Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 01:46
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://bugs.jqueryui.com/ticket/8859 - Issue Tracking, Vendor Advisory | |
| References | () http://bugs.jqueryui.com/ticket/8861 - Issue Tracking, Vendor Advisory | |
| References | () http://rhn.redhat.com/errata/RHSA-2015-0442.html - Third Party Advisory | |
| References | () http://rhn.redhat.com/errata/RHSA-2015-1462.html - | |
| References | () http://seclists.org/oss-sec/2014/q4/613 - Third Party Advisory, VDB Entry | |
| References | () http://seclists.org/oss-sec/2014/q4/616 - Third Party Advisory, VDB Entry | |
| References | () http://www.securityfocus.com/bid/71107 - | |
| References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/98697 - | |
| References | () https://github.com/jquery/jquery-ui/commit/5fee6fd5000072ff32f2d65b6451f39af9e0e39e - Issue Tracking, Patch, Third Party Advisory | |
| References | () https://github.com/jquery/jquery-ui/commit/f2854408cce7e4b7fc6bf8676761904af9c96bde - Issue Tracking, Patch, Third Party Advisory | |
| References | () https://github.com/jquery/jquery/issues/2432 - |
Information
Published : 2014-11-24 16:59
Updated : 2024-11-21 01:46
NVD link : CVE-2012-6662
Mitre link : CVE-2012-6662
CVE.ORG link : CVE-2012-6662
JSON object : View
Products Affected
redhat
- enterprise_linux_server
- enterprise_linux_desktop
- enterprise_linux_hpc_node
- enterprise_linux_workstation
jqueryui
- jquery_ui
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')