This exploit leverages two vulnerabilities in jQuery: CVE-2020-7656 which allows for XSS through improper script handling, and CVE-2019-11358 which leads to XSS due to Prototype Pollution. By injecting payloads into a vulnerable page running jQuery versions prior to 3.4.X, malicious actors can run arbitrary JavaScript code in the victim's browser.
A Cross-Site Scripting (XSS) vulnerability exists in jQuery versions greater than or equal to 1.2 and before 3.5.0. An attacker can inject malicious code into the vulnerable application, which will be executed in the victim's browser. Proof of Concept 1: <option><style></option></select><img src=x onerror=alert(1)></style>
A denial of service vulnerability exists in jQuery UI version 1.12.1 and prior. An attacker can exploit this vulnerability by creating a dialog box with a long title, which will cause the application to crash. This can be done by using the jQuery UI dialog() method and passing a long string as the title parameter.
Services By CQR