jQuery UI – CVE-2021-41182

Home » Blog » jQuery UI – CVE-2021-41182

Description

Kayran has detected that the version of jQuery UI being used is vulnerable to cross-site scripting.

By accepting the value of the ” altField” option of the Datepicker widget from untrusted sources, untrusted codes may be executed.
An attacker could abuse this to insert and execute commands for his own purposes.

Severity/Score

CVSS Version 3.x – 6.1 Medium

Recommendation

To fix this, update the jQuery UI version being used to 1.13.0 or higher.
As of now, any string value passed to the ” altField” option is now being treated as a CSS selector.

Another option is to not accept the value of the ” altField” option from any untrusted sources.

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41182

https://cwe.mitre.org/data/definitions/79.html

< Return to all Vulnerabilities

APT vs. ATP

In this article we will talk about APT vs. ATP. In other words, Advanced Persistent Threat and Advanced Threat Protection and the context between these

The least choking snake – Python

Nice title does it? No but seriously, tell it to my boss. but seriously-Seriously, in this article we are gonna talk about Python, and no,

Injection Attacks – You better inject yourself before you get-hacked yourself

Besides the most creative title you’ve ever seen, there are many things we do not like that we can talk about, in this case, we

PT- Pentest – Penetration Testing

There’s no way you’ve had a working internet connection in the last year and you haven’t seen or heard the terms PT, Pentest or Penetration

Crossing Scripts – XSS

Injections. SQL Injections. Cross-site Scripting (hence the amazing title “Crossing Scripts – XSS”). There all sorts of Injection-Based attacks, if you want to read about

The average hacker shopping list – the CVE

When i take an X-Rey my doctor sits me down and simply “roast” me with stuff like how un-healthy i am, how i should stop

WEB APPLICATION VULNERABILITY SCANNER