Vulnerability-Lookup

ubuntu-cve-2021-41183

Vulnerability from osv_ubuntu

Published

2021-10-26 15:15

Modified

2026-03-13 15:05

Summary

Details

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. A workaround is to not accept the value of the *Text options from untrusted sources.

Severity

6.1 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2021-41183	REPORT
	https://github.com/jquery/jquery-ui/security/advi…	REPORT
	https://bugs.jqueryui.com/ticket/15284	REPORT
	https://github.com/jquery/jquery-ui/pull/1953	REPORT
	https://blog.jqueryui.com/2021/10/jquery-ui-1-13-…	REPORT
	https://ubuntu.com/security/notices/USN-6419-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2021-41183	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libjs-jquery-ui",
            "binary_version": "1.10.1+dfsg-1ubuntu0.14.04.1~esm1"
          },
          {
            "binary_name": "libjs-jquery-ui-docs",
            "binary_version": "1.10.1+dfsg-1ubuntu0.14.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "jqueryui",
        "purl": "pkg:deb/ubuntu/jqueryui@1.10.1+dfsg-1ubuntu0.14.04.1~esm1?arch=source\u0026distro=trusty/esm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.1+dfsg-1ubuntu0.14.04.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.1+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libjs-jquery-ui",
            "binary_version": "1.10.1+dfsg-1ubuntu0.16.04.1~esm1"
          },
          {
            "binary_name": "libjs-jquery-ui-docs",
            "binary_version": "1.10.1+dfsg-1ubuntu0.16.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "jqueryui",
        "purl": "pkg:deb/ubuntu/jqueryui@1.10.1+dfsg-1ubuntu0.16.04.1~esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.1+dfsg-1ubuntu0.16.04.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.1+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libjs-jquery-ui",
            "binary_version": "1.12.1+dfsg-5ubuntu0.18.04.1~esm3"
          },
          {
            "binary_name": "libjs-jquery-ui-docs",
            "binary_version": "1.12.1+dfsg-5ubuntu0.18.04.1~esm3"
          },
          {
            "binary_name": "node-jquery-ui",
            "binary_version": "1.12.1+dfsg-5ubuntu0.18.04.1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "jqueryui",
        "purl": "pkg:deb/ubuntu/jqueryui@1.12.1+dfsg-5ubuntu0.18.04.1~esm3?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.12.1+dfsg-5ubuntu0.18.04.1~esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.12.1+dfsg-5",
        "1.12.1+dfsg-5ubuntu0.18.04.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjs-jquery-ui",
            "binary_version": "1.12.1+dfsg-5ubuntu0.20.04.1"
          },
          {
            "binary_name": "libjs-jquery-ui-docs",
            "binary_version": "1.12.1+dfsg-5ubuntu0.20.04.1"
          },
          {
            "binary_name": "node-jquery-ui",
            "binary_version": "1.12.1+dfsg-5ubuntu0.20.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "jqueryui",
        "purl": "pkg:deb/ubuntu/jqueryui@1.12.1+dfsg-5ubuntu0.20.04.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.12.1+dfsg-5ubuntu0.20.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.12.1+dfsg-5"
      ]
    }
  ],
  "aliases": [],
  "details": "jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.",
  "id": "UBUNTU-CVE-2021-41183",
  "modified": "2026-03-13T15:05:04Z",
  "published": "2021-10-26T15:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-41183"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.jqueryui.com/ticket/15284"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/jquery/jquery-ui/pull/1953"
    },
    {
      "type": "REPORT",
      "url": "https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6419-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41183"
    }
  ],
  "related": [
    "USN-6419-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2021-41183"
  ]
}

CVE-2021-41183 (GCVE-0-2021-41183)

Vulnerability from cvelistv5 – Published: 2021-10-26 00:00 – Updated: 2025-02-13 16:28

Title

XSS in `*Text` options of the Datepicker widget

Summary

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

18 references

URL	Tags
https://blog.jqueryui.com/2021/10/jquery-ui-1-13-…
https://github.com/jquery/jquery-ui/security/advi…
https://github.com/jquery/jquery-ui/pull/1953
https://bugs.jqueryui.com/ticket/15284
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2022…	mailing-list
https://www.drupal.org/sa-core-2022-002
https://www.oracle.com/security-alerts/cpuapr2022.html
https://security.netapp.com/advisory/ntap-2021111…
https://www.drupal.org/sa-contrib-2022-004
https://www.drupal.org/sa-core-2022-001
https://www.oracle.com/security-alerts/cpujul2022.html
https://www.tenable.com/security/tns-2022-09
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…

Impacted products

1 product

Vendor	Product	Version
jquery	jquery-ui	Affected: < 1.13.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:08:31.304Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/jquery/jquery-ui/pull/1953"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.jqueryui.com/ticket/15284"
          },
          {
            "name": "FEDORA-2021-51c256bf87",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/"
          },
          {
            "name": "FEDORA-2021-ab38307fc3",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/"
          },
          {
            "name": "FEDORA-2021-013ab302be",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/"
          },
          {
            "name": "[debian-lts-announce] 20220119 [SECURITY] [DLA-2889-1] drupal7 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.drupal.org/sa-core-2022-002"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211118-0004/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.drupal.org/sa-contrib-2022-004"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.drupal.org/sa-core-2022-001"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2022-09"
          },
          {
            "name": "FEDORA-2022-9d655503ea",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/"
          },
          {
            "name": "FEDORA-2022-bf18450366",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jquery-ui",
          "vendor": "jquery",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-31T02:06:53.562Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/"
        },
        {
          "url": "https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4"
        },
        {
          "url": "https://github.com/jquery/jquery-ui/pull/1953"
        },
        {
          "url": "https://bugs.jqueryui.com/ticket/15284"
        },
        {
          "name": "FEDORA-2021-51c256bf87",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/"
        },
        {
          "name": "FEDORA-2021-ab38307fc3",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/"
        },
        {
          "name": "FEDORA-2021-013ab302be",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/"
        },
        {
          "name": "[debian-lts-announce] 20220119 [SECURITY] [DLA-2889-1] drupal7 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html"
        },
        {
          "url": "https://www.drupal.org/sa-core-2022-002"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20211118-0004/"
        },
        {
          "url": "https://www.drupal.org/sa-contrib-2022-004"
        },
        {
          "url": "https://www.drupal.org/sa-core-2022-001"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        },
        {
          "url": "https://www.tenable.com/security/tns-2022-09"
        },
        {
          "name": "FEDORA-2022-9d655503ea",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/"
        },
        {
          "name": "FEDORA-2022-bf18450366",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"
        }
      ],
      "source": {
        "advisory": "GHSA-j7qv-pgf6-hvh4",
        "discovery": "UNKNOWN"
      },
      "title": "XSS in `*Text` options of the Datepicker widget"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-41183",
    "datePublished": "2021-10-26T00:00:00.000Z",
    "dateReserved": "2021-09-15T00:00:00.000Z",
    "dateUpdated": "2025-02-13T16:28:30.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-6419-1

Vulnerability from osv_ubuntu

Published

2023-10-05 12:36

Modified

2026-06-29 10:53

Summary

jqueryui vulnerabilities

Details

Hong Phat Ly discovered that jQuery UI did not properly manage parameters from untrusted sources, which could lead to arbitrary web script or HTML code injection. A remote attacker could possibly use this issue to perform a cross-site scripting (XSS) attack. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-7103)

Esben Sparre Andreasen discovered that jQuery UI did not properly handle values from untrusted sources in the Datepicker widget. A remote attacker could possibly use this issue to perform a cross-site scripting (XSS) attack and execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-41182, CVE-2021-41183)

It was discovered that jQuery UI did not properly validate values from untrusted sources. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-41184)

It was discovered that the jQuery UI checkboxradio widget did not properly decode certain values from HTML entities. An attacker could possibly use this issue to perform a cross-site scripting (XSS) attack and cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-31160)

References

URL

Type

	https://ubuntu.com/security/notices/USN-6419-1	ADVISORY
	https://ubuntu.com/security/CVE-2016-7103	REPORT
	https://ubuntu.com/security/CVE-2021-41182	REPORT
	https://ubuntu.com/security/CVE-2021-41183	REPORT
	https://ubuntu.com/security/CVE-2021-41184	REPORT
	https://ubuntu.com/security/CVE-2022-31160	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2016-7103",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-41182",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-41183",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libjs-jquery-ui",
            "binary_version": "1.10.1+dfsg-1ubuntu0.14.04.1~esm1"
          },
          {
            "binary_name": "libjs-jquery-ui-docs",
            "binary_version": "1.10.1+dfsg-1ubuntu0.14.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "jqueryui",
        "purl": "pkg:deb/ubuntu/jqueryui@1.10.1+dfsg-1ubuntu0.14.04.1~esm1?arch=source\u0026distro=trusty/esm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.1+dfsg-1ubuntu0.14.04.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.1+dfsg-1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2016-7103",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-41182",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-41183",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libjs-jquery-ui",
            "binary_version": "1.10.1+dfsg-1ubuntu0.16.04.1~esm1"
          },
          {
            "binary_name": "libjs-jquery-ui-docs",
            "binary_version": "1.10.1+dfsg-1ubuntu0.16.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "jqueryui",
        "purl": "pkg:deb/ubuntu/jqueryui@1.10.1+dfsg-1ubuntu0.16.04.1~esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.1+dfsg-1ubuntu0.16.04.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.1+dfsg-1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2021-41182",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-41183",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libjs-jquery-ui",
            "binary_version": "1.12.1+dfsg-5ubuntu0.18.04.1~esm3"
          },
          {
            "binary_name": "libjs-jquery-ui-docs",
            "binary_version": "1.12.1+dfsg-5ubuntu0.18.04.1~esm3"
          },
          {
            "binary_name": "node-jquery-ui",
            "binary_version": "1.12.1+dfsg-5ubuntu0.18.04.1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "jqueryui",
        "purl": "pkg:deb/ubuntu/jqueryui@1.12.1+dfsg-5ubuntu0.18.04.1~esm3?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.12.1+dfsg-5ubuntu0.18.04.1~esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.12.1+dfsg-5",
        "1.12.1+dfsg-5ubuntu0.18.04.1~esm2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2021-41182",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-41183",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-41184",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-31160",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjs-jquery-ui",
            "binary_version": "1.12.1+dfsg-5ubuntu0.20.04.1"
          },
          {
            "binary_name": "libjs-jquery-ui-docs",
            "binary_version": "1.12.1+dfsg-5ubuntu0.20.04.1"
          },
          {
            "binary_name": "node-jquery-ui",
            "binary_version": "1.12.1+dfsg-5ubuntu0.20.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "jqueryui",
        "purl": "pkg:deb/ubuntu/jqueryui@1.12.1+dfsg-5ubuntu0.20.04.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.12.1+dfsg-5ubuntu0.20.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.12.1+dfsg-5"
      ]
    }
  ],
  "aliases": [],
  "details": "Hong Phat Ly discovered that jQuery UI did not properly manage parameters\nfrom untrusted sources, which could lead to arbitrary web script or HTML\ncode injection. A remote attacker could possibly use this issue to perform\na cross-site scripting (XSS) attack. This issue only affected\nUbuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-7103)\n\nEsben Sparre Andreasen discovered that jQuery UI did not properly handle\nvalues from untrusted sources in the Datepicker widget. A remote attacker\ncould possibly use this issue to perform a cross-site scripting (XSS)\nattack and execute arbitrary code. This issue only affected\nUbuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n(CVE-2021-41182, CVE-2021-41183)\n\nIt was discovered that jQuery UI did not properly validate values from\nuntrusted sources. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. This issue only affected\nUbuntu 20.04 LTS. (CVE-2021-41184)\n\nIt was discovered that the jQuery UI checkboxradio widget did not properly\ndecode certain values from HTML entities. An attacker could possibly use\nthis issue to perform a cross-site scripting (XSS) attack and cause a\ndenial of service or execute arbitrary code. This issue only affected\nUbuntu 20.04 LTS. (CVE-2022-31160)\n",
  "id": "USN-6419-1",
  "modified": "2026-06-29T10:53:05Z",
  "published": "2023-10-05T12:36:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6419-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-7103"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-41182"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-41183"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-41184"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-31160"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "jqueryui vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2016-7103",
    "UBUNTU-CVE-2021-41182",
    "UBUNTU-CVE-2021-41183",
    "UBUNTU-CVE-2021-41184",
    "UBUNTU-CVE-2022-31160"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

ubuntu-cve-2021-41183

Vulnerability from osv_ubuntu

CVE-2021-41183 (GCVE-0-2021-41183)

usn-6419-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour