CVE-2010-5312

MEDIUM

jQuery UI <1.10.0 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.

References (19)

[Exploit, Vendor Advisory] http://bugs.jqueryui.com/ticket/6016

[Third Party Advisory] http://rhn.redhat.com/errata/RHSA-2015-0442.html

[Third Party Advisory] http://rhn.redhat.com/errata/RHSA-2015-1462.html

[Mailing List, Third Party Advisory] http://seclists.org/oss-sec/2014/q4/613

[Mailing List, Third Party Advisory] http://seclists.org/oss-sec/2014/q4/616

[Third Party Advisory] http://www.debian.org/security/2015/dsa-3249

[Patch, Third Party Advisory] http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

[Broken Link, Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/71106

[Broken Link, Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1037035

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/98696

[Vendor Advisory] https://github.com/jquery/jquery-ui/commit/7e9060c109b928769a664dbcc2c17bd21231b6f3

[Mailing List, Third Party Advisory] https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

[Mailing List, Third Party Advisory] https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

[Mailing List, Third Party Advisory] https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/

[Third Party Advisory] https://security.netapp.com/advisory/ntap-20190416-0007/

[Third Party Advisory] https://www.drupal.org/sa-core-2022-002

Scores

CVSS v3 6.1

EPSS 0.0520

EPSS Percentile 89.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-79

Status draft

Affected Products (12)

debian/debian_linux

jqueryui/jquery_ui < 1.10.0

fedoraproject/fedora

netapp/snapcenter

apache/drill

drupal/drupal < 7.86

debian/debian_linux

npm/jquery-ui < 1.10.0npm

org.webjars.npm/jquery-ui < 1.10.0Maven

nuget/jQuery.UI.Combined < 1.10.0NuGet

rubygems/jquery-ui-rails < 4.0.0RubyGems

Timeline

Published Nov 24, 2014

Tracked Since Feb 18, 2026