PT-2014-2103 · Jquery+2 · Jquery Ui+2

Jzaefferer · Publicado 2014-11-24 · Atualizado 2025-06-17 · CVE-2010-5312

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jqueryui versions prior to 1.10.0 jqueryui version 1.8.ooops.21+dfsg-2+deb7u2 jqueryui version 1.10.1+dfsg-1

Description A cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option. This would allow a remote attacker to inject arbitrary code through cross-site scripting.

Recommendations For versions prior to 1.10.0, upgrade to version 1.10.0 or later. For version 1.8.ooops.21+dfsg-2+deb7u2, this version has already fixed the issue. For version 1.10.1+dfsg-1, this version has already fixed the issue. As a temporary workaround, consider disabling the use of the title option in the Dialog widget until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CESA-2015_0442

CESA-2015_1462

CVE-2010-5312

DLA-258-1

DLA-2889-1

DSA-3249-1

DSA-3249-2

GHSA-WCM2-9C89-WMFM

MGASA-2014-0559

RHSA-2015:0442

RHSA-2015:1462

RHSA-2015_0442

RHSA-2015_1462

Produtos afetados

Centos

Red Hat

Jquery Ui

Referências · 50

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ui-rails/CVE-2010-5312.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ui-rails/CVE-2012-6662.yml · Exploit
• 🔥 http://bugs.jqueryui.com/ticket/6016 · Exploit
• https://github.com/jquery/jquery-ui/commit/7e9060c109b928769a664dbcc2c17bd21231b6f3 · Aviso do Fabricante
• https://github.com/jquery/jquery-ui · Nota
• https://osv.dev/vulnerability/CVE-2010-5312 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20190416-0007 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2010-5312 · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2015-1462.html · Aviso do Fabricante
• https://t.me/cvenotify/52811 · Publicação no Telegram
• http://securityfocus.com/bid/71106 · Nota
• http://rhn.redhat.com/errata/RHSA-2015-0442.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-5312 · Nota de Segurança
• https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E · Nota
• http://seclists.org/oss-sec/2014/q4/613 · Nota