Posts with tag jquery

Attack prototypes already present

jQuery below 3.5.0 vulnerable to cross-site scripting

All jQuery versions below 3.5.0 are vulnerable to cross-site scripting (XSS) attacks. If exploited successfully, an attacker can trick the user’s browser to render a malicious page or hijack a user session. It is even possible to execute remote code. It is recommended to update to jQuery >= 3.5.0

Several dangerous attacks possible

jQuery below 3.4.0 vulnerable to prototype pollution

All jQuery versions below 3.4.0 are affected by a new hacking technique called prototype pollution. Successful exploitation could allow an attacker to modify existing object properties, including security properties such as cookies or tokens. Privilege escalation, content manipulation, application hijacking and even remote code execution is possible.