CVE-2021-41183

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various Text options are now alway...

UBUNTU-CVE-2021-41182

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now...

Code injection

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now...

UBUNTU-CVE-2021-41183

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various Text options are now alway...

Code injection

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the of option of the .position util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS...

@atlassian/aui (>=8.2.4, <=9.4.1), @chinchilla-software/ng-date-time-picker (>=1.0.0, <=1.0.1) +131 more potentially affected by CVE-2021-41183 via jquery-ui (>=1.10.4, <=1.12.1)

jquery-ui NPM version =1.10.4, =8.2.4, =1.0.0, =1.0.0, =0.1.0, =2.3.2, =6.4.0, =1.1.42, =5.0.0-110, =0.0.0, =2.1.1, =4.0.0, =1.0.0-alpha.0, =1.0.0-alpha.10 and more Source cves: CVE-2021-41183 Source advisory: OSV:GHSA-J7QV-PGF6-HVH4...

@atlassian/aui (>=8.2.4, <=9.4.1), @chinchilla-software/ng-date-time-picker (>=1.0.0, <=1.0.1) +131 more potentially affected by CVE-2021-41183 via jquery-ui (>=1.10.4, <=1.12.1)

jquery-ui NPM version =1.10.4, =8.2.4, =1.0.0, =1.0.0, =0.1.0, =2.3.2, =6.4.0, =1.1.42, =5.0.0-110, =0.0.0, =2.1.1, =4.0.0, =1.0.0-alpha.0, =1.0.0-alpha.10 and more Source cves: CVE-2021-41183 Source advisory: GHSA-J7QV-PGF6-HVH4...

GHSA-J7QV-PGF6-HVH4 XSS in `*Text` options of the Datepicker widget in jquery-ui

Impact Accepting the value of various Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: js $ "datepicker" .datepicker showButtonPanel: true, showOn: "both", closeText: "doEvilThing 'closeText XSS...

XSS in `*Text` options of the Datepicker widget in jquery-ui

Impact Accepting the value of various Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: js $ "datepicker" .datepicker showButtonPanel: true, showOn: "both", closeText: "doEvilThing 'closeText XSS...

org.webjars.npm:evol-colorpicker (3.4.2), org.webjars.npm:jquery-ui-multidatespicker (1.6.6) potentially affected by CVE-2021-41183 via org.webjars.npm:jquery-ui (1.13.0-rc.3)

org.webjars.npm:jquery-ui MAVEN version 1.13.0-rc.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:jquery-ui and may be impacted: - org.webjars.npm:evol-colorpicker 3.4.2 - org.webjars.npm:jquery-ui-multidatespicker 1.6.6 Source cves:...

@atlassian/aui (>=8.2.4, <=9.4.1), @chinchilla-software/ng-date-time-picker (>=1.0.0, <=1.0.1) +131 more potentially affected by CVE-2021-41184 via jquery-ui (>=1.10.4, <=1.12.1)

jquery-ui NPM version =1.10.4, =8.2.4, =1.0.0, =1.0.0, =0.1.0, =2.3.2, =6.4.0, =1.1.42, =5.0.0-110, =0.0.0, =2.1.1, =4.0.0, =1.0.0-alpha.0, =1.0.0-alpha.10 and more Source cves: CVE-2021-41184 Source advisory: GHSA-GPQQ-952Q-5327...

XSS in the `of` option of the `.position()` util in jquery-ui

Impact Accepting the value of the of option of the .position util from untrusted sources may execute untrusted code. For example, invoking the following code: js $ "element" .position my: "left top", at: "right bottom", of: "", collision: "none" ; will call the doEvilThing function. Patches The...

@atlassian/aui (>=8.2.4, <=9.4.1), @chinchilla-software/ng-date-time-picker (>=1.0.0, <=1.0.1) +131 more potentially affected by CVE-2021-41184 via jquery-ui (>=1.10.4, <=1.12.1)

jquery-ui NPM version =1.10.4, =8.2.4, =1.0.0, =1.0.0, =0.1.0, =2.3.2, =6.4.0, =1.1.42, =5.0.0-110, =0.0.0, =2.1.1, =4.0.0, =1.0.0-alpha.0, =1.0.0-alpha.10 and more Source cves: CVE-2021-41184 Source advisory: OSV:GHSA-GPQQ-952Q-5327...

GHSA-GPQQ-952Q-5327 XSS in the `of` option of the `.position()` util in jquery-ui

Impact Accepting the value of the of option of the .position util from untrusted sources may execute untrusted code. For example, invoking the following code: js $ "element" .position my: "left top", at: "right bottom", of: "", collision: "none" ; will call the doEvilThing function. Patches The...

GHSA-9GJ3-HWP5-PMWC XSS in the `altField` option of the Datepicker widget in jquery-ui

Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: js $ "datepicker" .datepicker altField: "", ; will call the doEvilThing function. Patches The issue is fixed...

XSS in the `altField` option of the Datepicker widget in jquery-ui

Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: js $ "datepicker" .datepicker altField: "", ; will call the doEvilThing function. Patches The issue is fixed...

@atlassian/aui (>=8.2.4, <=9.4.1), @chinchilla-software/ng-date-time-picker (>=1.0.0, <=1.0.1) +131 more potentially affected by CVE-2021-41182 via jquery-ui (>=1.10.4, <=1.12.1)

jquery-ui NPM version =1.10.4, =8.2.4, =1.0.0, =1.0.0, =0.1.0, =2.3.2, =6.4.0, =1.1.42, =5.0.0-110, =0.0.0, =2.1.1, =4.0.0, =1.0.0-alpha.0, =1.0.0-alpha.10 and more Source cves: CVE-2021-41182 Source advisory: GHSA-9GJ3-HWP5-PMWC...

@atlassian/aui (>=8.2.4, <=9.4.1), @chinchilla-software/ng-date-time-picker (>=1.0.0, <=1.0.1) +131 more potentially affected by CVE-2021-41182 via jquery-ui (>=1.10.4, <=1.12.1)

jquery-ui NPM version =1.10.4, =8.2.4, =1.0.0, =1.0.0, =0.1.0, =2.3.2, =6.4.0, =1.1.42, =5.0.0-110, =0.0.0, =2.1.1, =4.0.0, =1.0.0-alpha.0, =1.0.0-alpha.10 and more Source cves: CVE-2021-41182 Source advisory: OSV:GHSA-9GJ3-HWP5-PMWC...

CVE-2021-41183: Improper Neutralization of Input During Web Page Generation

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various Text options are now alway...

CVE-2021-41184

CVE-2021-41184 describes an XSS in jQuery-UI before 1.13.0 where untrusted input passed to the of option of the .position() utility could lead to code execution. The connected documents confirm the issue affects jQuery-UI embedded in other software (e.g., OTRS/IU contexts) and state the fix is to...