CVE-2021-41184Medium· 6.5▾ TwilightPoC availablejQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0.…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 8.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
41%
1 GitHub repo
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. A workaround is to not accept the value of the of option from untrusted sources.
jquery_ui < 1.13.0fedora = 33fedora = 34fedora = 35fedora = 36h300s_firmwareh500s_firmwareh700s_firmwareh300e_firmwareh500e_firmwareh700e_firmwareh410s_firmwareh410c_firmwaredrupal >= 7.0, < 7.86drupal >= 9.2.0, < 9.2.11drupal >= 9.3.0, < 9.3.3tenable.sc < 5.21.0agile_product_lifecycle_management = 9.3.6application_express < 22.1.1banking_platform = 2.9.0banking_platform = 2.12.0big_data_spatial_and_graph < 23.1big_data_spatial_and_graph = 23.1communications_interactive_session_recorder = 6.4communications_operations_monitor = 4.3communications_operations_monitor = 4.4communications_operations_monitor = 5.0hospitality_inventory_management = 9.1.0hospitality_materials_control = 18.1hospitality_suite8 >= 8.11.0, <= 8.14.0hospitality_suite8 = 8.10.2jd_edwards_enterpriseone_tools <= 9.2.6.3peoplesoft_enterprise_peopletools = 8.58peoplesoft_enterprise_peopletools = 8.59policy_automation >= 12.2.0, <= 12.2.25primavera_unifier >= 17.7, <= 17.12primavera_unifier = 18.8primavera_unifier = 19.12primavera_unifier = 20.12primavera_unifier = 21.12rest_data_services < 22.1.1rest_data_services = 22.1.1weblogic_server = 12.2.1.3.0weblogic_server = 12.2.1.4.0weblogic_server = 14.1.1.0.0Upgrade past the affected range:
jquery_ui 1.13.0drupal 9.3.3tenable.sc 5.21.0application_express 22.1.1big_data_spatial_and_graph 23.1rest_data_services 22.1.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2021-41182Medium· 6.5jQuery-UI is the official jQuery user interface library
CVE-2021-41183Medium· 6.5jQuery-UI is the official jQuery user interface library
CVE-2021-41164High· 8.2CKEditor4 is an open source WYSIWYG HTML editor
CVE-2020-5398High· 7.5In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in…
CVE-2020-3580Medium· 6.1Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting …
CVE-2019-1973Medium· 4.8A vulnerability in the web portal framework of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface