PT-2014-2103 · Jquery+2 · Jquery Ui+2

Jzaefferer · Published 2014-11-24 · Updated 2025-06-17 · CVE-2010-5312

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jqueryui versions prior to 1.10.0 jqueryui version 1.8.ooops.21+dfsg-2+deb7u2 jqueryui version 1.10.1+dfsg-1

Description A cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option. This would allow a remote attacker to inject arbitrary code through cross-site scripting.

Recommendations For versions prior to 1.10.0, upgrade to version 1.10.0 or later. For version 1.8.ooops.21+dfsg-2+deb7u2, this version has already fixed the issue. For version 1.10.1+dfsg-1, this version has already fixed the issue. As a temporary workaround, consider disabling the use of the title option in the Dialog widget until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CESA-2015_0442

CESA-2015_1462

CVE-2010-5312

DLA-258-1

DLA-2889-1

DSA-3249-1

DSA-3249-2

GHSA-WCM2-9C89-WMFM

MGASA-2014-0559

RHSA-2015:0442

RHSA-2015:1462

RHSA-2015_0442

RHSA-2015_1462

Affected Products

Centos

Red Hat

Jquery Ui

References · 50

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ui-rails/CVE-2010-5312.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ui-rails/CVE-2012-6662.yml · Exploit
• 🔥 http://bugs.jqueryui.com/ticket/6016 · Exploit
• https://github.com/jquery/jquery-ui/commit/7e9060c109b928769a664dbcc2c17bd21231b6f3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-5312 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2010-5312 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-1462.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0442.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-5312 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2889-1 · Vendor Advisory
• http://debian.org/security/2015/dsa-3249 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3249-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wcm2-9c89-wmfm · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3249-2 · Vendor Advisory