jQuery: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Summary

Product

Vulnerabilities 3

• Medium 6.5
  CVE-2021-41182 Public exploit EPSS 39%

  XSS in the `altField` option of the Datepicker widget

  jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value…

  jquery jquery-ui drupal7 jQuery.UI.Combined Debian Ubuntu Alpine npm Maven NuGet RubyGems
  Oct 26, 2021
• Medium 6.5
  CVE-2021-41183

  XSS in `*Text` options of the Datepicker widget

  jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values pas…

  jquery jquery-ui drupal7 jQuery.UI.Combined Debian Ubuntu Alpine npm Maven NuGet RubyGems
  Oct 26, 2021
• Medium 6.5
  CVE-2021-41184 Public exploit EPSS 41%

  XSS in the `of` option of the `.position()` util

  jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value pass…

  jquery jquery-ui jQuery.UI.Combined org.webjars.npm:jquery-ui Debian Ubuntu npm Maven NuGet RubyGems
  Oct 26, 2021

Revision history

1. 2023-10-05 #11

   Neue Updates von Ubuntu aufgenommen

2. 2023-10-04 #10

   Neue Updates von HP aufgenommen

3. 2022-12-07 #9

   Neue Updates von Debian aufgenommen

4. 2022-10-26 #8

   Referenz(en) aufgenommen: FEDORA-2022-BF18450366

5. 2022-10-16 #7

   Referenz(en) aufgenommen: FEDORA-2022-9D655503EA, FEDORA-2022-C4334D5277

6. 2022-05-26 #6

   Neue Updates von Tenable und Red Hat aufgenommen

7. 2022-05-18 #5

   Neue Updates von SUSE aufgenommen

8. 2022-05-09 #4

   Neue Updates von Tenable aufgenommen

9. 2022-04-07 #3

   Neue Updates von HCL aufgenommen

10. 2022-01-19 #2

    Neue Updates von Drupal und Debian aufgenommen

11. 2021-11-01 #1

    Initiale Fassung

References

• Ubuntu Security Notice USN-6419-1 vom 2023-10-05
  https://ubuntu.com/security/notices/USN-6419-1
• HP Security Bulletin HPSBPI03869 vom 2023-10-04
  https://support.hp.com/us-en/document/ish_9365285-9365309-16/HPSBPI03869
• Red Hat Bugzilla vom 2021-11-01
  https://bugzilla.redhat.com/show_bug.cgi?id=2019144
• Red Hat Bugzilla vom 2021-11-01
  https://bugzilla.redhat.com/show_bug.cgi?id=2019148
• Red Hat Bugzilla vom 2021-11-01
  https://bugzilla.redhat.com/show_bug.cgi?id=2019153
• Drupal Security Advisory SA-CONTRIB-2022-004 vom 2022-01-19
  https://www.drupal.org/sa-contrib-2022-004
• Debian Security Advisory DLA-2889 vom 2022-01-19
  https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html
• Drupal Security Advisory SA-CORE-2022-011 vom 2022-01-19
  https://www.drupal.org/sa-core-2022-011
• Drupal Security Advisory SA-CORE-2022-002 vom 2022-01-19
  https://www.drupal.org/sa-core-2022-002
• Drupal Security Advisory
  https://www.drupal.org/sa-core-2022-001
• SUSE Security Update SUSE-SU-2022:1729-1 vom 2022-05-18
  https://lists.suse.com/pipermail/sle-security-updates/2022-May/011075.html
• Tenable Security Advisory
  https://www.tenable.com/security/tns-2022-12
• Red Hat Security Advisory RHSA-2022:4711 vom 2022-05-26
  https://access.redhat.com/errata/RHSA-2022:4711
• Tenable Security Advisory
  https://www.tenable.com/security/tns-2022-11
• HCL Article KB0097697 vom 2022-04-07
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097697
• Tenable Security Advisory TNS-2022-10 vom 2022-05-10
  http://www.auscert.org.au/bulletins/ESB-2022.2191
• Tenable Security Advisory TNS-2022-10 vom 2022-05-10 vom 2022-05-09
  https://www.tenable.com/security/tns-2022-10
• Debian Security Advisory DLA-3230 vom 2022-12-07
  https://lists.debian.org/debian-lts-announce/2022/12/msg00015.html