CVE-2020-7656
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
- Score
- CVSS 3.1 6.1 Medium
- Status
- Modified - report@snyk.io
- Published
- 2020-05-19
- Last modified
- 2024-08-04
- Weaknesses
- CWE-79
Affected products
- Jquery (Jquery)
- Junos (Juniper)
- Active Iq Unified Manager (Netapp)
- Cloud Backup (Netapp)
- Oncommand System Manager (Netapp)
- Snap Creator Framework (Netapp)
- Peoplesoft Enterprise Peopletools (Oracle)
References
- https://security.netapp.com/advisory/ntap-20200528-0001/
- https://snyk.io/vuln/SNYK-JS-JQUERY-569619
- https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-…
- https://www.oracle.com/security-alerts/cpujul2022.html
