Published: 26/10/2021 Updated: 31/08/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8

VMScore: 384

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

Vulnerable Product	Search on Vulmon	Subscribe to Product
jqueryui jquery ui
fedoraproject fedora 33
fedoraproject fedora 34
fedoraproject fedora 35
fedoraproject fedora 36
netapp h300s_firmware -
netapp h500s_firmware -
netapp h700s_firmware -
netapp h300e_firmware -
netapp h500e_firmware -
netapp h700e_firmware -
netapp h410s_firmware -
netapp h410c_firmware -
drupal drupal
tenable tenable.sc
oracle hospitality suite8 8.10.2
oracle weblogic server 12.2.1.3.0
oracle primavera unifier 18.8
oracle primavera unifier
oracle hospitality materials control 18.1
oracle agile plm 9.3.6
oracle weblogic server 12.2.1.4.0
oracle peoplesoft enterprise peopletools 8.58
oracle primavera unifier 19.12
oracle weblogic server 14.1.1.0.0
oracle banking platform 2.9.0
oracle primavera unifier 20.12
oracle hospitality inventory management 9.1.0
oracle communications interactive session recorder 6.4
oracle peoplesoft enterprise peopletools 8.59
oracle communications operations monitor 4.3
oracle banking platform 2.12.0
oracle communications operations monitor 4.4
oracle communications operations monitor 5.0
oracle primavera unifier 21.12
oracle big data spatial and graph 23.1
oracle big data spatial and graph
oracle hospitality suite8
oracle jd edwards enterpriseone tools
oracle rest data services
oracle application express
oracle rest data services 22.1.1
oracle policy automation

Synopsis Moderate: RHV Manager (ovirt-engine) [ovirt-450] security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Updated ovirt-engine packages that fix several bugs and add various enhancements are now available ...

jQuery-UI is the official jQuery user interface library Prior to version 1130, accepting the value of the `of` option of the `position()` util from untrusted sources may execute untrusted code The issue is fixed in jQuery UI 1130 Any string value passed to the `of` option is now treated as a CSS selector A workaround is to not accept the v ...

Tenablesc leverages third-party software to help provide underlying functionality Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers Out of caution, and in line with best practice, Tenable has upgraded the bundled components to address the potential impact ...

Exploit-Medium-CVE-2021-41184 Exploit Medium CVE-2021-41184 XSS in the of option of the position() util jQuery ui version v1121 vulnerable 11 wwwwebsitecom/_js/jquery/jquery-ui-1121/jquery-uiminjs ------------------------------------------------Concept proof--------------------------------------------------------------- Open url Open inspect Look for s

CWE-79 https://github.com/jquery/jquery-ui/commit/effa323f1505f2ce7a324e4f429fa9032c72f280 https://github.com/jquery/jquery-ui/security/advisories/GHSA-gpqq-952q-5327 https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/https://security.netapp.com/advisory/ntap-20211118-0004/https://www.drupal.org/sa-core-2022-001 https://www.oracle.com/security-alerts/cpuapr2022.html https://www.tenable.com/security/tns-2022-09 https://www.oracle.com/security-alerts/cpujul2022.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html https://access.redhat.com/errata/RHSA-2022:4711 https://nvd.nist.gov https://www.tenable.com/security/tns-2022-09

CVE-2021-41184

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect