January 9, 2014 - 22:36 UTC - Tags: javascript retire.js retirejs
After working on retire.js I decided to take it for a real test run. I setup a node script with phantomjs and scanned the landing page of 150,000 Norwegian domains. These are the results. You will find that a lot of sites are using really old versions of libraries with known vulnerabilities (red means the library has known vulnerabilities). I think this supports the idea that most sites have the jQuery version that was available when the site was first made. Oh, and using a vulnerable library does not necessarily mean the site is vulnerable, but it might be.
Updated 8th of February, 2014:
jQuery
jQuery is a very widely used library. I was surprised however to find so many different and old versions in use
| jquery 0.0.2 | 1 |
|---|---|
| jquery 1-1.3.2 | 2 |
| jquery 1.0 | 2 |
| jquery 1.0.2 | 2 |
| jquery 1.1 | 43 |
| jquery 1.1.1 | 5 |
| jquery 1.1.2 | 133 |
| jquery 1.1.3a | 2 |
| jquery 1.1.3 | 2 |
| jquery 1.1.3.1 | 37 |
| jquery 1.1.4 | 12 |
| jquery 1.2 | 6 |
| jquery 1.2.1 | 143 |
| jquery 1.2.2b2 | 8 |
| jquery 1.2.2b | 1 |
| jquery 1.2.2e | 1 |
| jquery 1.2.2 | 68 |
| jquery 1.2.3a | 1 |
| jquery 1.2.3b | 3 |
| jquery 1.2.3 | 545 |
| jquery 1.2.4a | 5 |
| jquery 1.2.4b | 1 |
| jquery 1.2.4 | 13 |
| jquery 1.2.5 | 3 |
| jquery 1.2.6 | 1602 |
| jquery 1.3 | 220 |
| jquery 1.3.0 | 2 |
| jquery 1.3.1 | 374 |
| jquery 1.3.2 | 4857 |
| jquery 1.4 | 526 |
| jquery 1.4.0 | 28 |
| jquery 1.4.1 | 684 |
| jquery 1.4.2 | 6709 |
| jquery 1.4.3pre | 11 |
| jquery 1.4.3rc2 | 1 |
| jquery 1.4.3 | 611 |
| jquery 1.4.4 | 2639 |
| jquery 1.5 | 480 |
| jquery 1.5.0 | 83 |
| jquery 1.5.1 | 1274 |
| jquery 1.5.1-1.8.11 | 1 |
| jquery 1.5.1.min.rev-7 | 1 |
| jquery 1.5.2 | 1163 |
| jquery 1.5. | 20 |
| jquery 1.6pre | 2 |
| jquery 1.6 | 539 |
| jquery 1.6.0 | 16 |
| jquery 1.6.1 | 1443 |
| jquery 1.6.2 | 1735 |
| jquery 1.6.3 | 135 |
| jquery 1.6.4 | 2511 |
| jquery 1.6.x-1.8.x | 5 |
| jquery 1.6.x-1.8.x-1.2.x | 1 |
| jquery 1.7p1 | 13 |
| jquery 1.7 | 1904 |
| jquery 1.7.0 | 195 |
| jquery 1.7.1 | 7629 |
| jquery 1.7.2rc1 | 2 |
| jquery 1.7.2 | 6418 |
| jquery 1.7.3pre | 1 |
| jquery 1.7.x | 1 |
| jquery 1.8 | 431 |
| jquery 1.8.0 | 603 |
| jquery 1.8.1 | 1061 |
| jquery 1.8.2 | 2143 |
| jquery 1.8.3 | 7259 |
| jquery 1.8.23 | 1 |
| jquery 1.9 | 2 |
| jquery 1.9.0 | 720 |
| jquery 1.9.1 | 4336 |
| jquery 1.10 | 2 |
| jquery 1.10.0 | 104 |
| jquery 1.10.1 | 502 |
| jquery 1.10.2 | 13741 |
| jquery 1.10.2-pre | 1 |
| jquery 1.11.0 | 227 |
| jquery 1.11.0-beta2 | 2 |
| jquery 1.11.0-rc1 | 1 |
| jquery 1.11.1pre | 1 |
| jquery 1.12.2.1 | 2 |
| jquery 1.12.2.3 | 158 |
| jquery 1.18 | 2 |
| jquery 1.20 | 48 |
| jquery 2.0 | 4 |
| jquery 2.0.0 | 78 |
| jquery 2.0.1 | 5 |
| jquery 2.0.2 | 36 |
| jquery 2.0.3 | 295 |
| jquery 2.1.0 | 44 |
| jquery 3.0.4 | 24 |
| jquery 3.0.5 | 17 |
| jquery 16 | 1 |
| jquery 17 | 4 |
| jquery 170713a | 2 |
jQuery UI
Loads of different versions
| jquery-ui-autocomplete 1.8rc1 | 1 |
|---|---|
| jquery-ui-autocomplete 1.8rc3 | 5 |
| jquery-ui-autocomplete 1.8 | 27 |
| jquery-ui-autocomplete 1.8.1 | 51 |
| jquery-ui-autocomplete 1.8.2 | 226 |
| jquery-ui-autocomplete 1.8.4 | 100 |
| jquery-ui-autocomplete 1.8.5 | 329 |
| jquery-ui-autocomplete 1.8.6 | 125 |
| jquery-ui-autocomplete 1.8.7 | 101 |
| jquery-ui-autocomplete 1.8.8 | 15 |
| jquery-ui-autocomplete 1.8.9 | 122 |
| jquery-ui-autocomplete 1.8.10 | 42 |
| jquery-ui-autocomplete 1.8.11 | 157 |
| jquery-ui-autocomplete 1.8.12 | 95 |
| jquery-ui-autocomplete 1.8.13 | 158 |
| jquery-ui-autocomplete 1.8.14 | 218 |
| jquery-ui-autocomplete 1.8.15 | 47 |
| jquery-ui-autocomplete 1.8.16 | 1542 |
| jquery-ui-autocomplete 1.8.17 | 159 |
| jquery-ui-autocomplete 1.8.18 | 449 |
| jquery-ui-autocomplete 1.8.19 | 18 |
| jquery-ui-autocomplete 1.8.20 | 88 |
| jquery-ui-autocomplete 1.8.21 | 141 |
| jquery-ui-autocomplete 1.8.22 | 75 |
| jquery-ui-autocomplete 1.8.23 | 398 |
| jquery-ui-autocomplete 1.8.24 | 376 |
| jquery-ui-autocomplete 1.9m5 | 2 |
| jquery-ui-autocomplete 1.9pre | 1 |
| jquery-ui-autocomplete 1.9.0 | 106 |
| jquery-ui-autocomplete 1.9.1 | 200 |
| jquery-ui-autocomplete 1.9.2 | 630 |
| jquery-ui-autocomplete 1.10.0 | 137 |
| jquery-ui-autocomplete 1.10.1 | 945 |
| jquery-ui-autocomplete 1.10.2 | 218 |
| jquery-ui-autocomplete 1.10.3 | 933 |
| jquery-ui-autocomplete 1.10.4pre | 1 |
| jquery-ui-autocomplete 1.10.4 | 55 |
| jquery-ui-dialog 1.5.3 | 1 |
| jquery-ui-dialog 1.6rc6 | 3 |
| jquery-ui-dialog 1.6 | 1 |
| jquery-ui-dialog 1.7 | 3 |
| jquery-ui-dialog 1.7.1 | 98 |
| jquery-ui-dialog 1.7.2 | 205 |
| jquery-ui-dialog 1.7.3 | 9 |
| jquery-ui-dialog 1.8rc1 | 1 |
| jquery-ui-dialog 1.8rc3 | 2 |
| jquery-ui-dialog 1.8 | 27 |
| jquery-ui-dialog 1.8.1 | 59 |
| jquery-ui-dialog 1.8.2 | 236 |
| jquery-ui-dialog 1.8.4 | 97 |
| jquery-ui-dialog 1.8.5 | 326 |
| jquery-ui-dialog 1.8.6 | 129 |
| jquery-ui-dialog 1.8.7 | 114 |
| jquery-ui-dialog 1.8.8 | 22 |
| jquery-ui-dialog 1.8.9 | 120 |
| jquery-ui-dialog 1.8.10 | 46 |
| jquery-ui-dialog 1.8.11 | 189 |
| jquery-ui-dialog 1.8.12 | 99 |
| jquery-ui-dialog 1.8.13 | 167 |
| jquery-ui-dialog 1.8.14 | 201 |
| jquery-ui-dialog 1.8.15 | 43 |
| jquery-ui-dialog 1.8.16 | 1510 |
| jquery-ui-dialog 1.8.17 | 138 |
| jquery-ui-dialog 1.8.18 | 455 |
| jquery-ui-dialog 1.8.19 | 17 |
| jquery-ui-dialog 1.8.20 | 88 |
| jquery-ui-dialog 1.8.21 | 137 |
| jquery-ui-dialog 1.8.22 | 74 |
| jquery-ui-dialog 1.8.23 | 402 |
| jquery-ui-dialog 1.8.24 | 380 |
| jquery-ui-dialog 1.9m5 | 2 |
| jquery-ui-dialog 1.9pre | 1 |
| jquery-ui-dialog 1.9.0 | 103 |
| jquery-ui-dialog 1.9.1 | 200 |
| jquery-ui-dialog 1.9.2 | 661 |
| jquery-ui-dialog 1.10.0 | 134 |
| jquery-ui-dialog 1.10.1 | 949 |
| jquery-ui-dialog 1.10.2 | 210 |
| jquery-ui-dialog 1.10.3 | 900 |
| jquery-ui-dialog 1.10.4 | 55 |
| jquery-ui-tooltip 1.8.8 | 6 |
| jquery-ui-tooltip 1.8.16 | 12 |
| jquery-ui-tooltip 1.8.18 | 4 |
| jquery-ui-tooltip 1.9m5 | 2 |
| jquery-ui-tooltip 1.9pre | 1 |
| jquery-ui-tooltip 1.9.0 | 106 |
| jquery-ui-tooltip 1.9.1 | 196 |
| jquery-ui-tooltip 1.9.2 | 559 |
| jquery-ui-tooltip 1.10.0 | 134 |
| jquery-ui-tooltip 1.10.1 | 944 |
| jquery-ui-tooltip 1.10.2 | 212 |
| jquery-ui-tooltip 1.10.3 | 899 |
| jquery-ui-tooltip 1.10.4 | 53 |
jQuery-mobile
Betas and release candidates in use here
| jquery-mobile 1.0b2 | 1 |
|---|---|
| jquery-mobile 1.0rc1 | 1 |
| jquery-mobile 1.0rc2 | 10 |
| jquery-mobile 1.0 | 2 |
| jquery-mobile 1.0.1 | 1 |
| jquery-mobile 1.1.0 | 6 |
| jquery-mobile 1.2.0 | 44 |
| jquery-mobile 1.2.0-rc.1 | 1 |
| jquery-mobile 1.3.0 | 18 |
| jquery-mobile 1.3.1 | 15 |
| jquery-mobile 1.3.2 | 38 |
| jquery-mobile 1.4.0 | 6 |
YUI
The Yahoo User Interface Library is also quite widely used
| YUI 0.12.2 | 5 |
|---|---|
| YUI 1.8.1 | 1 |
| YUI 1.09i | 3 |
| YUI 2.2.0 | 4 |
| YUI 2.2.1 | 21 |
| YUI 2.2.2 | 6 |
| YUI 2.3.0 | 26 |
| YUI 2.3.1 | 59 |
| YUI 2.4.0 | 3 |
| YUI 2.4.1 | 11 |
| YUI 2.5.0 | 22 |
| YUI 2.5.1 | 261 |
| YUI 2.5.2 | 194 |
| YUI 2.6.0 | 24 |
| YUI 2.7.0 | 140 |
| YUI 2.8.0r4 | 1298 |
| YUI 2.8.1 | 58 |
| YUI 2.8.2r1 | 43 |
| YUI 2.8.2 | 1 |
| YUI 2.9.0 | 1124 |
| YUI 3.0.0 | 12 |
| YUI 3.1.1 | 6 |
| YUI 3.2.0 | 68 |
| YUI 3.3.0 | 20 |
| YUI 3.4.0 | 25 |
| YUI 3.4.1 | 482 |
| YUI 3.5.1 | 25 |
| YUI 3.6.0 | 2 |
| YUI 3.7.1 | 26 |
| YUI 3.7.3 | 208 |
| YUI 3.9.0 | 25 |
| YUI 3.9.1 | 1 |
| YUI 3.10.1 | 7 |
| YUI 3.11.0 | 5 |
| YUI 3.13.0 | 3 |
| YUI 3.14.1 | 1 |
Prototype.js
Quite a number of versions in use
| prototypejs 1.3.1 | 5 |
|---|---|
| prototypejs 1.4.0 | 407 |
| prototypejs 1.5 | 3 |
| prototypejs 1.5.0 | 95 |
| prototypejs 1.5.1 | 40 |
| prototypejs 1.5.1.1 | 41 |
| prototypejs 1.5.1.2 | 17 |
| prototypejs 1.6 | 33 |
| prototypejs 1.6.0 | 154 |
| prototypejs 1.6.0.1 | 82 |
| prototypejs 1.6.0.2 | 476 |
| prototypejs 1.6.0.3 | 459 |
| prototypejs 1.6.1 | 474 |
| prototypejs 1.6.1.0 | 15 |
| prototypejs 1.7 | 1268 |
| prototypejs 1.7.0 | 8 |
| prototypejs 1.7.0.0 | 40 |
| prototypejs 1.7.1 | 63 |
| prototypejs 1.7.1.0 | 261 |
| prototypejs 2.05 | 1 |
Other
| angularjs 1.0.1 | 26 |
|---|---|
| angularjs 1.0.2 | 4 |
| angularjs 1.0.4 | 1 |
| angularjs 1.0.6 | 4 |
| angularjs 1.0.7 | 6 |
| angularjs 1.0.8 | 12 |
| angularjs 1.1.4 | 3 |
| angularjs 1.1.5 | 5 |
| angularjs 1.2.0 | 1 |
| angularjs 1.2.0-rc.3 | 11 |
| angularjs 1.2.1 | 5 |
| angularjs 1.2.2 | 3 |
| angularjs 1.2.3 | 1 |
| angularjs 1.2.4 | 21 |
| angularjs 1.2.7 | 2 |
| angularjs 1.2.9 | 2 |
| backbone.js 0.3.3 | 1 |
| backbone.js 0.5.1 | 1 |
| backbone.js 0.5.3 | 11 |
| backbone.js 0.9.0 | 1 |
| backbone.js 0.9.1 | 2 |
| backbone.js 0.9.2 | 40 |
| backbone.js 0.9.9 | 111 |
| backbone.js 0.9.10 | 8 |
| backbone.js 1.0.0 | 51 |
| backbone.js 1.1.0 | 8 |
| dojo 0.0.0 | 16 |
| dojo 0.4.1 | 1 |
| dojo 0.4.3 | 3 |
| dojo 1.0.0 | 2449 |
| dojo 1.1.1 | 1 |
| dojo 1.2.2 | 1 |
| dojo 1.3.1 | 3 |
| dojo 1.3.2 | 3 |
| dojo 1.4.0 | 2 |
| dojo 1.4.1 | 1 |
| dojo 1.4.4 | 1 |
| dojo 1.5.0 | 4 |
| dojo 1.5.1 | 7 |
| dojo 1.5.2 | 13 |
| dojo 1.6.0 | 7 |
| dojo 1.6.1 | 58 |
| dojo 1.7.2 | 2 |
| dojo 1.7.3 | 7 |
| dojo 1.8.0 | 3 |
| dojo 1.8.3 | 17 |
| dojo 1.9.1 | 9 |
| dojo 3.0.0 | 2 |
| easyXDM 2.0.1 | 1 |
| easyXDM 2.4.15.0 | 1 |
| easyXDM 2.4.15.118 | 77 |
| easyXDM 2.4.17.1 | 7 |
| easyXDM 2.4.18.4 | 3 |
| easyXDM 2.4.18.25 | 2 |
| handlebars.js 0.9.0.pre.4 | 1 |
| handlebars.js 1.0.0 | 12 |
| handlebars.js 1.0.0-rc.3 | 15 |
| handlebars.js 1.0.0-rc.4 | 2 |
| handlebars.js 1.0.0.beta.6 | 1 |
| handlebars.js 1.0.beta.1 | 1 |
| handlebars.js 1.0.beta.2 | 6 |
| handlebars.js 1.0.beta.5 | 2 |
| handlebars.js 1.0.beta.6 | 5 |
| handlebars.js 1.0.rc.1 | 8 |
| mustache.js 0.2.3 | 2 |
| mustache.js 0.3.0 | 6 |
| mustache.js 0.3.1 | 17 |
| mustache.js 0.4.0 | 20 |
| mustache.js 0.5.0 | 2 |
| mustache.js 0.5.1 | 1 |
| mustache.js 0.7.0 | 11 |
| mustache.js 0.7.1 | 105 |
| mustache.js 0.7.2 | 22 |
| sessvars 1.01 | 23 |
About Erlend
Security guy with some thoughts on secure development.
Tag cloud
Categories
Blogroll
