Version 4.6.0

jquery-rails

A gem to automate using jQuery with Rails

Install Instructions

gem install jquery-rails
Current Version Release Date June 26, 2023
Language Ruby
Package URL (purl) pkg:gem/jquery-rails@4.6.0

Find jquery-rails vulnerabilities in your supply chain.

Scan for Free

jquery-rails Vulnerabilities

Sort by
icon CVE (Latest)
  • icon CVE (Latest)
  • icon CVE (Oldest)
  • icon CVSS Score (Highest)
  • icon CVSS Score (Lowest)
CVE question mark icon CVSS Score question mark icon CWE(s) question mark icon EPSS Score question mark icon EPSS % question mark icon Impacted Versions
CVE-2015-1840 Medium 5 CWE-200, CWE-352 0.0062 0.79481
  • 4.0.0–4.0.3
  • 3.0.0–3.1.2
  • 2.0.1–2.3.0
  • 1.0–1.0.19
  • 0.1.1–0.2.7
CVE-2015-9251 Medium 6.1 CWE-79 0.0066 0.80242
  • 4.0.0–4.1.1
  • 3.0.0–3.1.5
  • 2.0.1–2.3.0
  • 1.0–1.0.19
  • 0.1.1–0.2.7
CVE-2019-11358 Medium 6.1 CWE-1321, CWE-79 0.02335 0.90128
  • 4.0.0–4.3.3
  • 3.0.0–3.1.5
  • 2.0.1–2.3.0
  • 1.0–1.0.19
  • 0.1.1–0.2.7
CVE-2020-11022 Medium 6.1 CWE-79 0.06271 0.93845
  • 4.0.0–4.3.5
  • 3.0.0–3.1.5
  • 2.0.1–2.3.0
CVE-2020-11023 Medium 6.1 CWE-79 0.02302 0.9007
  • 4.0.0–4.3.5
  • 3.0.0–3.1.5
  • 2.0.1–2.3.0
  • 1.0–1.0.19
  • 0.1.1–0.2.7
CVE-2012-6708 Medium 6.1 CWE-79 0.00823 0.8254
  • 2.0.1–2.1.4
  • 1.0–1.0.19
  • 0.1.1–0.2.7
CVE-2020-7656 Medium 6.1 CWE-79 0.00154 0.52855
  • 2.0.1–2.1.4
  • 1.0–1.0.19
  • 0.1.1–0.2.7
CVE-2011-4969 Medium 4.3 CWE-79 0.00306 0.70583
  • 1.0–1.0.15
  • 0.1.1–0.2.7
CVE-2014-6071 Medium 6.1 CWE-79 0.00135 0.5014
  • 1.0–1.0.14
  • 0.2.5–0.2.7

jquery-rails Vulnerability Remediation Guidance

CVE Description Full list of Impacted Versions Fix
CVE-2020-7656 jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed. 2.1.3, 2.1.1, 1.0.6, 0.2.2, 2.0.2, 2.0.1, 1.0.18, 0.1.3 (Show all) Major → 4.4.0
CVE-2020-11023 In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. 4.0.0, 4.3.4, 4.0.2, 4.1.0, 4.0.5, 4.0.0.beta2, 4.3.3, 4.3.2 (Show all) Minor → 4.4.0
CVE-2020-11022 In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. 4.0.0, 4.3.4, 4.0.2, 4.1.0, 4.0.5, 4.0.0.beta2, 4.3.3, 4.3.2 (Show all) Minor → 4.4.0
CVE-2019-11358 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. 4.0.0, 4.0.2, 4.1.0, 4.0.5, 4.0.0.beta2, 4.3.3, 4.3.2, 2.1.3 (Show all) Minor → 4.4.0
CVE-2015-9251 jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. 4.0.0, 4.0.2, 4.1.0, 4.0.5, 4.0.0.beta2, 2.1.3, 3.1.2, 3.1.1 (Show all) Minor → 4.4.0
CVE-2015-1840 jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value. 4.0.0, 4.0.2, 2.1.3, 3.1.2, 3.1.1, 3.0.2, 3.0.1, 2.2.1 (Show all) Minor → 4.4.0
CVE-2014-6071 jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after. 1.0.6, 1.0.13, 1.0.14, 1.0.12, 1.0.11, 1.0.10, 1.0.9, 1.0.8 (Show all) Major → 4.4.0
CVE-2012-6708 jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common. 2.1.3, 2.1.1, 1.0.6, 0.2.2, 2.0.2, 2.0.1, 1.0.18, 0.1.3 (Show all) Major → 4.4.0
CVE-2011-4969 Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag. 1.0.6, 0.2.2, 0.1.3, 0.1.1, 1.0.13, 1.0.15, 1.0.14, 1.0.12 (Show all) Major → 4.4.0

Instantly see if these jquery-rails vulnerabilities affect your code.

Scan for Free

Dependencies

Packages using versions of jquery-rails affected by its vulnerabilities

Dependent Packages
rails-dom-testing>= 1, < 3
railties>= 4.2.0
thor>= 0.14, < 2.0