CVE-2021-41183
26.10.2021, 15:15
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.
| Vendor | Product | Version |
|---|---|---|
| jqueryui | jquery_ui | 𝑥 < 1.13.0 |
| netapp | h300s_firmware | - |
| netapp | h500s_firmware | - |
| netapp | h700s_firmware | - |
| netapp | h300e_firmware | - |
| netapp | h500e_firmware | - |
| netapp | h700e_firmware | - |
| netapp | h410s_firmware | - |
| netapp | h410c_firmware | - |
| debian | debian_linux | 9.0 |
| drupal | drupal | 7.0 ≤ 𝑥 < 7.86 |
| drupal | drupal | 9.2.0 ≤ 𝑥 < 9.2.11 |
| drupal | drupal | 9.3.0 ≤ 𝑥 < 9.3.3 |
| oracle | agile_plm | 9.3.6 |
| oracle | application_express | 𝑥 < 22.1.1 |
| oracle | banking_platform | 2.9.0 |
| oracle | banking_platform | 2.12.0 |
| oracle | big_data_spatial_and_graph | 𝑥 < 23.1 |
| oracle | big_data_spatial_and_graph | 23.1 |
| oracle | communications_interactive_session_recorder | 6.4 |
| oracle | communications_operations_monitor | 4.3 |
| oracle | communications_operations_monitor | 4.4 |
| oracle | communications_operations_monitor | 5.0 |
| oracle | hospitality_inventory_management | 9.1.0 |
| oracle | hospitality_suite8 | 8.11.0 ≤ 𝑥 ≤ 11.14.0 |
| oracle | hospitality_suite8 | 8.10.2 |
| oracle | jd_edwards_enterpriseone_tools | 𝑥 ≤ 9.2.6.3 |
| oracle | mysql_enterprise_monitor | 𝑥 ≤ 8.0.29 |
| oracle | peoplesoft_enterprise_peopletools | 8.58 |
| oracle | peoplesoft_enterprise_peopletools | 8.59 |
| oracle | policy_automation | 12.2.0 ≤ 𝑥 ≤ 12.2.5 |
| oracle | primavera_gateway | 17.7 ≤ 𝑥 ≤ 17.12 |
| oracle | primavera_gateway | 18.8.0 |
| oracle | primavera_gateway | 19.12.0 |
| oracle | primavera_gateway | 20.12.0 |
| oracle | primavera_gateway | 21.12.0 |
| oracle | rest_data_services | 𝑥 < 22.1.1 |
| oracle | rest_data_services | 22.1.1 |
| oracle | weblogic_server | 12.2.1.3.0 |
| oracle | weblogic_server | 12.2.1.4.0 |
| oracle | weblogic_server | 14.1.1.0.0 |
| tenable | tenable.sc | 𝑥 < 5.21.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| jqueryui |
|
References