Medium · published October 26, 2021
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.
| Product | Versions | Fixed in |
|---|---|---|
| jqueryui/jquery_ui | < 1.13.0 | 1.13.0 |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| netapp/h300s_firmware | all versions | — |
| netapp/h500s_firmware | all versions | — |
| netapp/h700s_firmware | all versions | — |
| netapp/h300e_firmware | all versions | — |
| netapp/h500e_firmware | all versions | — |
| netapp/h700e_firmware | all versions | — |
| netapp/h410s_firmware | all versions | — |
| netapp/h410c_firmware | all versions | — |
| drupal/drupal | ≥ 7.0, < 7.86 | 7.86 |
| drupal/drupal | ≥ 9.2.0, < 9.2.11 | 9.2.11 |
| drupal/drupal | ≥ 9.3.0, < 9.3.3 | 9.3.3 |
| tenable/tenable.sc | < 5.21.0 | 5.21.0 |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/application_express | < 22.1.1 | 22.1.1 |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/big_data_spatial_and_graph | < 23.1 | 23.1 |
| oracle/big_data_spatial_and_graph | all versions | — |
| oracle/communications_interactive_session_recorder | all versions | — |
| oracle/communications_operations_monitor | all versions | — |
| oracle/communications_operations_monitor | all versions | — |
| oracle/communications_operations_monitor | all versions | — |
| oracle/hospitality_inventory_management | all versions | — |
| oracle/hospitality_materials_control | all versions | — |
| oracle/hospitality_suite8 | ≥ 8.11.0, ≤ 8.14.0 | — |
| oracle/hospitality_suite8 | all versions | — |
| oracle/jd_edwards_enterpriseone_tools | ≤ 9.2.6.3 | — |
| oracle/peoplesoft_enterprise_peopletools | all versions | — |
| oracle/peoplesoft_enterprise_peopletools | all versions | — |
| oracle/policy_automation | ≥ 12.2.0, ≤ 12.2.25 | — |
| oracle/primavera_unifier | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/rest_data_services | < 22.1.1 | 22.1.1 |
| oracle/rest_data_services | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |