Orta CVSS 6.1

CVE-2021-41184: Jquery Ui: siteler arası betik çalıştırma (XSS)

Yayın: 26 Ekim 2021 18:15 · Güncelleme: 6 Kasım 2026 09:46

Açıklama (NVD)

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

Özet bilgiler

Ürün: Jqueryui Jquery Ui
CVSS v3.1: 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: %40,77 (yüzdelik 99)
CWE: CWE-79
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
jqueryui-jquery-ui	—	—	1.13.0
fedoraproject-fedora	33	33	—
fedoraproject-fedora	34	34	—
fedoraproject-fedora	35	35	—
fedoraproject-fedora	36	36	—
netapp-h300s-firmware	—	—	—
netapp-h500s-firmware	—	—	—
netapp-h700s-firmware	—	—	—
netapp-h300e-firmware	—	—	—
netapp-h500e-firmware	—	—	—
netapp-h700e-firmware	—	—	—
netapp-h410s-firmware	—	—	—
netapp-h410c-firmware	—	—	—
drupal-drupal	7.0	—	7.86
drupal-drupal	9.2.0	—	9.2.11
drupal-drupal	9.3.0	—	9.3.3
tenable-tenable.sc	—	—	5.21.0
oracle-agile-product-lifecycle-management	9.3.6	9.3.6	—
oracle-application-express	—	—	22.1.1
oracle-banking-platform	2.9.0	2.9.0	—
oracle-banking-platform	2.12.0	2.12.0	—
oracle-big-data-spatial-and-graph	—	—	23.1
oracle-big-data-spatial-and-graph	23.1	23.1	—
oracle-communications-interactive-session-recorder	6.4	6.4	—
oracle-communications-operations-monitor	4.3	4.3	—
oracle-communications-operations-monitor	4.4	4.4	—
oracle-communications-operations-monitor	5.0	5.0	—
oracle-hospitality-inventory-management	9.1.0	9.1.0	—
oracle-hospitality-materials-control	18.1	18.1	—
oracle-hospitality-suite8	8.11.0	8.14.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları