Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nodejsPhat LyNODEJS:127
HistoryJul 21, 2016 - 8:53 p.m.

XSS in dialog closeText

2016-07-2120:53:40
Phat Ly
www.npmjs.com
5953

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

JSON

Overview

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

References

CPENameOperatorVersion
jquery-uile1.11.4

Related

attackerkb 1
veracode 1
fedora 6
redhat 3
ibm 7
openvas 3
osv 4
redhatcve 1
prion 1
debiancve 1
f5 2
alpinelinux 1
cve 1
github 1
checkpoint_advisories 1
ubuntucve 1
nessus 11
debian 1
drupal 1
ubuntu 1
ics 1
oracle 7
attackerkb
attackerkb
CVE-2016-7103
2017-03-15 00:00:00
veracode
veracode
Cross-site Scripting (XSS) Via Dialog CloseText
2019-01-15 09:14:35
fedora
fedora
[SECURITY] Fedora 30 Update: rubygem-jquery-ui-rails-6.0.1-1.fc30
2019-06-19 22:46:06
[SECURITY] Fedora 25 Update: python-XStatic-jquery-ui-1.12.0.1-4.fc25
2017-11-22 05:09:08
[SECURITY] Fedora 26 Update: python-XStatic-jquery-ui-1.12.0.1-2.fc26
2017-11-22 02:32:23
redhat
redhat
(RHSA-2016:2932) Low: python-XStatic-jquery-ui security update
2016-12-08 16:02:28
(RHSA-2017:0161) Low: python-XStatic-jquery-ui security update
2017-01-19 13:13:57
(RHSA-2016:2933) Low: python-XStatic-jquery-ui security update
2016-12-08 16:02:32
ibm
ibm
Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by a Using Components with Known Vulnerabilities vulnerability
2018-06-16 22:07:03
Security Bulletin: Multiple vulnerabilities identified in jQuery-UI affects IBM Engineering Lifecycle Optimization - Publishing
2023-10-04 08:27:50
Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities
2020-07-30 13:47:03
openvas
openvas
Fedora Update for python-XStatic-jquery-ui FEDORA-2017-1bf5a0ce01
2017-11-23 00:00:00
Fedora Update for python-XStatic-jquery-ui FEDORA-2017-e2d17af41e
2017-11-23 00:00:00
Fedora Update for rubygem-jquery-ui-rails FEDORA-2019-a96124345a
2019-06-20 00:00:00
osv
osv
CVE-2016-7103
2017-03-15 16:59:00
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText
2017-10-24 18:33:35
drupal7 - security update
2022-01-19 00:00:00
redhatcve
redhatcve
CVE-2016-7103
2016-08-29 07:18:37
prion
prion
Cross site scripting
2017-03-15 16:59:00
debiancve
debiancve
CVE-2016-7103
2017-03-15 16:59:00
f5
f5
K95208524 : jQuery vulnerability CVE-2016-7103
2017-11-13 00:00:00
K12492858 : Appliance mode authenticated F5 BIG-IP Guided Configuration third-party lodash and jQuery vulnerabilities CVE-2021-23337, CVE-2020-28500, and CVE-2016-7103
2022-05-06 00:00:00
alpinelinux
alpinelinux
CVE-2016-7103
2017-03-15 16:59:00
cve
cve
CVE-2016-7103
2017-03-15 16:59:00
github
github
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText
2017-10-24 18:33:35
checkpoint_advisories
checkpoint_advisories
jQuery UI Cross-site Scripting (CVE-2016-7103)
2022-10-23 00:00:00
ubuntucve
ubuntucve
CVE-2016-7103
2017-03-15 00:00:00
nessus
nessus
F5 Networks BIG-IP : Appliance mode authenticated F5 BIG-IP Guided Configuration third-party lodash and jQuery vulnerabilities (K12492858)
2023-11-02 00:00:00
Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : jQuery UI vulnerabilities (USN-6419-1)
2023-10-05 00:00:00
Drupal 7.x < 7.86 / 9.2.x < 9.2.11 / 9.3.x < 9.3.3 Multiple Vulnerabilities (drupal-2022-01-19)
2022-01-19 00:00:00
debian
debian
[SECURITY] [DLA-2889-1] drupal7 security update
2022-01-19 20:00:29
drupal
drupal
Drupal core - Moderately critical - Cross site scripting - SA-CORE-2022-002
2022-01-19 00:00:00
ubuntu
ubuntu
jQuery UI vulnerabilities
2023-10-05 00:00:00
ics
ics
Hitachi Energy MSM Product
2022-08-30 12:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - October 2019
2020-01-22 00:00:00
Oracle Critical Patch Update Advisory - April 2019
2019-04-16 00:00:00
Oracle Critical Patch Update Advisory - July 2019
2019-07-16 00:00:00

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

JSON
Related for NODEJS:127
attackerkb1veracode1fedora6redhat3ibm7openvas3osv4redhatcve1prion1debiancve1f52alpinelinux1cve1github1checkpoint_advisories1ubuntucve1nessus11debian1drupal1ubuntu1ics1oracle7