XSS in the `of` option of the `.position()` util
Priority MEDIUM 57CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 1 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.40768 98th percentileScored 2026-11-07
Fix Partial jquery-ui (jquery): 1.13.0jquery-ui (npm): 1.13.0+3 more productsRed Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| JQuery | jquery-ui | before 1.13.0 | 1.13.0 | Patch available | CNA |
| — | jquery-ui (npm) | before 1.13.0 | 1.13.0 | Patch available | GHSA-gpqq-952q-5327 |
| — | org.webjars.npm:jquery-ui (Maven) | before 1.13.0 | 1.13.0 | Patch available | GHSA-gpqq-952q-5327 |
| — | jQuery.UI.Combined (NuGet) | before 1.13.0 | 1.13.0 | Patch available | GHSA-gpqq-952q-5327 |
| — | jquery-ui-rails (RubyGems) | before 7.0.0 | 7.0.0 | Patch available | GHSA-gpqq-952q-5327 |
- jquery-ui VendorJQuery Affected before 1.13.0 Fixed in 1.13.0 Patch available CNA
- jquery-ui (npm) Vendor— Affected before 1.13.0 Fixed in 1.13.0 Patch available GHSA-gpqq-952q-5327
- org.webjars.npm:jquery-ui (Maven) Vendor— Affected before 1.13.0 Fixed in 1.13.0 Patch available GHSA-gpqq-952q-5327
- jQuery.UI.Combined (NuGet) Vendor— Affected before 1.13.0 Fixed in 1.13.0 Patch available GHSA-gpqq-952q-5327
- jquery-ui-rails (RubyGems) Vendor— Affected before 7.0.0 Fixed in 7.0.0 Patch available GHSA-gpqq-952q-5327
CPE configurations NVD · 51
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jqueryui:jquery_ui:*:*:*:*:*:jquery:*:* | before 1.13.0 | Vulnerable | Jqueryui |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:jqueryui:jquery_ui:*:*:*:*:*:jquery:*:* Versions before 1.13.0 Vulnerable ·Jqueryui
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 41 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* | 7.0 to before 7.86; 9.2.0 to before 9.2.11; 9.3.0 to before 9.3.3 | Vulnerable | Drupal |
| cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* | before 5.21.0 | Vulnerable | Tenable |
| cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* | 9.3.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* | before 22.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* | 2.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:* | 2.12.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:big_data_spatial_and_graph:*:*:*:*:*:*:*:* | before 23.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:big_data_spatial_and_graph:23.1:*:*:*:*:*:*:* | 23.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:* | 6.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:* | 4.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_operations_monitor:4.4:*:*:*:*:*:*:* | 4.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_operations_monitor:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hospitality_inventory_management:9.1.0:*:*:*:*:*:*:* | 9.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* | 18.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hospitality_suite8:*:*:*:*:*:*:*:* | 8.11.0 – 8.14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hospitality_suite8:8.10.2:*:*:*:*:*:*:* | 8.10.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* | up to 9.2.6.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | 8.58 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* | 8.59 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* | 12.2.0 – 12.2.25 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* | 17.7 – 17.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* | 18.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* | 19.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* | 20.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:* | 21.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:* | before 22.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rest_data_services:22.1.1:*:*:*:-:*:*:* | 22.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* | 14.1.1.0.0 | Vulnerable | Oracle |
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 7.0 to before 7.86; 9.2.0 to before 9.2.11; 9.3.0 to before 9.3.3 Vulnerable ·Drupal
- cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* Versions before 5.21.0 Vulnerable ·Tenable
- cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* Versions before 22.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* Versions 2.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:big_data_spatial_and_graph:*:*:*:*:*:*:*:* Versions before 23.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:big_data_spatial_and_graph:23.1:*:*:*:*:*:*:* Versions 23.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_operations_monitor:4.4:*:*:*:*:*:*:* Versions 4.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_operations_monitor:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hospitality_inventory_management:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:* Versions 18.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hospitality_suite8:*:*:*:*:*:*:*:* Versions 8.11.0 – 8.14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hospitality_suite8:8.10.2:*:*:*:*:*:*:* Versions 8.10.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions up to 9.2.6.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
- cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* Versions 12.2.0 – 12.2.25 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:* Versions 21.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:* Versions before 22.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rest_data_services:22.1.1:*:*:*:-:*:*:* Versions 22.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle
Remediation
- Fix · CNA jquery-ui (jquery) Fixed in 1.13.0
- Fix · GHSA-gpqq-952q-5327 jquery-ui (npm) Fixed in 1.13.0 Advisory →
- Fix · GHSA-gpqq-952q-5327 org.webjars.npm:jquery-ui (Maven) Fixed in 1.13.0 Advisory →
- Fix · GHSA-gpqq-952q-5327 jQuery.UI.Combined (NuGet) Fixed in 1.13.0 Advisory →
- Fix · GHSA-gpqq-952q-5327 jquery-ui-rails (RubyGems) Fixed in 7.0.0 Advisory →
Red Hat 1 advisory
- RHSA-2022:4711 Released 2022-05-26 · Red Hat rating ModerateRHV Manager (ovirt-engine) [ovirt-4.5.0] security update
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-4.5.0.7-0.9.el8ev, ovirt-engine-backend-4.5.0.7-0.9.el8ev, ovirt-engine-dbscripts-4.5.0.7-0.9.el8ev +19
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
jquery-ui — FEDORA-2021-013ab302be
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2021-18021 XSS in the `altField` option of the Datepicker widgetPriority MEDIUM 56
- TI-2021-18022 XSS in `*Text` options of the Datepicker widgetPriority MEDIUM 40
- Advisory ·
jquery-ui — FEDORA-2021-51c256bf87
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2021-18021 XSS in the `altField` option of the Datepicker widgetPriority MEDIUM 56
- TI-2021-18022 XSS in `*Text` options of the Datepicker widgetPriority MEDIUM 40
Show 1 more group
- Advisory ·
jquery-ui — FEDORA-2021-ab38307fc3
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2021-18021 XSS in the `altField` option of the Datepicker widgetPriority MEDIUM 56
- TI-2021-18022 XSS in `*Text` options of the Datepicker widgetPriority MEDIUM 40
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 | Fixed | RHSA-2022:4711 |
Not affected: 5 products
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
- Red Hat Ansible Tower 3
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41184
- 2026-10-03 Alias added: GHSA-gpqq-952q-5327
- 2026-11-02 CISA SSVC decision points changed
References
Patch 4
Advisory 10
- https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/
- FEDORA-2021-51c256bf87
- FEDORA-2021-ab38307fc3
- FEDORA-2021-013ab302be
- https://security.netapp.com/advisory/ntap-20211118-0004/
- https://www.drupal.org/sa-core-2022-001
- https://www.oracle.com/security-alerts/cpujul2022.html
- FEDORA-2022-9d655503ea
- FEDORA-2022-bf18450366
- https://nvd.nist.gov/vuln/detail/CVE-2021-41184
Other 15
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
- https://security.netapp.com/advisory/ntap-20211118-0004
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4
- https://lists.fedoraproject.org/archives/list/[email protected]/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3
- https://github.com/jquery/jquery-ui
- https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released
- http://seclists.org/fulldisclosure/2024/Aug/37
More JQuery vulnerabilities
- TI-2020-08897 Potential XSS vulnerability in jQuery KEVCVSS 3.1MEDIUM 6.9
- TI-2020-08896 jQuery has a potential XSS vulnerability CVSS 3.1MEDIUM 6.9
- TI-2019-08480 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles… CVSS 3.1MEDIUM 6.1
- TI-2022-13203 jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label CVSS 3.1MEDIUM 6.1
- TI-2021-18021 XSS in the `altField` option of the Datepicker widget CVSS 3.1MEDIUM 6.5
- TI-2015-07630 jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a… CVSS 3.0MEDIUM 6.1
Sources
- CVE-2021-41184 · CVE Program
- CVE-2021-41184 · NVD
- FIRST EPSS
- GHSA-gpqq-952q-5327 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-41184 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences