IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
6.5Media

CVE-2021-41184XSS in the `of` option of the `.position()` util

jquery jquery-ui Publicada: (hace 5 años)

Descripción

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

Debilidad (CWE): CWE-79

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
drupal drupal 7.0 – < 7.86
fedoraproject fedora 33
jquery jquery-ui < 1.13.0
jqueryui jquery ui < 1.13.0
netapp h300e firmware —
netapp h300s firmware —
netapp h410c firmware —
netapp h410s firmware —
netapp h500e firmware —
netapp h500s firmware —
netapp h700e firmware —
netapp h700s firmware —
oracle agile product lifecycle management 9.3.6
oracle application express < 22.1.1
oracle banking platform 2.9.0
oracle big data spatial and graph < 23.1
oracle communications interactive session recorder 6.4
oracle communications operations monitor 4.3
oracle hospitality inventory management 9.1.0
oracle hospitality materials control 18.1
oracle hospitality suite8 8.11.0 – ≤ 8.14.0
oracle jd edwards enterpriseone tools ≤ 9.2.6.3
oracle peoplesoft enterprise peopletools 8.58
oracle policy automation 12.2.0 – ≤ 12.2.25
oracle primavera unifier 17.7 – ≤ 17.12
oracle rest data services < 22.1.1
oracle weblogic server 12.2.1.3.0
tenable tenable.sc < 5.21.0

Referencias y parches

Coincidencias CPE (NVD) (45)
  • cpe:2.3:a:jqueryui:jquery_ui:*:*:*:*:*:jquery:*:* < 1.13.0
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 7.0 < 7.86
  • cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 9.2.0 < 9.2.11
  • cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 9.3.0 < 9.3.3
  • cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* < 5.21.0
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* < 22.1.1
  • cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:big_data_spatial_and_graph:*:*:*:*:*:*:*:* < 23.1
  • cpe:2.3:a:oracle:big_data_spatial_and_graph:23.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_operations_monitor:4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_operations_monitor:5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:hospitality_inventory_management:9.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:hospitality_suite8:*:*:*:*:*:*:*:* ≥ 8.11.0 ≤ 8.14.0
  • cpe:2.3:a:oracle:hospitality_suite8:8.10.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* ≤ 9.2.6.3
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* ≥ 12.2.0 ≤ 12.2.25
  • cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* ≥ 17.7 ≤ 17.12
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:* < 22.1.1
  • cpe:2.3:a:oracle:rest_data_services:22.1.1:*:*:*:-:*:*:*
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*

CVE recientes del mismo producto — Drupal