CVE-2010-5312
Medium · 6.1CVSS
6.1
EPSS
18.4%
Published
Nov 24, 2014
CISA due date
—
The record
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.webjars.npm:jquery-ui | 1.7.0 | 1.10.0 |
| NuGet | jQuery.UI.Combined | 1.7.0 | 1.10.0 |
| RubyGems | jquery-ui-rails | 0 | 4.0.0 |
| npm | jquery-ui | 1.7.0 | 1.10.0 |
| Debian:11 | jqueryui | 0 | 1.10.1+dfsg-1 |
| Debian:12 | jqueryui | 0 | 1.10.1+dfsg-1 |
| Debian:13 | jqueryui | 0 | 1.10.1+dfsg-1 |
| Debian:6.0 | jqueryui | 0 | 1.8.dfsg-3+deb6u1 |
| Debian:7 | jqueryui | 0 | 1.8.ooops.21+dfsg-2+deb7u1 |
| Debian:9 | drupal7 | 0 | 7.52-2+deb9u17 |
| Mageia:4 | couchdb | 0 | 1.4.0-2.5.mga4 |
| Red Hat:enterprise_linux:6::client | ipa | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::client | ipa-admintools | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::client | ipa-client | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::client | ipa-debuginfo | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::client | ipa-python | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::client | ipa-server | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::client | ipa-server-selinux | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::client | ipa-server-trust-ad | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::computenode | ipa | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::computenode | ipa-admintools | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::computenode | ipa-client | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::computenode | ipa-debuginfo | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::computenode | ipa-python | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::computenode | ipa-server | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::computenode | ipa-server-selinux | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::computenode | ipa-server-trust-ad | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::server | ipa | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::server | ipa-admintools | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::server | ipa-client | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::server | ipa-debuginfo | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::server | ipa-python | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::server | ipa-server | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::server | ipa-server-selinux | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::server | ipa-server-trust-ad | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::workstation | ipa | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::workstation | ipa-admintools | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::workstation | ipa-client | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::workstation | ipa-debuginfo | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::workstation | ipa-python | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::workstation | ipa-server | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::workstation | ipa-server-selinux | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:6::workstation | ipa-server-trust-ad | 0 | 0:3.0.0-47.el6 |
| Red Hat:enterprise_linux:7::client | ipa | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::client | ipa-admintools | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::client | ipa-client | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::client | ipa-debuginfo | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::client | ipa-python | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::client | ipa-server | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::client | ipa-server-trust-ad | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::computenode | ipa | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::computenode | ipa-admintools | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::computenode | ipa-client | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::computenode | ipa-debuginfo | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::computenode | ipa-python | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::computenode | ipa-server | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::computenode | ipa-server-trust-ad | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::server | ipa | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::server | ipa-admintools | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::server | ipa-client | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::server | ipa-debuginfo | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::server | ipa-python | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::server | ipa-server | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::server | ipa-server-trust-ad | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::workstation | ipa | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::workstation | ipa-admintools | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::workstation | ipa-client | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::workstation | ipa-debuginfo | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::workstation | ipa-python | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::workstation | ipa-server | 0 | 0:4.1.0-18.el7 |
| Red Hat:enterprise_linux:7::workstation | ipa-server-trust-ad | 0 | 0:4.1.0-18.el7 |
| Ubuntu:14.04:LTS | jqueryui | 0 | 1.10.1+dfsg-1 |
| Ubuntu:16.04:LTS | jqueryui | 0 | 1.10.1+dfsg-1 |
| maven | org.webjars.npm/jquery-ui | 1.7.0 | 1.10.0 |
| nuget | jQuery.UI.Combined | 1.7.0 | 1.10.0 |
Related vulnerabilities
- CVE-2021-41184 jQuery-UI is the official jQuery user interface library. Also affects org.webjars.npm:jquery-ui
- CVE-2021-41182 jQuery-UI is the official jQuery user interface library. Also affects org.webjars.npm:jquery-ui
- CVE-2021-41183 jQuery-UI is the official jQuery user interface library. Also affects org.webjars.npm:jquery-ui
- CVE-2016-7103 Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote… Also affects org.webjars.npm:jquery-ui
- CVE-2020-11022 In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources… Also affects drupal7
- CVE-2014-2668 Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service… Also affects couchdb
- CVE-2016-5404 The cert_revoke command in FreeIPA does not check for the "revoke certificate"… Also affects ipa
- CVE-2016-2115 Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not… Also affects ipa