Description

Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

Remediation

References

http://bugs.jqueryui.com/ticket/8859

http://bugs.jqueryui.com/ticket/8861

http://rhn.redhat.com/errata/RHSA-2015-0442.html

http://rhn.redhat.com/errata/RHSA-2015-1462.html

http://seclists.org/oss-sec/2014/q4/613

http://seclists.org/oss-sec/2014/q4/616

http://www.securityfocus.com/bid/71107

https://exchange.xforce.ibmcloud.com/vulnerabilities/98697

https://github.com/jquery/jquery/issues/2432

https://github.com/jquery/jquery-ui/commit/5fee6fd5000072ff32f2d65b6451f39af9e0e39e

https://github.com/jquery/jquery-ui/commit/f2854408cce7e4b7fc6bf8676761904af9c96bde

Related Vulnerabilities

CVE-2022-21680 Vulnerability in npm package marked

CVE-2022-22969 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth-parent

CVE-2023-26136 Vulnerability in maven package org.webjars.npm:tough-cookie

CVE-2022-41244 Vulnerability in maven package org.jenkins-ci.plugins:view26

CVE-2023-43496 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

Severity

Critical

Classification

CWE-79

Tags

Issue Tracking Vendor Advisory Third Party Advisory VDB Entry Patch