February 24, 2014 - 20:10 UTC - Tags:
After scanning Norway I decided to scan the Alexa top 100,000 sites. Summarized over 60% are using JavaScript libraries with known vulnerabilities. Which means they will have problems with OWASP Top 10 2013-A9 Using Components with Known Vulnerabilities. I would like to stress though, that using a library with a known vulnerability, does not necessarily mean the site is vulnerable, because the vulnerable code may not be used.
Overall results
- Top 1,000 - 551 - 55,1% using libraries with known vulnerabilities
- Top 10,000 - 6,185 - 61,85% using libraries with known vulnerabilities
- Top 100,000 - 60,866 - 60,866% using libraries with known vulnerabilities
Libraries
jQuery
jQuery is a very widely used library. I was surprised however to find so many different and old versions in use
| jquery 1.0.0 | 3 |
|---|---|
| jquery 10.1 | 1 |
| jquery 1.0.2 | 2 |
| jquery 10.3.0.0 | 1 |
| jquery 1.0 | 4 |
| jquery 1.10 | 5 |
| jquery 1.10.0 | 142 |
| jquery 1.10.1 | 982 |
| jquery 1.10.2 | 13359 |
| jquery 1.10.2.x | 30 |
| jquery 1.10.3-pre | 1 |
| jquery 1.11 | 1 |
| jquery 1.11.0 | 471 |
| jquery 1.11.0-beta2 | 2 |
| jquery 1.11.0-beta3 | 1 |
| jquery 1.11.0-pre | 1 |
| jquery 1.11.1pre | 1 |
| jquery 1.1.1.1 | 1 |
| jquery 1.1.1 | 2 |
| jquery 1.12.2.1 | 3 |
| jquery 1.12.2.3 | 112 |
| jquery 1.1.2 | 22 |
| jquery 1.1.3.1 | 22 |
| jquery 1.1.3a | 1 |
| jquery 1.1.3 | 4 |
| jquery 1.1.4 | 18 |
| jquery 1.1 | 5 |
| jquery 1.2.0 | 1 |
| jquery 1.2.1 | 114 |
| jquery 1.2.2e | 7 |
| jquery 1.2.2 | 81 |
| jquery 1.2.3b | 4 |
| jquery 1.2.3 | 374 |
| jquery 1.2.4a | 3 |
| jquery 1.2.4b | 1 |
| jquery 1.2.4 | 4 |
| jquery 1.2.5 | 7 |
| jquery 1.2.6 | 1759 |
| jquery 1.2.8 | 2 |
| jquery 1.2 | 22 |
| jquery 1.3.0 | 18 |
| jquery 1.3.1 | 362 |
| jquery 1.3.2 | 4450 |
| jquery 1.3rc1 | 2 |
| jquery 1.3 | 210 |
| jquery 1.4.0 | 34 |
| jquery 1.4.1 | 602 |
| jquery 1.4.20 | 1 |
| jquery 1.4.2 | 6589 |
| jquery 1.4.3pre | 39 |
| jquery 1.4.3 | 666 |
| jquery 1.4.4rc1 | 1 |
| jquery 1.4.4 | 3176 |
| jquery 1.4a2 | 51 |
| jquery 1.4rc1 | 1 |
| jquery 1.4 | 489 |
| jquery 1.5.0 | 37 |
| jquery 1.5.1rc1 | 1 |
| jquery 1.5.1 | 1550 |
| jquery 1.5.2 | 1417 |
| jquery 1.5.3 | 1 |
| jquery 1.5 | 492 |
| jquery 1.6.0 | 82 |
| jquery 1.6.1rc1 | 2 |
| jquery 1.6.1 | 1493 |
| jquery 1.6.2pre | 2 |
| jquery 1.6.2 | 2251 |
| jquery 1.6.3 | 231 |
| jquery 1.6.4.1 | 3 |
| jquery 1.6.4rc1 | 1 |
| jquery 1.6.4 | 3693 |
| jquery 1.6 | 405 |
| jquery 1.7.0 | 190 |
| jquery 1.7.1.1 | 1 |
| jquery 1.7.1 | 8806 |
| jquery 1.7.2 | 9610 |
| jquery 1.7.3pre | 2 |
| jquery 1.7.3 | 2 |
| jquery 1.7b2 | 1 |
| jquery 1.7rc2 | 4 |
| jquery 1.7 | 1281 |
| jquery 1.8.0 | 1232 |
| jquery 1.8.1 | 1206 |
| jquery 1.8.2pre | 1 |
| jquery 1.8.2 | 4282 |
| jquery 1.8.3 | 6996 |
| jquery 1.8 | 357 |
| jquery 1.9 | 10 |
| jquery 1.9.0 | 932 |
| jquery 1.9.0rc1 | 2 |
| jquery 1.9.1 | 5882 |
| jquery 1.9.2 | 3 |
| jquery 1.9.2-pre | 1 |
| jquery 1.9.4.1 | 1 |
| jquery 2.0 | 4 |
| jquery 2.0.0 | 137 |
| jquery 2.0.1 | 11 |
| jquery 2.0.14 | 3 |
| jquery 2.0.2 | 74 |
| jquery 2.0.3 | 519 |
| jquery 2.1.0 | 127 |
| jquery 2.4.0 | 3 |
jQuery UI
Loads of different versions
| jquery-ui-autocomplete 1.10.0 | 283 |
|---|---|
| jquery-ui-autocomplete 1.10.0pre | 1 |
| jquery-ui-autocomplete 1.10.1 | 258 |
| jquery-ui-autocomplete 1.10.2 | 458 |
| jquery-ui-autocomplete 1.10.3 | 1753 |
| jquery-ui-autocomplete 1.10.3pre | 1 |
| jquery-ui-autocomplete 1.10.4 | 187 |
| jquery-ui-autocomplete 1.10.5pre | 1 |
| jquery-ui-autocomplete 1.7.2 | 1 |
| jquery-ui-autocomplete 1.7.3 | 1 |
| jquery-ui-autocomplete 1.8.10 | 141 |
| jquery-ui-autocomplete 1.8.11 | 276 |
| jquery-ui-autocomplete 1.8.12 | 125 |
| jquery-ui-autocomplete 1.8.13 | 233 |
| jquery-ui-autocomplete 1.8.14 | 258 |
| jquery-ui-autocomplete 1.8.15 | 70 |
| jquery-ui-autocomplete 1.8.16 | 1097 |
| jquery-ui-autocomplete 1.8.17 | 312 |
| jquery-ui-autocomplete 1.8.18 | 1067 |
| jquery-ui-autocomplete 1.8.19 | 70 |
| jquery-ui-autocomplete 1.8.1 | 103 |
| jquery-ui-autocomplete 1.8.20 | 170 |
| jquery-ui-autocomplete 1.8.21 | 227 |
| jquery-ui-autocomplete 1.8.22 | 135 |
| jquery-ui-autocomplete 1.8.23 | 485 |
| jquery-ui-autocomplete 1.8.24 | 442 |
| jquery-ui-autocomplete 1.8.2 | 283 |
| jquery-ui-autocomplete 1.8.4 | 158 |
| jquery-ui-autocomplete 1.8.5 | 195 |
| jquery-ui-autocomplete 1.8.6 | 159 |
| jquery-ui-autocomplete 1.8.7 | 168 |
| jquery-ui-autocomplete 1.8.8 | 18 |
| jquery-ui-autocomplete 1.8.9 | 186 |
| jquery-ui-autocomplete 1.8rc1 | 3 |
| jquery-ui-autocomplete 1.8rc3 | 1 |
| jquery-ui-autocomplete 1.8 | 48 |
| jquery-ui-autocomplete 1.9.0m8 | 1 |
| jquery-ui-autocomplete 1.9.0-rc.1 | 1 |
| jquery-ui-autocomplete 1.9.0 | 228 |
| jquery-ui-autocomplete 1.9.1 | 416 |
| jquery-ui-autocomplete 1.9.2 | 979 |
| jquery-ui-autocomplete 1.9m2 | 1 |
| jquery-ui-autocomplete 1.9m4 | 1 |
| jquery-ui-autocomplete 1.9m7 | 1 |
| jquery-ui-autocomplete 1.9pre | 5 |
| jquery-ui-dialog 1.10.0 | 241 |
| jquery-ui-dialog 1.10.0pre | 1 |
| jquery-ui-dialog 1.10.1 | 255 |
| jquery-ui-dialog 1.10.2 | 444 |
| jquery-ui-dialog 1.10.3 | 1694 |
| jquery-ui-dialog 1.10.3pre | 1 |
| jquery-ui-dialog 1.10.4 | 180 |
| jquery-ui-dialog 1.10.5pre | 1 |
| jquery-ui-dialog 1.5 | 1 |
| jquery-ui-dialog 1.5.3 | 1 |
| jquery-ui-dialog 1.6 | 2 |
| jquery-ui-dialog 1.6rc5 | 1 |
| jquery-ui-dialog 1.6rc6 | 1 |
| jquery-ui-dialog 1.7 | 12 |
| jquery-ui-dialog 1.7.1 | 15 |
| jquery-ui-dialog 1.7.2 | 189 |
| jquery-ui-dialog 1.7.3 | 21 |
| jquery-ui-dialog 1.8 | 56 |
| jquery-ui-dialog 1.8.1 | 106 |
| jquery-ui-dialog 1.8.10 | 141 |
| jquery-ui-dialog 1.8.11 | 279 |
| jquery-ui-dialog 1.8.12 | 112 |
| jquery-ui-dialog 1.8.13 | 223 |
| jquery-ui-dialog 1.8.14 | 249 |
| jquery-ui-dialog 1.8.15 | 92 |
| jquery-ui-dialog 1.8.16 | 1124 |
| jquery-ui-dialog 1.8.17 | 273 |
| jquery-ui-dialog 1.8.18 | 1038 |
| jquery-ui-dialog 1.8.19 | 86 |
| jquery-ui-dialog 1.8.2 | 272 |
| jquery-ui-dialog 1.8.20 | 163 |
| jquery-ui-dialog 1.8.21 | 206 |
| jquery-ui-dialog 1.8.22 | 118 |
| jquery-ui-dialog 1.8.23 | 478 |
| jquery-ui-dialog 1.8.24 | 540 |
| jquery-ui-dialog 1.8.4 | 164 |
| jquery-ui-dialog 1.8.5 | 187 |
| jquery-ui-dialog 1.8.6 | 147 |
| jquery-ui-dialog 1.8.7 | 194 |
| jquery-ui-dialog 1.8.8 | 19 |
| jquery-ui-dialog 1.8.9 | 170 |
| jquery-ui-dialog 1.8rc1 | 3 |
| jquery-ui-dialog 1.8rc3 | 6 |
| jquery-ui-dialog 1.9.0-rc.1 | 1 |
| jquery-ui-dialog 1.9.0 | 212 |
| jquery-ui-dialog 1.9.1 | 403 |
| jquery-ui-dialog 1.9.2 | 1036 |
| jquery-ui-dialog 1.9m2 | 1 |
| jquery-ui-dialog 1.9m4 | 1 |
| jquery-ui-dialog 1.9m7 | 1 |
| jquery-ui-dialog 1.9pre | 5 |
| jquery-ui-tooltip 1.10.0 | 261 |
| jquery-ui-tooltip 1.10.0pre | 1 |
| jquery-ui-tooltip 1.10.1 | 242 |
| jquery-ui-tooltip 1.10.2 | 435 |
| jquery-ui-tooltip 1.10.3 | 1634 |
| jquery-ui-tooltip 1.10.3pre | 1 |
| jquery-ui-tooltip 1.10.4 | 175 |
| jquery-ui-tooltip 1.10.5pre | 1 |
| jquery-ui-tooltip 1.8.13 | 1 |
| jquery-ui-tooltip 1.8.17 | 1 |
| jquery-ui-tooltip 1.8.18 | 2 |
| jquery-ui-tooltip 1.8.21 | 1 |
| jquery-ui-tooltip 1.8.23 | 1 |
| jquery-ui-tooltip 1.8.9 | 1 |
| jquery-ui-tooltip 1.9.0 | 211 |
| jquery-ui-tooltip 1.9.0-rc.1 | 1 |
| jquery-ui-tooltip 1.9.1 | 374 |
| jquery-ui-tooltip 1.9.2 | 874 |
| jquery-ui-tooltip 1.9m3 | 1 |
| jquery-ui-tooltip 1.9m4 | 1 |
| jquery-ui-tooltip 1.9pre | 5 |
jQuery-mobile
Betas and release candidates in use here
| jquery-mobile 1.0a4.1 | 1 |
|---|---|
| jquery-mobile 1.0b1 | 1 |
| jquery-mobile 1.0b2 | 1 |
| jquery-mobile 1.0rc1 | 1 |
| jquery-mobile 1.0rc2.customized | 12 |
| jquery-mobile 1.0rc2 | 1 |
| jquery-mobile 1.0.vb | 1 |
| jquery-mobile 1.0 | 1 |
| jquery-mobile 1.1.0 | 6 |
| jquery-mobile 1.1.1 | 8 |
| jquery-mobile 1.1.2 | 2 |
| jquery-mobile 1.2.0 | 22 |
| jquery-mobile 1.3.0 | 21 |
| jquery-mobile 1.3.0-rc.1 | 1 |
| jquery-mobile 1.3.1 | 29 |
| jquery-mobile 1.3.2 | 54 |
| jquery-mobile 1.3.2.custom | 1 |
| jquery-mobile 1.4.0 | 10 |
| jquery-mobile 2013 | 1 |
YUI
The Yahoo User Interface Library is also quite widely used
| YUI 0.10.0 | 1 |
|---|---|
| YUI 0.12.2 | 16 |
| YUI 1.09i | 2 |
| YUI 1.10.2 | 2 |
| YUI 1.8.16 | 1 |
| YUI 1.8.2 | 1 |
| YUI 2.0 | 1 |
| YUI 2.2.0 | 12 |
| YUI 2.2.1 | 6 |
| YUI 2.2.2 | 8 |
| YUI 2.3.0 | 19 |
| YUI 2.3.1 | 42 |
| YUI 2.4.0 | 26 |
| YUI 2.4.1 | 32 |
| YUI 2.5.0 | 29 |
| YUI 2.5.1r2 | 1 |
| YUI 2.5.1 | 52 |
| YUI 2.5.2 | 102 |
| YUI 2.6.0 | 223 |
| YUI 2.7.0 | 691 |
| YUI 2.8.0r4 | 310 |
| YUI 2.8.0 | 1 |
| YUI 2.8.0. | 1 |
| YUI 2.8.1r2 | 1 |
| YUI 2.8.1 | 63 |
| YUI 2.8.2int | 12 |
| YUI 2.8.2r1 | 65 |
| YUI 2.8.2 | 1 |
| YUI 2.8.x | 1 |
| YUI 2.9.0 | 1337 |
| YUI 2.x | 1 |
| YUI 3.0.0b1 | 23 |
| YUI 3.0.0 | 22 |
| YUI 3.10.0 | 47 |
| YUI 3.10.1 | 4 |
| YUI 3.10.3 | 22 |
| YUI 3.1.0 | 6 |
| YUI 3.11.0 | 114 |
| YUI 3.1.1 | 6 |
| YUI 3.12.0 | 6 |
| YUI 3.1.2 | 3 |
| YUI 3.13.0 | 75 |
| YUI 3.14.0 | 20 |
| YUI 3.14.1 | 17 |
| YUI 3.2.0 | 58 |
| YUI 3.3.0 | 56 |
| YUI 3.4.0 | 88 |
| YUI 3.4.1 | 69 |
| YUI 3.5.0 | 31 |
| YUI 3.5.1 | 20 |
| YUI 3.6.0 | 2 |
| YUI 3.7.2 | 40 |
| YUI 3.7.3 | 16 |
| YUI 3.8.0 | 7 |
| YUI 3.8.1 | 7 |
| YUI 3.9.0 | 160 |
| YUI 3.9.1 | 31 |
| YUI 3.x | 1 |
Prototype.js
Quite a number of versions in use
| prototypejs 1.3.1 | 3 |
|---|---|
| prototypejs 1.4.0 | 107 |
| prototypejs 1.4.0. | 1 |
| prototypejs 1.4.1 | 1 |
| prototypejs 1.5.0 | 227 |
| prototypejs 1.5.1.1 | 60 |
| prototypejs 1.5.1.2 | 10 |
| prototypejs 1.5.1 | 39 |
| prototypejs 1.6.0.1 | 61 |
| prototypejs 1.6.0.2 | 190 |
| prototypejs 1.6.0.3 | 388 |
| prototypejs 1.6.0 | 118 |
| prototypejs 1-6-1 | 3 |
| prototypejs 1.6.1 | 327 |
| prototypejs 1.6.1.0 | 32 |
| prototypejs 1.6 | 4 |
| prototypejs 1.7 | 1012 |
| prototypejs 1.7.0 | 1 |
| prototypejs 1.7.0.0 | 86 |
| prototypejs 1.7.1 | 255 |
| prototypejs 1.7.1.0 | 134 |
| prototypejs 1.7.2-beta | 1 |
| prototypejs 1.9.0 | 1 |
Other
| angularjs 0.10.6 | 1 |
|---|---|
| angularjs 1.0.1 | 7 |
| angularjs 1.0.2 | 9 |
| angularjs 1.0.3 | 3 |
| angularjs 1.0.4 | 9 |
| angularjs 1.0.5 | 9 |
| angularjs 1.0.6 | 7 |
| angularjs 1.0.7 | 49 |
| angularjs 1.0.8 | 26 |
| angularjs 1.1.1 | 1 |
| angularjs 1.1.2 | 5 |
| angularjs 1.1.4 | 6 |
| angularjs 1.1.5 | 29 |
| angularjs 1.2.0 | 12 |
| angularjs 120 | 1 |
| angularjs 1.2.0rc1 | 4 |
| angularjs 1.2.0-rc.2 | 6 |
| angularjs 1.2.0-rc.3 | 98 |
| angularjs 1.2.1 | 5 |
| angularjs 1.2.10 | 17 |
| angularjs 1.2.11 | 5 |
| angularjs 1.2.11-build.2204 | 4 |
| angularjs 1.2.12 | 15 |
| angularjs 1.2.13 | 4 |
| angularjs 1.2.2 | 5 |
| angularjs 1.2.3 | 11 |
| angularjs 1.2.4 | 7 |
| angularjs 1.2.5 | 6 |
| angularjs 1.2.6 | 13 |
| angularjs 1.2.7 | 27 |
| angularjs 1.2.7-build.2026 | 3 |
| angularjs 1.2.8 | 6 |
| angularjs 1.2.8-build.2087 | 1 |
| angularjs 1.2.9 | 26 |
| backbone.js 0.3.3 | 3 |
| backbone.js 0.5.1 | 3 |
| backbone.js 0.5.2 | 1 |
| backbone.js 0.5.3 | 17 |
| backbone.js 0.9.0 | 1 |
| backbone.js 0.9.1 | 6 |
| backbone.js 0.9.10 | 25 |
| backbone.js 0.9.2 | 91 |
| backbone.js 0.9.9 | 14 |
| backbone.js 1.0.0 | 151 |
| backbone.js 1.1.0 | 50 |
| backbone.js 1.1.2 | 1 |
| dojo 0.0.0 | 77 |
| dojo 0.0.1 | 1 |
| dojo 0.1.0 | 1 |
| dojo 0.2.2 | 2 |
| dojo 0.3.1 | 2 |
| dojo 0.4.3-custom-4.1.5 | 1 |
| dojo 0.4.3-custom-4.1.6 | 1 |
| dojo 1.0.0 | 2 |
| dojo 1.0.2 | 2 |
| dojo 1.1.1 | 4 |
| dojo 1.2.0 | 1 |
| dojo 1.2.2 | 2 |
| dojo 1.2.3 | 4 |
| dojo 1.3.0 | 2 |
| dojo 1.3.1 | 4 |
| dojo 1.3.2 | 10 |
| dojo 1.4.1 | 9 |
| dojo 1.4.2 | 1 |
| dojo 1.4.3 | 2 |
| dojo 1.4.4 | 1 |
| dojo 1.5.0 | 4 |
| dojo 1.5.2 | 7 |
| dojo 1.6.0 | 18 |
| dojo 1.6.1 | 28 |
| dojo 1.7.1 | 1 |
| dojo 1.7.2 | 3 |
| dojo 1.7.3 | 11 |
| dojo 1.8.0 | 3 |
| dojo 1.8.1 | 3 |
| dojo 1.8.3 | 4 |
| dojo 1.8.5 | 1 |
| dojo 1.9.0 | 1 |
| dojo 1.9.1 | 8 |
| dojo 3.0.0 | 16 |
| easyXDM 0.9.9 | 1 |
| easyXDM 10.2.55 | 1 |
| easyXDM 1.7.2 | 3 |
| easyXDM 2.4.10.0 | 4 |
| easyXDM 2.4.10.103 | 2 |
| easyXDM 2.4.14.117 | 11 |
| easyXDM 2.4.15.118 | 43 |
| easyXDM 2.4.16.0 | 49 |
| easyXDM 2.4.16.3 | 12 |
| easyXDM 2.4.17.0 | 1 |
| easyXDM 2.4.17.1 | 21 |
| easyXDM 2.4.18.0 | 4 |
| easyXDM 2.4.18.25 | 18 |
| easyXDM 2.4.18.4 | 10 |
| easyXDM 2.4.18.9 | 8 |
| easyXDM 2.4.19.3 | 1 |
| handlebars.js 0.9.0.pre.4 | 2 |
| handlebars.js 1.0.0 | 42 |
| handlebars.js 1.0.0.beta2 | 3 |
| handlebars.js 1.0.0.beta.6 | 18 |
| handlebars.js 1.0.0-rc.3 | 29 |
| handlebars.js 1.0.0-rc.4 | 7 |
| handlebars.js 1.0.12 | 1 |
| handlebars.js 1.0.beta.1 | 1 |
| handlebars.js 1.0.beta.2 | 8 |
| handlebars.js 1.0.beta.5 | 6 |
| handlebars.js 1.0.beta.6 | 37 |
| handlebars.js 1.0.rc.1 | 26 |
| handlebars.js 1.0.rc.2 | 5 |
| handlebars.js 1.1.2 | 1 |
| handlebars.js 1.3.0 | 4 |
| mustache.js 0.2.3-dev | 1 |
| mustache.js 0.3.0 | 21 |
| mustache.js 0.3.1-dev | 71 |
| mustache.js 0.4.0 | 15 |
| mustache.js 0.40.0-44 | 1 |
| mustache.js 0.4.0-dev | 32 |
| mustache.js 0.4.1 | 1 |
| mustache.js 0.4.2 | 4 |
| mustache.js 0.4.3-dev | 1 |
| mustache.js 0.5 | 1 |
| mustache.js 0.5.0 | 2 |
| mustache.js 0.5.0-dev | 39 |
| mustache.js 0.5.1-dev | 4 |
| mustache.js 0.5.2 | 6 |
| mustache.js 0.5.2-dev | 1 |
| mustache.js 0.6.0 | 2 |
| mustache.js 0.7.0 | 13 |
| mustache.js 0.7.1 | 12 |
| mustache.js 0.7.2 | 107 |
| mustache.js 0.7.3 | 2 |
| mustache.js 0.8.0 | 1 |
| mustache.js 0.8.1 | 4 |
| mustache.js 19 | 1 |
| sessvars 1.01 | 43 |
About Erlend
Security guy with some thoughts on secure development.
Tag cloud
Categories
Blogroll
