CVE-2021-41184

🗓️ 26 Oct 2021 00:00:00Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 997 Views🌐 WEB

jQuery-UI prior to 1.13.0 allows code execution via untrusted `of` option value in `.position()` uti

Reporter	Title	Published	Views	Family All 182
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Governance	11 Jan 202416:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Symphony provides upgraded software packages to address known CVEs	31 Jan 202402:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in jQuery affect IBM Tivoli Netcool Impact	1 Dec 202310:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	13 Jan 202215:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Conductor provides upgraded software packages to address known CVEs	31 Jan 202402:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Workflow Management (EWM) vulnerabilities CVE-2021-41182, CVE-2022-31160, CVE-2021-41184, CVE-2021-41183	27 Mar 202317:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities identified in jQuery-UI affects IBM Engineering Lifecycle Optimization - Publishing	4 Oct 202308:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities	18 Feb 202220:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Aspera Orchestrator was vulnerable to cross-site scripting due to multiple JQuery vulnerabilities (CVE-2021-41184, CVE-2021-41183, CVE-2021-41182)	2 Feb 202320:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Governance - Identity Manager virtual appliance component	10 Jan 202404:21	–	ibm

NVD

Vulners

Node

jqueryui jquery_uiRange<1.13.0jquery

Node

fedoraproject fedoraMatch33

fedoraproject fedoraMatch34

fedoraproject fedoraMatch35

fedoraproject fedoraMatch36

Node

AND

netapp h300s_firmwareMatch-

netapp h300sMatch-

Node

AND

netapp h500s_firmwareMatch-

netapp h500sMatch-

Node

AND

netapp h700s_firmwareMatch-

netapp h700sMatch-

Node

AND

netapp h300e_firmwareMatch-

netapp h300eMatch-

Node

AND

netapp h500e_firmwareMatch-

netapp h500eMatch-

Node

AND

netapp h700e_firmwareMatch-

netapp h700eMatch-

Node

AND

netapp h410s_firmwareMatch-

netapp h410sMatch-

Node

AND

netapp h410c_firmwareMatch-

netapp h410cMatch-

Node

drupal drupalRange7.0–7.86

drupal drupalRange9.2.0–9.2.11

drupal drupalRange9.3.0–9.3.3

Node

tenable tenable.scRange<5.21.0

Node

oracle agile_product_lifecycle_managementMatch9.3.6

oracle application_expressRange<22.1.1

oracle banking_platformMatch2.9.0

oracle banking_platformMatch2.12.0

oracle big_data_spatial_and_graphRange<23.1

oracle big_data_spatial_and_graphMatch23.1

oracle communications_interactive_session_recorderMatch6.4

oracle communications_operations_monitorMatch4.3

oracle communications_operations_monitorMatch4.4

oracle communications_operations_monitorMatch5.0

oracle hospitality_inventory_managementMatch9.1.0

oracle hospitality_materials_controlMatch18.1

oracle hospitality_suite8Range8.11.0–8.14.0

oracle hospitality_suite8Match8.10.2

oracle jd_edwards_enterpriseone_toolsRange≤9.2.6.3

oracle peoplesoft_enterprise_peopletoolsMatch8.58

oracle peoplesoft_enterprise_peopletoolsMatch8.59

oracle policy_automationRange12.2.0–12.2.25

oracle primavera_unifierRange17.7–17.12

oracle primavera_unifierMatch18.8

oracle primavera_unifierMatch19.12

oracle primavera_unifierMatch20.12

oracle primavera_unifierMatch21.12

oracle rest_data_servicesRange<22.1.1-

oracle rest_data_servicesMatch22.1.1-

oracle weblogic_serverMatch12.2.1.3.0

oracle weblogic_serverMatch12.2.1.4.0

oracle weblogic_serverMatch14.1.1.0.0

[
  {
    "vendor": "jquery",
    "product": "jquery-ui",
    "versions": [
      {
        "version": "< 1.13.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/
lists	www.lists.debian.org/debian-lts-announce/2023/08/msg00040.html
blog	www.blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/
security	www.security.netapp.com/advisory/ntap-20211118-0004/
github	www.github.com/jquery/jquery-ui/commit/effa323f1505f2ce7a324e4f429fa9032c72f280
drupal	www.drupal.org/sa-core-2022-001
oracle	www.oracle.com/security-alerts/cpujul2022.html

Parameter	Position	Path	Description	CWE
of	path	_js/jquery/jquery-ui-1.12.1/jquery-ui.min.js	XSS via untrusted input in the of option of jQuery UI position() (v1.12.1) prior to 1.13.0 when loading untrusted values	CWE-79

25 Aug 2026 16:28Current

6.5Medium risk

Vulners AI Score6.5

CVSS 24.3

CVSS 3.16.1 - 6.5

EPSS0.40768

CWE-79