GitHub Advisoryadvisory · npm, Maven, NuGet, RubyGems

GHSA-wcm2-9c89-wmfm Cross-site Scripting in jquery-ui

MEDIUM Published 2017-10-24 Modified 2025-04-14 Official page ↗
Aliases
CVE-2010-5312
Ecosystem
npm, Maven, NuGet, RubyGems
Packages
jquery-ui, org.webjars.npm:jquery-ui, jQuery.UI.Combined, jquery-ui-rails
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• npm jquery-ui: >= 1.7.0, < 1.10.0 → fixed in 1.10.0 • Maven org.webjars.npm:jquery-ui: >= 1.7.0, < 1.10.0 → fixed in 1.10.0 • NuGet jQuery.UI.Combined: >= 1.7.0, < 1.10.0 → fixed in 1.10.0 • RubyGems jquery-ui-rails: < 4.0.0 → fixed in 4.0.0

Description

Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.

Related

Alias · CVE (1)

  • CVE-2010-5312 Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References