drupal7 - security update

Fixed packages 1

Vulnerabilities 4

• Medium 6.5
  CVE-2021-41182 Public exploit EPSS 39%

  XSS in the `altField` option of the Datepicker widget

  jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value…

  jquery jquery-ui drupal7 jQuery.UI.Combined Debian Ubuntu Alpine npm Maven NuGet RubyGems
  Oct 26, 2021
• Medium 6.5
  CVE-2021-41183

  XSS in `*Text` options of the Datepicker widget

  jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values pas…

  jquery jquery-ui drupal7 jQuery.UI.Combined Debian Ubuntu Alpine npm Maven NuGet RubyGems
  Oct 26, 2021
• Medium 6.1
  CVE-2010-5312 EPSS 18%

  Cross-site Scripting in jquery-ui

  Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.

  drupal7 org.webjars.npm:jquery-ui jqueryui jquery-ui Debian Alpine npm Maven NuGet RubyGems
  Nov 24, 2014
• Medium 6.1
  CVE-2016-7103 EPSS 29%

  jQuery-UI vulnerable to Cross-site Scripting in dialog closeText

  Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.

  drupal7 jqueryui jquery-ui jquery-ui-rails Debian Ubuntu Alpine npm Maven NuGet RubyGems
  Mar 15, 2017