jQuery UI – CVE-2012-6662

Description

Kayran has detected that the version of jQuery UI being used is vulnerable to Cross-site scripting (XSS).
This can be done by abusing the jquery.ui.tooltip.js. Also known as CVE-2012-6662.

By abusing the jquery.ui.tooltip.js in the Tooltip widget in jQuery UI, remote attackers can inject arbitrary web scripts or any HTML.
This is done via the title attribute, which is not properly handled in the autocomplete combo box demo.

Recommendation

To fix CVE-2012-6662, update the version of the jQuery UI being used.
Make sure its version is 1.10.0 or higher.

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6662

https://cwe.mitre.org/data/definitions/79.html

< Return to all Vulnerabilities

Bug Bounties

As pirates, we all love plundering, we all love raiding, but mostly, we all love bounties, especially Bug Bounties. Let’s talk about it. Bug Bounties

Read More »

APT vs. ATP

In this article we will talk about APT vs. ATP. In other words, Advanced Persistent Threat and Advanced Threat Protection and the context between these

Read More »

Man-In-The-Middle Attacks

Do you know these people who just push themselves into conversations?That’s Man-In-The-Middle Attacks. And from a wider angle, Man-In-The-Middle Attacks, or MITM, are built around

Read More »

Passwords 101

Unlike basketballs, “passwords” are things we don’t want to be passed around, especially in a society built around the idea that “mystery” is appealing. We

Read More »