Cross-site Scripting in jquery-ui (GHSA-wcm2-9c89-wmfm)
Published: 2017-10-24T18:33:38Z
Aliases: CVE-2010-5312
Severity: MODERATE · CWE: CWE-79

Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.

Affected packages:
package: ecosystem: npm
name: jquery-ui
ranges: type: ECOSYSTEM
events: introduced: 1.7.0
fixed: 1.10.0
package: ecosystem: Maven
name: org.webjars.npm:jquery-ui
ranges: type: ECOSYSTEM
events: introduced: 1.7.0
fixed: 1.10.0
package: ecosystem: NuGet
name: jQuery.UI.Combined
ranges: type: ECOSYSTEM
events: introduced: 1.7.0
fixed: 1.10.0
package: ecosystem: RubyGems
name: jquery-ui-rails
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.0.0