Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
osvGoogleOSV:GHSA-HPCF-8VF9-Q4GJ
HistoryOct 24, 2017 - 6:33 p.m.

jQuery-UI vulnerable to Cross-site Scripting in dialog closeText

2017-10-2418:33:35
Google
osv.dev
135

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.005 Low

EPSS

Percentile

75.0%

JSON

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

References

Related

attackerkb 1
f5 2
cve 1
alpinelinux 1
github 1
openvas 10
redhatcve 1
redhat 3
prion 1
fedora 6
debiancve 1
veracode 1
ibm 7
osv 3
checkpoint_advisories 1
ubuntucve 1
nodejs 1
nessus 11
drupal 1
debian 1
ubuntu 1
ics 1
oracle 7
attackerkb
attackerkb
CVE-2016-7103
2017-03-15 00:00:00
f5
f5
K95208524 : jQuery vulnerability CVE-2016-7103
2017-11-13 00:00:00
K12492858 : Appliance mode authenticated F5 BIG-IP Guided Configuration third-party lodash and jQuery vulnerabilities CVE-2021-23337, CVE-2020-28500, and CVE-2016-7103
2022-05-06 00:00:00
cve
cve
CVE-2016-7103
2017-03-15 16:59:00
alpinelinux
alpinelinux
CVE-2016-7103
2017-03-15 16:59:00
github
github
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText
2017-10-24 18:33:35
openvas
openvas
Fedora Update for python-XStatic-jquery-ui FEDORA-2017-e2d17af41e
2017-11-23 00:00:00
Fedora Update for python-XStatic-jquery-ui FEDORA-2017-1bf5a0ce01
2017-11-23 00:00:00
Fedora Update for rubygem-jquery-ui-rails FEDORA-2019-a96124345a
2019-06-20 00:00:00
redhatcve
redhatcve
CVE-2016-7103
2016-08-29 07:18:37
redhat
redhat
(RHSA-2017:0161) Low: python-XStatic-jquery-ui security update
2017-01-19 13:13:57
(RHSA-2016:2932) Low: python-XStatic-jquery-ui security update
2016-12-08 16:02:28
(RHSA-2016:2933) Low: python-XStatic-jquery-ui security update
2016-12-08 16:02:32
prion
prion
Cross site scripting
2017-03-15 16:59:00
fedora
fedora
[SECURITY] Fedora 25 Update: python-XStatic-jquery-ui-1.12.0.1-4.fc25
2017-11-22 05:09:08
[SECURITY] Fedora 30 Update: rubygem-jquery-ui-rails-6.0.1-1.fc30
2019-06-19 22:46:06
[SECURITY] Fedora 26 Update: python-XStatic-jquery-ui-1.12.0.1-2.fc26
2017-11-22 02:32:23
debiancve
debiancve
CVE-2016-7103
2017-03-15 16:59:00
veracode
veracode
Cross-site Scripting (XSS) Via Dialog CloseText
2019-01-15 09:14:35
ibm
ibm
Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by a Using Components with Known Vulnerabilities vulnerability
2018-06-16 22:07:03
Security Bulletin: Multiple vulnerabilities identified in jQuery-UI affects IBM Engineering Lifecycle Optimization - Publishing
2023-10-04 08:27:50
Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities
2020-07-30 13:47:03
osv
osv
CVE-2016-7103
2017-03-15 16:59:00
drupal7 - security update
2022-01-19 00:00:00
jqueryui vulnerabilities
2023-10-05 12:36:27
checkpoint_advisories
checkpoint_advisories
jQuery UI Cross-site Scripting (CVE-2016-7103)
2022-10-23 00:00:00
ubuntucve
ubuntucve
CVE-2016-7103
2017-03-15 00:00:00
nodejs
nodejs
XSS in dialog closeText
2016-07-21 20:53:40
nessus
nessus
F5 Networks BIG-IP : Appliance mode authenticated F5 BIG-IP Guided Configuration third-party lodash and jQuery vulnerabilities (K12492858)
2023-11-02 00:00:00
Drupal 7.x < 7.86 / 9.2.x < 9.2.11 / 9.3.x < 9.3.3 Multiple Vulnerabilities (drupal-2022-01-19)
2022-01-19 00:00:00
Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : jQuery UI vulnerabilities (USN-6419-1)
2023-10-05 00:00:00
drupal
drupal
Drupal core - Moderately critical - Cross site scripting - SA-CORE-2022-002
2022-01-19 00:00:00
debian
debian
[SECURITY] [DLA-2889-1] drupal7 security update
2022-01-19 20:00:29
ubuntu
ubuntu
jQuery UI vulnerabilities
2023-10-05 00:00:00
ics
ics
Hitachi Energy MSM Product
2022-08-30 12:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - October 2019
2020-01-22 00:00:00
Oracle Critical Patch Update Advisory - July 2019
2019-07-16 00:00:00
Oracle Critical Patch Update Advisory - April 2019
2019-04-16 00:00:00

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.005 Low

EPSS

Percentile

75.0%

JSON
Related for OSV:GHSA-HPCF-8VF9-Q4GJ
attackerkb1f52cve1alpinelinux1github1openvas10redhatcve1redhat3prion1fedora6debiancve1veracode1ibm7osv3checkpoint_advisories1ubuntucve1nodejs1nessus11drupal1debian1ubuntu1ics1oracle7