{"id":"CVE-2020-7656","aliases":["ALSA-2021:4142","CLSA-2026-1773188121","CLSA-2026-1787557579","CLSA-2026-1787916782","CLSA-2026-1787920143","CLSA-2026-1787920316","CLSA-2026-1788956475","EUVD-2020-0437","GHSA-q4m3-2j7h-f7xw","RHSA-2020:4211","RHSA-2021:4142","RLSA-2021:4142","SNYK-JS-JQUERY-569619","UBUNTU-CVE-2020-7656"],"status":"published","title":"Cross-Site Scripting in jquery","description":"jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove \"\u003cscript\u003e\" HTML tags that contain a whitespace character, i.e: \"\u003c/script \u003e\", which results in the enclosed script logic to be executed.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.06428,"percentile":0.93751,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2020-05-19T00:00:00Z","modified":"2026-10-29T11:00:45Z","exploits":[{"source":"exploitdb","id":"EDB-52141","title":"jQuery 3.3.1 - Prototype Pollution \u0026 XSS Exploit","type":"webapps","platform":"multiple","date":"2025-04-08","url":"https://www.exploit-db.com/exploits/52141"}],"fixes":[{"ecosystem":"RubyGems","package":"jquery-rails","fixed_in":["2.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"jquery","fixed_in":["1.9.0"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"jQuery","fixed_in":["1.9.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.webjars.npm:jquery","fixed_in":["1.9.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.1"},{"fixed":"1.9.0"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"jQuery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.1"},{"fixed":"1.9.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.webjars.npm:jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.1"},{"fixed":"1.9.0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.10-4.el8.alma"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.10-4.el8.alma"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2-tuxcare.0"},{"fixed":"1.8.2-tuxcare.1"}]}],"versions":["1.8.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.3-tuxcare.0"},{"fixed":"1.8.3-tuxcare.1"}]}],"versions":["1.8.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.1-tuxcare.0"},{"fixed":"1.4.1-tuxcare.1"}]}],"versions":["1.4.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.2-tuxcare.0"},{"fixed":"1.4.2-tuxcare.1"}]}],"versions":["1.4.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.3-tuxcare.0"},{"fixed":"1.4.3-tuxcare.1"}]}],"versions":["1.4.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.2-tuxcare.0"},{"fixed":"1.3.2-tuxcare.1"}]}],"versions":["1.3.2"],"bundled":6},{"source":"osv","ecosystem":"npm","package":"jquery","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.1"},{"fixed":"1.9.0"}]}]},{"source":"osv","ecosystem":"NuGet","package":"jQuery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.1"},{"fixed":"1.9.0"}]}],"versions":["1.4.1","1.4.2","1.4.3","1.4.4","1.5.0","1.5.1","1.5.2","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.7.0","1.7.1","1.7.1.1","1.7.2","1.8.0","1.8.1","1.8.2","1.8.3"]},{"source":"osv","ecosystem":"RubyGems","package":"jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}],"versions":["0.1.1","0.1.2","0.1.3","0.2","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","1.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.0.rc","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4"]},{"source":"osv","ecosystem":"Maven","package":"org.webjars.npm:jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.1"},{"fixed":"1.9.0"}]}],"versions":["1.7.2","1.7.3","1.8.2","1.8.3"]},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el6","package":"qpid-dispatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el6_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el6","package":"qpid-dispatch-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el6_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el6","package":"qpid-dispatch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el6_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el6","package":"qpid-dispatch-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el6_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el6","package":"qpid-dispatch-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el6_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el6","package":"qpid-dispatch-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el6_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el7","package":"qpid-dispatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el7","package":"qpid-dispatch-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el7","package":"qpid-dispatch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el7","package":"qpid-dispatch-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el7","package":"qpid-dispatch-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el7","package":"qpid-dispatch-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el8","package":"qpid-dispatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el8","package":"qpid-dispatch-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el8","package":"qpid-dispatch-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el8","package":"qpid-dispatch-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el8","package":"qpid-dispatch-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el8","package":"qpid-dispatch-router-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:amq_interconnect:1::el8","package":"qpid-dispatch-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.10-4.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.10-4.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.10-4.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.10-4.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.10-4.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2+dfsg-2ubuntu1","1.7.2+dfsg-2ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2+dfsg-3ubuntu2","1.11.3+dfsg-4","1.11.3+dfsg-4ubuntu0.1~esm1"]}],"products":[{"vendor":"jquery","product":"jquery"},{"vendor":"juniper","product":"junos"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"netapp","product":"oncommand_system_manager"},{"vendor":"netapp","product":"snap_creator_framework"},{"vendor":"oracle","product":"peoplesoft_enterprise_peopletools"}],"references":[{"url":"https://security.netapp.com/advisory/ntap-20200528-0001/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://snyk.io/vuln/SNYK-JS-JQUERY-569619","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1?language=en_US","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7656","tags":["advisory"]},{"url":"https://github.com/jquery/jquery/blob/9e6393b0bcb52b15313f88141d0bd7dd54227426/src/ajax.js#L203","tags":["web"]},{"url":"https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#220-19-january-2013","tags":["web"]},{"url":"https://github.com/rails/jquery-rails/blob/v2.1.4/vendor/assets/javascripts/jquery.js#L7481","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-7656.yml","tags":["web"]},{"url":"https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d","tags":["web"]},{"url":"https://github.com/jquery/jquery/commit/606b863edaff29035960e4d813b45d63b8d92876","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20200528-0001","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q4m3-2j7h-f7xw"},{"url":"https://vulners.com/cve/CVE-2020-11023","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7656","tags":["report"]},{"url":"https://github.com/jquery/jquery","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4211","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq.interconnect\u0026downloadType=distributions\u0026version=1.9.0","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_amq/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1828406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850119","tags":["report"]},{"url":"https://issues.redhat.com/browse/ENTMQIC-2448","tags":["article"]},{"url":"https://issues.redhat.com/browse/ENTMQIC-2455","tags":["article"]},{"url":"https://issues.redhat.com/browse/ENTMQIC-2460","tags":["article"]},{"url":"https://issues.redhat.com/browse/ENTMQIC-2481","tags":["article"]},{"url":"https://issues.redhat.com/browse/ENTMQIC-2485","tags":["article"]},{"url":"https://issues.redhat.com/browse/ENTMQIC-2492","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4211.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7656","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7656","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11022","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11022","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11022","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gxr4-xjj5-5px2","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11023","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11023","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11023","tags":["advisory"]},{"url":"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4142","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1290830","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1432097","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1678273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690419","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720221","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1759995","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1841019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1854238","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1872378","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1885293","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1885302","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1896458","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1909901","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1922996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1927384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1927394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930886","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1935594","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1984901","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992668","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998454","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4142.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11358","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1701972","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11358","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11358","tags":["advisory"]},{"url":"https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/","tags":["article"]},{"url":"https://www.drupal.org/sa-core-2019-006","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4142","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-7656","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-7656","description":"jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove \"\u003cscript\u003e\" HTML tags that contain a whitespace character, i.e: \"\u003c/script \u003e\", which results in the enclosed script logic to be executed.","status":"published","published":"2020-05-19T00:00:00Z","modified":"2024-08-04T09:33:19.995Z","updated_at":"2026-11-02T14:35:58.787905Z"}],"euvd":[{"id":"EUVD-2020-0437","description":"jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove \"\u003cscript\u003e\" HTML tags that contain a whitespace character, i.e: \"\u003c/script \u003e\", which results in the enclosed script logic to be executed.","status":"published","published":"2020-05-19T00:00:00Z","modified":"2024-08-04T09:33:19Z","updated_at":"2026-11-03T03:08:00.054795Z"}],"ghsa":[{"id":"GHSA-q4m3-2j7h-f7xw","title":"Cross-Site Scripting in jquery","description":"Versions of `jquery` prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove `\u003cscript\u003e` HTML tags that contain a whitespace character, i.e: `\u003c/script \u003e`, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 1.9.0 or later.","status":"published","published":"2020-05-20T16:18:01Z","modified":"2024-10-10T16:17:34Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:09.785133Z"}],"nvd":[{"id":"CVE-2020-7656","description":"jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove \"\u003cscript\u003e\" HTML tags that contain a whitespace character, i.e: \"\u003c/script \u003e\", which results in the enclosed script logic to be executed.","status":"published","published":"2020-05-19T21:15:10.257Z","modified":"2026-06-17T03:25:12.767Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:00.784809Z"}],"osv":[{"id":"CVE-2020-7656","description":"jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove \"\u003cscript\u003e\" HTML tags that contain a whitespace character, i.e: \"\u003c/script \u003e\", which results in the enclosed script logic to be executed.","status":"published","published":"2020-05-19T21:15:10.257Z","modified":"2026-10-24T10:30:43.667578169Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"GHSA-q4m3-2j7h-f7xw","title":"Cross-Site Scripting in jquery","description":"Versions of `jquery` prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove `\u003cscript\u003e` HTML tags that contain a whitespace character, i.e: `\u003c/script \u003e`, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 1.9.0 or later.","status":"published","published":"2020-05-20T16:18:01Z","modified":"2026-07-08T06:49:51.784220278Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"RHSA-2020:4211","title":"Red Hat Security Advisory: Red Hat AMQ Interconnect 1.9.0 release and security update","status":"published","published":"2024-09-18T04:27:15Z","modified":"2026-10-14T10:01:28Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2021:4142","title":"Red Hat Security Advisory: pcs security, bug fix, and enhancement update","status":"published","published":"2024-09-18T04:29:23Z","modified":"2026-10-14T10:01:52Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4142","title":"Low: pcs security, bug fix, and enhancement update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nThe following packages have been upgraded to a later upstream version: pcs (0.10.10). (BZ#1935594)\n\nSecurity Fix(es):\n\n* jquery: Cross-site scripting (XSS) via \u003cscript\u003e HTML tags containing whitespaces (CVE-2020-7656)\n\n* jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods (CVE-2020-11023)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:21:49Z","modified":"2026-02-04T10:15:06.513909Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-7656","description":"jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove \"\u003cscript\u003e\" HTML tags that contain a whitespace character, i.e: \"\u003c/script \u003e\", which results in the enclosed script logic to be executed.","status":"published","published":"2020-05-19T21:15:00Z","modified":"2025-09-08T16:45:59Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"ALSA-2021:4142","title":"Low: pcs security, bug fix, and enhancement update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nThe following packages have been upgraded to a later upstream version: pcs (0.10.10). (BZ#1935594)\n\nSecurity Fix(es):\n\n* jquery: Cross-site scripting (XSS) via \u003cscript\u003e HTML tags containing whitespaces (CVE-2020-7656)\n\n* jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods (CVE-2020-11023)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:21:49Z","modified":"2026-10-29T11:00:45.548867715Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2026-1773188121","title":"TuxCare security update for jquery (5 CVEs)","description":"TuxCare rebuilt jquery to address 5 CVEs. Fixed in 1.8.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:27.943415247Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1787557579","title":"TuxCare security update for jquery (6 CVEs)","description":"TuxCare rebuilt jquery to address 6 CVEs. Fixed in 1.8.3-tuxcare.1.","status":"published","published":"2026-08-24T07:46:19Z","modified":"2026-10-15T09:45:32.73757161Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787916782","title":"TuxCare security update for jquery (7 CVEs)","description":"TuxCare rebuilt jquery to address 7 CVEs. Fixed in 1.4.1-tuxcare.1.","status":"published","published":"2026-08-28T11:33:02Z","modified":"2026-10-15T09:48:03.108876655Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1787920143","title":"TuxCare security update for jquery (8 CVEs)","description":"TuxCare rebuilt jquery to address 8 CVEs. Fixed in 1.4.2-tuxcare.1.","status":"published","published":"2026-08-28T12:29:03Z","modified":"2026-10-15T09:48:03.182510065Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1787920316","title":"TuxCare security update for jquery (7 CVEs)","description":"TuxCare rebuilt jquery to address 7 CVEs. Fixed in 1.4.3-tuxcare.1.","status":"published","published":"2026-08-28T12:31:56Z","modified":"2026-10-15T09:48:03.111008671Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788956475","title":"TuxCare security update for jquery (6 CVEs)","description":"TuxCare rebuilt jquery to address 6 CVEs. Fixed in 1.3.2-tuxcare.1.","status":"published","published":"2026-09-09T12:21:15Z","modified":"2026-10-15T09:47:55.440487334Z","updated_at":"2026-11-02T15:43:47.938828Z"}]}}