CVE-2012-6662

Опубликовано: 24 нояб. 2014

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

Ссылки

http://bugs.jqueryui.com/ticket/8859
Issue Tracking
Vendor Advisory
http://bugs.jqueryui.com/ticket/8861
Issue Tracking
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0442.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1462.html
http://seclists.org/oss-sec/2014/q4/613
Third Party Advisory
VDB Entry
http://seclists.org/oss-sec/2014/q4/616
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/71107
https://exchange.xforce.ibmcloud.com/vulnerabilities/98697
https://github.com/jquery/jquery-ui/commit/5fee6fd5000072ff32f2d65b6451f39af9e0e39e
Issue Tracking
Patch
Third Party Advisory
https://github.com/jquery/jquery-ui/commit/f2854408cce7e4b7fc6bf8676761904af9c96bde
Issue Tracking
Patch
Third Party Advisory
https://github.com/jquery/jquery/issues/2432
http://bugs.jqueryui.com/ticket/8859
Issue Tracking
Vendor Advisory
http://bugs.jqueryui.com/ticket/8861
Issue Tracking
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0442.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1462.html
http://seclists.org/oss-sec/2014/q4/613
Third Party Advisory
VDB Entry
http://seclists.org/oss-sec/2014/q4/616
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/71107
https://exchange.xforce.ibmcloud.com/vulnerabilities/98697
https://github.com/jquery/jquery-ui/commit/5fee6fd5000072ff32f2d65b6451f39af9e0e39e
Issue Tracking
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:a:jqueryui:jquery_ui:1.10.0:rc1:*:*:*:jquery:*:*

EPSS

Процентиль: 90%

0.06154

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2012-6662

ubuntu

больше 10 лет назад

CVE-2012-6662

redhat

больше 12 лет назад

CVE-2012-6662

debian

больше 10 лет назад

Cross-site scripting (XSS) vulnerability in the default content option ...

GHSA-qqxp-xp9v-vvx6

github

больше 7 лет назад

jquery-ui Tooltip widget vulnerable to XSS

ELSA-2015-1462

oracle-oval

почти 10 лет назад

ELSA-2015-1462: ipa security and bug fix update (MODERATE)

EPSS

Процентиль: 90%

0.06154

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79