jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
AND |
|
Configuration 4 (hide)
AND |
|
Configuration 5 (hide)
AND |
|
Configuration 6 (hide)
AND |
|
Configuration 7 (hide)
AND |
|
Configuration 8 (hide)
AND |
|
Configuration 9 (hide)
AND |
|
Configuration 10 (hide)
AND |
|
Configuration 11 (hide)
|
Configuration 12 (hide)
|
Configuration 13 (hide)
|
Configuration 14 (hide)
|
History
21 Nov 2024, 06:25
Type | Values Removed | Values Added |
---|---|---|
References | () https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/ - Release Notes, Vendor Advisory | |
References | () https://bugs.jqueryui.com/ticket/15284 - Issue Tracking, Vendor Advisory | |
References | () https://github.com/jquery/jquery-ui/pull/1953 - Patch, Third Party Advisory | |
References | () https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4 - Exploit, Mitigation, Third Party Advisory | |
References | () https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html - Mailing List, Third Party Advisory | |
References | () https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html - | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/ - Mailing List, Third Party Advisory | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/ - Mailing List, Third Party Advisory | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/ - Mailing List, Third Party Advisory | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/ - Mailing List, Third Party Advisory | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/ - Mailing List, Third Party Advisory | |
References | () https://security.netapp.com/advisory/ntap-20211118-0004/ - Third Party Advisory | |
References | () https://www.drupal.org/sa-contrib-2022-004 - Third Party Advisory | |
References | () https://www.drupal.org/sa-core-2022-001 - Third Party Advisory | |
References | () https://www.drupal.org/sa-core-2022-002 - Third Party Advisory | |
References | () https://www.oracle.com/security-alerts/cpuapr2022.html - Patch, Third Party Advisory | |
References | () https://www.oracle.com/security-alerts/cpujul2022.html - Third Party Advisory | |
References | () https://www.tenable.com/security/tns-2022-09 - Patch, Release Notes, Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.5 |
31 Aug 2023, 03:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
21 Jun 2023, 18:23
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:jqueryui:jquery_ui:*:*:*:*:*:jquery:*:* | |
First Time |
Jqueryui jquery Ui
Jqueryui |
Information
Published : 2021-10-26 15:15
Updated : 2024-11-21 06:25
NVD link : CVE-2021-41183
Mitre link : CVE-2021-41183
CVE.ORG link : CVE-2021-41183
JSON object : View
Products Affected
jqueryui
- jquery_ui
netapp
- h300s_firmware
- h700e_firmware
- h410s_firmware
- h410c_firmware
- h300e
- h300s
- h700s
- h500e_firmware
- h300e_firmware
- h410c
- h410s
- h500s_firmware
- h700e
- h500s
- h500e
- h700s_firmware
oracle
- primavera_gateway
- peoplesoft_enterprise_peopletools
- banking_platform
- application_express
- big_data_spatial_and_graph
- agile_plm
- communications_operations_monitor
- rest_data_services
- hospitality_inventory_management
- weblogic_server
- communications_interactive_session_recorder
- mysql_enterprise_monitor
- policy_automation
- hospitality_suite8
- jd_edwards_enterpriseone_tools
fedoraproject
- fedora
debian
- debian_linux
tenable
- tenable.sc
drupal
- drupal
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')