CoderDias

3 exploits Active since Apr 2020
CVE-2020-11022 GITHUB MEDIUM WORKING POC
jQuery 1.12.0-3.4.1 - Cross-Site Scripting via DOM Manipulation Methods
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVSS 6.9
CVE-2020-11023 GITHUB MEDIUM WORKING POC
jQuery <3.5.0 - XSS
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVSS 6.9
CVE-2021-41184 GITHUB MEDIUM WORKING POC
jQuery UI < 1.13.0 - Cross-Site Scripting via Position Utility 'of' Option
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.
CVSS 6.5