CVE-2021-41184 — XSS in the `of` option of the `.position()` util

Affected: jquery-ui

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

USN-5181-1 — jqueryui vulnerability

Affected: Ubuntu:Pro:18.04:LTS: jqueryui, Ubuntu:Pro:20.04:LTS: jqueryui, Ubuntu:Pro:22.04:LTS: jqueryui

It was discovered that jQuery UI did not properly validate the values from untrusted sources. An attacker could use this vulnerability to cause a crash or possibly execute arbitrary code. This issue affected only Ubuntu 18.04 ESM and Ubuntu 20.4 ESM. (CVE-2021-41184)

It was discovered that jQuery UI checkboxradio widget did not properly decode certain values from HTML entities. An attacker could possibly use this issue to generate a cross-site scripting(XSS) attack, resulting in a crash or possibly execute arbitrary code. (CVE-2022-31160)

Most recent entries from all

CVE-2021-41184 — XSS in the `of` option of the `.position()` util

USN-5181-1 — jqueryui vulnerability