Medium · published October 26, 2021
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.
| Product | Versions | Fixed in |
|---|---|---|
| jqueryui/jquery_ui | < 1.13.0 | 1.13.0 |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| netapp/h300s_firmware | all versions | — |
| netapp/h500s_firmware | all versions | — |
| netapp/h700s_firmware | all versions | — |
| netapp/h300e_firmware | all versions | — |
| netapp/h500e_firmware | all versions | — |
| netapp/h700e_firmware | all versions | — |
| netapp/h410s_firmware | all versions | — |
| netapp/h410c_firmware | all versions | — |
| debian/debian_linux | all versions | — |
| drupal/drupal | ≥ 7.0, < 7.86 | 7.86 |
| drupal/drupal | ≥ 9.2.0, < 9.2.11 | 9.2.11 |
| drupal/drupal | ≥ 9.3.0, < 9.3.3 | 9.3.3 |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/application_express | < 22.1.1 | 22.1.1 |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/big_data_spatial_and_graph | < 23.1 | 23.1 |
| oracle/big_data_spatial_and_graph | all versions | — |
| oracle/communications_interactive_session_recorder | all versions | — |
| oracle/communications_operations_monitor | all versions | — |
| oracle/communications_operations_monitor | all versions | — |
| oracle/communications_operations_monitor | all versions | — |
| oracle/hospitality_inventory_management | all versions | — |
| oracle/hospitality_suite8 | ≥ 8.11.0, ≤ 11.14.0 | — |
| oracle/hospitality_suite8 | all versions | — |
| oracle/jd_edwards_enterpriseone_tools | ≤ 9.2.6.3 | — |
| oracle/mysql_enterprise_monitor | ≤ 8.0.29 | — |
| oracle/peoplesoft_enterprise_peopletools | all versions | — |
| oracle/peoplesoft_enterprise_peopletools | all versions | — |
| oracle/policy_automation | ≥ 12.2.0, ≤ 12.2.5 | — |
| oracle/primavera_gateway | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/rest_data_services | < 22.1.1 | 22.1.1 |
| oracle/rest_data_services | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| tenable/tenable.sc | < 5.21.0 | 5.21.0 |