Hi !Donovan,
I wonder if this vulnerability described in the following link is still open (well it has been patched at long last): http://webcache.googleusercontent.com/search?q=cache:UGkNI5vxC_UJ:sijmen.ruwhof.net/weblog/256-cross-site-scripting-in-millions-of-web-sites+&cd=3&hl=nl&ct=clnk&gl=nl
They finally fixed this in November 2014: http://www.securityweek.com/developers-fix-xss-vulnerability-jquery-validation-plugin-script
Most vulnerabilties for JQuery are of a Cross Site Scripting nature, well lest other security measures has not been brought into place.
In addition, developers usually use jQuery libraries as a plug-and-play product, which doesn't require maintenance apart from library updates.
Because jQuery libraries are minified and infrequently reviewed by those using them, jQuery becomes a good place to hide malicious code. Such malicious code usually attempts to deliver malware to as many users as possible.
Quote from Ben-Hayak.
Just to show how easy this is to inject JQuery onto any webpage that has not got it, use this bookmarklet
javascript:var element1=document.createElement("script");element1.src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.4/jquery.min.js";element1.type="text/javascript";document.getElementsByTagName("head")[0].appendChild(element1);
Inspiration for the bookmarklet from http://ww1.tutkiun.com/2010/07/load-javascript-after-pageload.html
Info credits go to: brandonmartinez. (only use bookmarklet on sites you are authorized to)
polonus
