Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ ΠΌΠ΅ΠΆΡΠ°ΠΉΡΠΎΠ²ΠΎΠ³ΠΎ ΡΠΊΡΠΈΠΏΡΠΈΠ½Π³Π° (XSS) Π² ΡΠ°ΠΉΠ»Π΅ "jquery.ui.dialog.js" Π²ΠΈΠ΄ΠΆΠ΅ΡΠ° Dialog Π±ΠΈΠ±Π»ΠΈΠΎΡΠ΅ΠΊΠΈ jQuery UI, ΠΏΠΎΠ·Π²ΠΎΠ»ΡΡΡΠ°Ρ Π²Π½Π΅Π΄ΡΡΡΡ ΠΏΡΠΎΠΈΠ·Π²ΠΎΠ»ΡΠ½ΡΠΉ Π²Π΅Π±-ΡΠΊΡΠΈΠΏΡ ΠΈΠ»ΠΈ HTML ΡΠ΅ΡΠ΅Π· ΠΏΠ°ΡΠ°ΠΌΠ΅ΡΡ "title"
ΠΠΏΠΈΡΠ°Π½ΠΈΠ΅
ΠΠ±Π½Π°ΡΡΠΆΠ΅Π½Π° ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΡ ΠΌΠ΅ΠΆΡΠ°ΠΉΡΠΎΠ²ΠΎΠ³ΠΎ ΡΠΊΡΠΈΠΏΡΠΈΠ½Π³Π° (XSS) Π² ΡΠ°ΠΉΠ»Π΅ jquery.ui.dialog.js Π²ΠΈΠ΄ΠΆΠ΅ΡΠ° Dialog Π±ΠΈΠ±Π»ΠΈΠΎΡΠ΅ΠΊΠΈ jQuery UI Π΄ΠΎ Π²Π΅ΡΡΠΈΠΈ 1.10.0. Π£Π΄Π°Π»ΡΠ½Π½ΡΠ΅ Π·Π»ΠΎΡΠΌΡΡΠ»Π΅Π½Π½ΠΈΠΊΠΈ ΠΌΠΎΠ³ΡΡ Π²Π½Π΅Π΄ΡΡΡΡ ΠΏΡΠΎΠΈΠ·Π²ΠΎΠ»ΡΠ½ΡΠΉ Π²Π΅Π±-ΡΠΊΡΠΈΠΏΡ ΠΈΠ»ΠΈ HTML ΡΠ΅ΡΠ΅Π· ΠΏΠ°ΡΠ°ΠΌΠ΅ΡΡ title.
ΠΠ°ΡΡΠΎΠ½ΡΡΡΠ΅ Π²Π΅ΡΡΠΈΠΈ ΠΠ
- jQuery UI Π΄ΠΎ Π²Π΅ΡΡΠΈΠΈ 1.10.0
Π’ΠΈΠΏ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
ΠΠ΅ΠΆΡΠ°ΠΉΡΠΎΠ²ΡΠΉ ΡΠΊΡΠΈΠΏΡΠΈΠ½Π³ (XSS)
ΠΠ°ΡΡΠΎΠ½ΡΡΡΠ΅ ΠΏΠ°ΠΊΠ΅ΡΡ
| ΠΠ»Π°ΡΡΠΎΡΠΌΠ° | ΠΠ°ΠΊΠ΅Ρ | Π‘ΠΎΡΡΠΎΡΠ½ΠΈΠ΅ | Π Π΅ΠΊΠΎΠΌΠ΅Π½Π΄Π°ΡΠΈΡ | Π Π΅Π»ΠΈΠ· |
|---|---|---|---|---|
| CloudForms Management Engine 5 | ruby193-rubygem-jquery-rails | Will not fix | ||
| OpenShift Enterprise 1 | ruby193-rubygem-jquery-rails | Will not fix | ||
| OpenStack Foreman | ruby193-rubygem-jquery-ui-rails | Will not fix | ||
| Red Hat Enterprise Linux 6 | python-sphinx | Will not fix | ||
| Red Hat Enterprise Linux 7 | python-sphinx | Will not fix | ||
| Red Hat Enterprise Linux 7 | yelp-xsl | Will not fix | ||
| Red Hat OpenShift Enterprise 2 | ruby193-rubygem-jquery-rails | Will not fix | ||
| Red Hat OpenStack Platform 4 | ruby193-rubygem-jquery-rails | Will not fix | ||
| Red Hat Satellite 6 | ruby193-rubygem-jquery-ui-rails | Will not fix | ||
| Red Hat Software Collections | ror40-rubygem-jquery-rails | Will not fix |
ΠΠΎΠΊΠ°Π·ΡΠ²Π°ΡΡ ΠΏΠΎ
Π‘ΡΡΠ»ΠΊΠΈ Π½Π° ΠΈΡΡΠΎΡΠ½ΠΈΠΊΠΈ
ΠΠΎΠΏΠΎΠ»Π½ΠΈΡΠ΅Π»ΡΠ½Π°Ρ ΠΈΠ½ΡΠΎΡΠΌΠ°ΡΠΈΡ
Π‘ΡΠ°ΡΡΡ:
EPSS
4.3 Medium
CVSS2
Π‘Π²ΡΠ·Π°Π½Π½ΡΠ΅ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the ...
ELSA-2015-1462: ipa security and bug fix update (MODERATE)
EPSS
4.3 Medium
CVSS2