≤ v ≤ 8.0.7 | — |
| oracle financial_services_liquidity_risk_management | 8.0.2 ≤ v ≤ 8.0.6 | — |
| oracle financial_services_loan_loss_forecasting_and_provisioning | 8.0.2 ≤ v ≤ 8.0.7 | — |
| oracle financial_services_market_risk_measurement_and_management | 8.0.5, 8.0.6 | — |
| oracle financial_services_profitability_management | 8.0.4 ≤ v ≤ 8.0.6 | — |
| oracle financial_services_reconciliation_framework | 8.0.5, 8.0.6 | — |
| oracle fusion_middleware_mapviewer | 12.2.1.3.0 | — |
| oracle healthcare_foundation | 7.1, 7.2 | — |
| oracle healthcare_translational_research | 3.1.0 | — |
| oracle hospitality_cruise_fleet_management | 9.0.11 | — |
| oracle hospitality_guest_access | 4.2.0, 4.2.1 | — |
| oracle hospitality_materials_control | 18.1 | — |
| oracle hospitality_reporting_and_analytics | 9.1.0 | — |
| oracle insurance_insbridge_rating_and_underwriting | 5.2, 5.4, 5.5 | — |
| oracle jd_edwards_enterpriseone_tools | 9.2 | — |
| oracle jdeveloper | 11.1.1.9.0, 12.1.3.0.0, 12.2.1.3.0 | — |
| oracle oss_support_tools | 19.1 | — |
| oracle peoplesoft_enterprise_peopletools | 8.55, 8.56, 8.57 | — |
| oracle primavera_gateway | 15.2, 16.2, 17.12 | — |
| oracle primavera_unifier | 17.1 ≤ v ≤ 17.12, 16.1, 16.2, 18.8 | — |
| oracle real-time_scheduler | 2.3.0 | — |
| oracle retail_allocation | 15.0.2 | — |
| oracle retail_customer_insights | 15.0, 16.0 | — |
| oracle retail_invoice_matching | 15.0 | — |
| oracle retail_sales_audit | 15.0 | — |
| oracle retail_workforce_management_software | 1.60.9, 1.64.0 | — |
| oracle service_bus | 12.1.3.0.0, 12.2.1.3.0 | — |
| oracle siebel_ui_framework | 18.10, 18.11 | — |
| oracle utilities_framework | 4.3.0.1 ≤ v ≤ 4.3.0.4 | — |
| oracle utilities_mobile_workforce_management | 2.3.0 | — |
| oracle webcenter_sites | 11.1.1.8.0 | — |
| oracle weblogic_server | 12.1.3.0, 12.2.1.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.