Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2020-11022

Description

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

POC

Reference

- http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html

- https://www.oracle.com//security-alerts/cpujul2021.html

- https://www.oracle.com/security-alerts/cpuApr2021.html

- https://www.oracle.com/security-alerts/cpuapr2022.html

- https://www.oracle.com/security-alerts/cpujan2021.html

- https://www.oracle.com/security-alerts/cpujan2022.html

- https://www.oracle.com/security-alerts/cpujul2020.html

- https://www.oracle.com/security-alerts/cpujul2022.html

- https://www.oracle.com/security-alerts/cpuoct2020.html

- https://www.oracle.com/security-alerts/cpuoct2021.html

- https://www.tenable.com/security/tns-2020-10

- https://www.tenable.com/security/tns-2020-11

- https://www.tenable.com/security/tns-2021-02

- https://www.tenable.com/security/tns-2021-10

Github

- https://github.com/0day404/vulnerability-poc

- https://github.com/0xAJ2K/CVE-2020-11022-CVE-2020-11023

- https://github.com/2lambda123/bartongroup-AlmostSignificant

- https://github.com/ARPSyndicate/cve-scores

- https://github.com/ARPSyndicate/cvemon

- https://github.com/Akhlaken07/WASCaseStudy1

- https://github.com/ArrestX/--POC

- https://github.com/AssassinUKG/JS_Encoder

- https://github.com/AssassinUKG/XSSPlayground

- https://github.com/Chiku014/vulnerability-scanner

- https://github.com/DanielRuf/snyk-js-jquery-565129

- https://github.com/EdgeSecurityTeam/Vulnerability

- https://github.com/EmptyHeart5292/jQuery-XSS

- https://github.com/KayCHENvip/vulnerability-poc

- https://github.com/LSP1025923/CVE

- https://github.com/Leviticus-Triage/CVE_Exploit_Framework-s

- https://github.com/Miraitowa70/POC-Notes

- https://github.com/NeuraLegion/brokencrystals

- https://github.com/Ng0Sang/Brokencrystals-CI-CD-Pipeline

- https://github.com/PanaceaInfosec/jQuery-XSS-Scanner-Pro

- https://github.com/Rkshah123/JS-CVE-Discovery-tool

- https://github.com/SBZ-DevSecOps/Angular10-InsecureApp

- https://github.com/Sang-DevSecOps1/Brokencrystals-CI-CD-Pipeline

- https://github.com/SexyBeast233/SecBooks

- https://github.com/Snorlyd/https-nj.gov---CVE-2020-11022

- https://github.com/Threekiii/Awesome-POC

- https://github.com/Tirthikas/XSSplore

- https://github.com/VirgilioMike/xss-scanner

- https://github.com/XiaomingX/awesome-poc-for-red-team

- https://github.com/Ziad-Naciri/portfolio-guide

- https://github.com/alphaSeclab/sec-daily-2020

- https://github.com/amakhu/cdp

- https://github.com/badigervijay/AI-Based-Threat-Intelligence-Platform

- https://github.com/bartongroup/AlmostSignificant

- https://github.com/blaufish/geo

- https://github.com/captcha-n00b/CVEcrystalyer

- https://github.com/corey-schneider/bagel-shop

- https://github.com/ctcpip/jquery-security

- https://github.com/cve-sandbox/jquery

- https://github.com/d4n-sec/d4n-sec.github.io

- https://github.com/elifesciences/github-repo-security-alerts

- https://github.com/faizhaffizudin/Case-Study-Hamsa

- https://github.com/gregdo21/brokencrystals

- https://github.com/hdgittest/brokencrystals

- https://github.com/jev770/badmoodle-scan

- https://github.com/johnrearden/strings_attached

- https://github.com/jquery-lts/jquery-lts

- https://github.com/krusche-sensetence/jquery-2.2.4-patched

- https://github.com/kuppamjohari/advaya-gems-sql-injection-poc

- https://github.com/m3n0sd0n4ld/uCVE

- https://github.com/mahp/jQuery-with-XSS

- https://github.com/marksowell/retire-html-parser

- https://github.com/missuvimdool-netizen/scan

- https://github.com/nomi-sec/PoC-in-GitHub

- https://github.com/octane23/CASE-STUDY-1

- https://github.com/officialsangdavid/Brokencrystals-CI-CD-Pipeline

- https://github.com/ossf-cve-benchmark/CVE-2020-11022

- https://github.com/pilot114/jquery-cve

- https://github.com/secbyteX03/GitHub_for_Cyber_Risk_Analysts

- https://github.com/soosmile/POC

- https://github.com/spurreiter/jquery

- https://github.com/tnwebdev/jquery-2.2.4-patched

- https://github.com/tssbox/ab-bc-01

- https://github.com/tzwlhack/Vulnerability

- https://github.com/zeitlerquintet/jquery-2.2.4-patched

- https://github.com/zeitlersensetence/jquery-2.2.4-patched