Most recent entries from all

BIT-drupal-2021-41183 — XSS in `*Text` options of the Datepicker widget

Affected: Bitnami: drupal

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.

certfr-2022-avi-058 — De multiples vulnérabilités ont été découvertes dans Drupal core. Elles permettent à un attaquant de provoquer une inje…

certfr-2022-avi-058

CLEANSTART-2024-ND69835 — jQuery-UI is the official jQuery user interface library

Affected: CleanStart: drupal7

Security vulnerability affects the drupal7 package. jQuery-UI is the official jQuery user interface library.

EUVD-2026-215980

fkie_cve-2021-41183

GHSA-j7qv-pgf6-hvh4 — XSS in `*Text` options of the Datepicker widget in jquery-ui

Affected: npm: jquery-ui, Maven: org.webjars.npm:jquery-ui, RubyGems: jquery-ui-rails, NuGet: jQuery.UI.Combined

### Impact Accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: ```js $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); ``` will call `doEvilThing` with 6 different parameters coming from all `*Text` options.

### Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML.

### Workarounds A workaround is to not accept the value of the `*Text` options from untrusted sources.

### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.

gsd-2021-41183

OESA-2022-1693 — python-XStatic-jquery-ui security update

Affected: openEuler:20.03-LTS-SP3: python-XStatic-jquery-ui

jquery-ui javascript library packaged for setuptools (easy_install) / pip. This package is intended to be used by **any** project that needs these files. It intentionally does **not** provide any extra code except some metadata **nor** has any extra requirements. You MAY use some minimal support code from the XStatic base package, if you like. You can find more info about the xstatic packaging way in the package `XStatic`. Security Fix(es): jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.(CVE-2021-41183)

RHSA-2022:4711 — Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.0] security update

nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes nodejs-trim-off-newlines: ReDoS via string processing nodejs-normalize-url: ReDoS for data URLs jquery-ui: XSS in the altField option of the datepicker widget jquery-ui: XSS in *Text options of the datepicker widget jquery-ui: XSS in the 'of' option of the .position() util

UBUNTU-CVE-2021-41183

Affected: Ubuntu:Pro:14.04:LTS: jqueryui, Ubuntu:Pro:16.04:LTS: jqueryui, Ubuntu:Pro:18.04:LTS: jqueryui, Ubuntu:20.04:LTS: jqueryui

VDE-2022-019 — Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components

For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.

WID-SEC-W-2022-1729 — jQuery: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in jQuery ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.