{"id":"CVE-2021-41182","aliases":["ALPINE-CVE-2021-41182","BIT-drupal-2021-41182","CLSA-2026-1773188127","CLSA-2026-1792502475","DEBIAN-CVE-2021-41182","DLA-2889-1","DLA-3230-1","DLA-3551-1","EUVD-2021-2186","GHSA-9gj3-hwp5-pmwc","RHSA-2022:4711","SUSE-SU-2022:1729-1","UBUNTU-CVE-2021-41182","USN-6419-1"],"status":"published","title":"XSS in the `altField` option of the Datepicker widget","description":"jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.39361,"percentile":0.98626,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2021-10-26T00:00:00Z","modified":"2026-11-03T06:32:41Z","exploits":[{"source":"pocgithub","id":"aredspy/CVE-2021-41182-Tester","title":"aredspy/CVE-2021-41182-Tester","date":"2024-08-05","url":"https://github.com/aredspy/CVE-2021-41182-Tester"}],"fixes":[{"ecosystem":"npm","package":"jquery-ui","fixed_in":["1.13.0"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"jQuery.UI.Combined","fixed_in":["1.13.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.webjars.npm:jquery-ui","fixed_in":["1.13.0"],"sources":["ghsa","osv"]},{"ecosystem":"RubyGems","package":"jquery-ui-rails","fixed_in":["7.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.15","package":"drupal7","fixed_in":["7.86-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"drupal7","fixed_in":["7.86-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"drupal7","fixed_in":["7.86-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"drupal7","fixed_in":["7.86-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"drupal7","fixed_in":["7.86-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"drupal7","fixed_in":["7.86-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"drupal","fixed_in":["7.86.0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"jqueryui","fixed_in":["1.13.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jqueryui","fixed_in":["1.13.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jqueryui","fixed_in":["1.13.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jqueryui","fixed_in":["1.10.1+dfsg-1ubuntu0.14.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jqueryui","fixed_in":["1.10.1+dfsg-1ubuntu0.16.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"jqueryui","fixed_in":["1.12.1+dfsg-5ubuntu0.18.04.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"jqueryui","fixed_in":["1.12.1+dfsg-5ubuntu0.20.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"jQuery.UI.Combined","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.webjars.npm:jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"jquery-ui-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.86-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.86-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.86-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.86-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.86-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.86-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"drupal","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.86.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.4-tuxcare.0"},{"fixed":"1.10.4-tuxcare.1"}]}],"versions":["1.10.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.3-tuxcare.0"},{"fixed":"1.10.3-tuxcare.1"}]}],"versions":["1.10.3"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52-2+deb9u17"}]}],"versions":["7.52-2","7.52-2+deb9u1","7.52-2+deb9u10","7.52-2+deb9u11","7.52-2+deb9u12","7.52-2+deb9u13","7.52-2+deb9u14","7.52-2+deb9u15","7.52-2+deb9u16","7.52-2+deb9u2","7.52-2+deb9u3","7.52-2+deb9u4","7.52-2+deb9u5","7.52-2+deb9u6","7.52-2+deb9u7","7.52-2+deb9u8","7.52-2+deb9u9"],"bundled":4},{"source":"osv","ecosystem":"Debian:10","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1+dfsg-5+deb10u1"}]}],"versions":["1.12.1+dfsg-5"],"bundled":4},{"source":"osv","ecosystem":"Debian:10","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.16-2+deb10u1"}]}],"versions":["2.0.4p01-10","2.0.4p01-11","2.0.4p01-12","2.0.4p01-13","2.0.4p01-14","2.0.4p01-14.1","2.0.4p01-15","2.0.4p01-16","2.0.4p01-17","2.0.4p01-18","2.0.4p01-6","2.0.4p01-7","2.0.4p01-8","2.0.4p01-9","2.0.99beta1-1","2.0.99beta1-2","2.1.1-1","2.1.3-1","2.1.4-1","2.1.4-2","2.1.5-1","2.1.5-2","2.1.5-3","2.1.6-1","2.1.7-1","2.1.7-2","2.2.0~beta2-1","2.2.0~beta3-1","2.2.1-1","2.2.2-1","2.2.3-1","2.2.4-1","2.2.5-1","2.2.5-2","2.2.6-1","2.2.7-1","2.2.7-2","2.2.7-2lenny1","2.2.7-2lenny2","2.2.7-2lenny3","2.2.7-3","2.3.2-1","2.3.2-2","2.3.3-1","2.3.4-1","2.3.4-2","2.3.4-3","2.3.4-4","2.3.4-5","2.3.4-6","2.3.4-7","2.4.10+dfsg1-1","2.4.10+dfsg1-2","2.4.10+dfsg1-3","2.4.5-1","2.4.5-2","2.4.5-3","2.4.5-4","2.4.5-5","2.4.6-1","2.4.6-2","2.4.7+dfsg1-1","2.4.7-1","2.4.7-2","2.4.7-3","2.4.7-4","2.4.7-5","2.4.7-6","2.4.8+dfsg1-1","2.4.9+dfsg1-1","2.4.9+dfsg1-2","2.4.9+dfsg1-3","2.4.9+dfsg1-3+squeeze1","2.4.9+dfsg1-3+squeeze3","2.4.9+dfsg1-3+squeeze4","2.4.9+dfsg1-3+squeeze5","2.4.9+dfsg1-4","2.4.9+dfsg1-5","3.0.10+dfsg1-1","3.0.10+dfsg1-2","3.0.11+dfsg1-1","3.0.8+dfsg1-1","3.0.9+dfsg1-1","3.1.0~beta4+dfsg1-1","3.1.0~beta5+dfsg1-1","3.1.0~rc1+dfsg1-1","3.1.1+dfsg1-1","3.1.1+dfsg1-2","3.1.10+dfsg1-1","3.1.11+dfsg1-1","3.1.12+dfsg1-1","3.1.12+dfsg1-2","3.1.12+dfsg1-3","3.1.2+dfsg1-1","3.1.2+dfsg1-2","3.1.2+dfsg1-3","3.1.3+dfsg1-1","3.1.3+dfsg1-2","3.1.4+dfsg1-1","3.1.5+dfsg1-1","3.1.5+dfsg1-2","3.1.5+dfsg1-3","3.1.6+dfsg1-1","3.1.7+dfsg1-1","3.1.7+dfsg1-2","3.1.7+dfsg1-3","3.1.7+dfsg1-4","3.1.7+dfsg1-5","3.1.7+dfsg1-6","3.1.7+dfsg1-7","3.1.7+dfsg1-8","3.1.8+dfsg1-1","3.1.9+dfsg1-1","3.2.1+dfsg1-1","3.2.10-1","3.2.10-2","3.2.11-1","3.2.11-1~bpo70+1","3.2.12-1","3.2.2+dfsg1-1","3.2.3+dfsg1-1","3.2.4-1","3.2.5-1","3.2.6-1","3.2.6-2","3.2.7-1","3.2.7-2","3.2.8-1","3.2.9-1","3.2.9-2","3.3.1-1","3.3.10-1","3.3.11-1","3.3.18-1~deb7u1","3.3.18-1~deb7u2","3.3.18-1~deb7u3","3.3.2-1","3.3.3-1","3.3.3-2","3.3.3-3","3.3.4-1","3.3.5-1","3.3.6-1","3.3.7-1","3.3.7-2","3.3.8-1","3.3.9-1","3.3.9-2","3.3.9-3","3.3.9-3~bpo70+1","4.0.10-1","4.0.11-1","4.0.12-1","4.0.13-1","4.0.13-1~bpo8+1","4.0.5-1","4.0.5-2","4.0.6-1","4.0.7-1","4.0.7-2","4.0.8-1","4.0.9-1","5.0.1-1","5.0.1-2","5.0.10-1","5.0.10-1~bpo8+1","5.0.11-1","5.0.12-1","5.0.13-1","5.0.13-1~bpo8+1","5.0.13-2","5.0.14-1","5.0.14-1~bpo8+1","5.0.15-1","5.0.16-1","5.0.16-1~bpo8+1","5.0.17-1","5.0.18-1","5.0.19-1","5.0.2-1","5.0.20-1","5.0.21-1","5.0.21-1~bpo9+1","5.0.22-1","5.0.23-1","5.0.23-1~bpo9+1","5.0.24-1","5.0.24-1~bpo9+1","5.0.3-1","5.0.5-1","5.0.6-1","5.0.6-1~bpo8+1","5.0.7-1","5.0.8+dfsg1-1","5.0.8-1","5.0.8-1~bpo8+1","5.0.9+dfsg1-1","5.0.9+repack1-1","6.0.1-1","6.0.10-1","6.0.11-1","6.0.11-1~bpo9+1","6.0.12-1","6.0.12-1~bpo9+1","6.0.13-1","6.0.14-1","6.0.15-1","6.0.16-1","6.0.16-2","6.0.2-1","6.0.3-1","6.0.4-1","6.0.5-1","6.0.6-1","6.0.7-1","6.0.8-1","6.0.8-1~bpo9+1","6.0.9-1","6.0.9-1~bpo9+1"],"bundled":32},{"source":"osv","ecosystem":"npm","package":"jquery-ui","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}]},{"source":"osv","ecosystem":"NuGet","package":"jQuery.UI.Combined","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}],"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.11.1","1.11.2","1.11.3","1.11.4","1.12.0","1.12.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.15","1.8.16","1.8.17","1.8.18","1.8.19","1.8.20","1.8.20.1","1.8.21","1.8.22","1.8.23","1.8.24","1.8.9","1.9.0","1.9.0-RC1","1.9.1","1.9.2"]},{"source":"osv","ecosystem":"RubyGems","package":"jquery-ui-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0"}]}],"versions":["0.0.1","0.0.2","0.1.0","0.2.0","0.2.1","0.2.2","0.3.0","0.4.0","0.4.1","0.5.0","1.0.0","1.1.0","1.1.1","2.0.0","2.0.1","2.0.2","3.0.0","3.0.1","4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.1.0","4.1.1","4.1.2","4.2.0","4.2.1","5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","6.0.0","6.0.1"]},{"source":"osv","ecosystem":"Maven","package":"org.webjars.npm:jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}],"versions":["1.10.4","1.10.5","1.12.0","1.12.0-rc.2","1.12.1","1.13.0-rc.2","1.13.0-rc.3"]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-ui-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-2.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-dbscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-health-check-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-restapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-cinderlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-imageio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-ovirt-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-ovirt-engine-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-vmconsole-proxy-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-websocket-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-tools-backup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-vmconsole-proxy-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-webadmin-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-websocket-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"python3-ovirt-engine-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"rhvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1644879908.8a641c1-3.13.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.26.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.14.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev24-3.34.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev4-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev3-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev18-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev206-3.40.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev33-3.31.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-3.17.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0.1-4.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-3.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20220413-3.30.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.35.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev24-3.38.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.1~dev30-3.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev11-4.39.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev18-4.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.36.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-4.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev60-3.41.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1~dev10-3.37.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2~dev3-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev206-6.39.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev91-3.39.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-4.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev15-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.2~dev48-2.30.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.26.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.14.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev24-3.34.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev4-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev3-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev18-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev206-3.40.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev33-3.31.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-3.17.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0.1-4.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-3.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20220413-3.30.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-4.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-1ubuntu0.14.04.1~esm1"}]}],"versions":["1.10.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-1ubuntu0.16.04.1~esm1"}]}],"versions":["1.10.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1+dfsg-5ubuntu0.18.04.1~esm3"}]}],"versions":["1.12.1+dfsg-5","1.12.1+dfsg-5ubuntu0.18.04.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1+dfsg-5ubuntu0.20.04.1"}]}],"versions":["1.12.1+dfsg-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-1ubuntu0.14.04.1~esm1"}]}],"versions":["1.10.1+dfsg-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-1ubuntu0.16.04.1~esm1"}]}],"versions":["1.10.1+dfsg-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1+dfsg-5ubuntu0.18.04.1~esm3"}]}],"versions":["1.12.1+dfsg-5","1.12.1+dfsg-5ubuntu0.18.04.1~esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1+dfsg-5ubuntu0.20.04.1"}]}],"versions":["1.12.1+dfsg-5"],"bundled":5}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"drupal","product":"drupal"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"jquery","product":"jquery-ui"},{"vendor":"jqueryui","product":"jquery_ui"},{"vendor":"netapp","product":"h300e_firmware"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410c_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500e_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700e_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"oracle","product":"agile_product_lifecycle_management"},{"vendor":"oracle","product":"application_express"},{"vendor":"oracle","product":"banking_platform"},{"vendor":"oracle","product":"big_data_spatial_and_graph"},{"vendor":"oracle","product":"communications_interactive_session_recorder"},{"vendor":"oracle","product":"communications_operations_monitor"},{"vendor":"oracle","product":"hospitality_inventory_management"},{"vendor":"oracle","product":"hospitality_materials_control"},{"vendor":"oracle","product":"hospitality_suite8"},{"vendor":"oracle","product":"jd_edwards_enterpriseone_tools"},{"vendor":"oracle","product":"mysql_enterprise_monitor"},{"vendor":"oracle","product":"peoplesoft_enterprise_peopletools"},{"vendor":"oracle","product":"policy_automation"},{"vendor":"oracle","product":"primavera_unifier"},{"vendor":"oracle","product":"rest_data_services"},{"vendor":"oracle","product":"weblogic_server"},{"vendor":"tenable","product":"tenable.sc"}],"references":[{"url":"https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc","tags":["x_transferred","Exploit","Mitigation","Third Party Advisory","advisory","evidence","web","report"]},{"url":"https://github.com/jquery/jquery-ui/pull/1954/commits/6809ce843e5ac4128108ea4c15cbc100653c2b63","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix","web","report"]},{"url":"https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/","tags":["x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.drupal.org/sa-core-2022-002","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20211118-0004/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.drupal.org/sa-contrib-2022-004","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://www.tenable.com/security/tns-2022-09","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41182","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ui-rails/CVE-2021-41182.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9gj3-hwp5-pmwc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-41182","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-41182","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20211118-0004","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3","tags":["web"]},{"url":"https://github.com/jquery/jquery-ui","tags":["package"]},{"url":"https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2022:4711","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=655153","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=977778","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1624015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1648985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1687845","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1781241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1782056","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1849169","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1878930","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1922977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1926625","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1927985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944290","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944834","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1959186","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1971622","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1974741","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979797","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1980192","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1986726","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1986834","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1987121","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990462","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995793","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1996123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998255","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1999698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000031","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2002283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2003883","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2003996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2006602","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2006745","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2008798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2010203","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2010903","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014888","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015796","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2019144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2019148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2019153","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2021217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2023250","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2023786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024202","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025936","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030663","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2031027","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035051","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037115","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037121","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040361","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040402","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040474","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041544","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048546","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050566","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051857","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056052","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056126","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2059521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2059877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061904","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065052","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2071468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072637","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072641","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072642","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075352","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4711.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3807","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3807","tags":["advisory"]},{"url":"https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23425","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23425","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23425","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-TRIMOFFNEWLINES-1296850","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33502","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33502","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41182","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41182","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41183","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41183","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41184","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41184","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41184","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221729-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1118088","tags":["report"]},{"url":"https://bugzilla.suse.com/1179534","tags":["report"]},{"url":"https://bugzilla.suse.com/1184177","tags":["report"]},{"url":"https://bugzilla.suse.com/1186380","tags":["report"]},{"url":"https://bugzilla.suse.com/1189390","tags":["report"]},{"url":"https://bugzilla.suse.com/1189794","tags":["report"]},{"url":"https://bugzilla.suse.com/1192070","tags":["report"]},{"url":"https://bugzilla.suse.com/1192073","tags":["report"]},{"url":"https://bugzilla.suse.com/1192075","tags":["report"]},{"url":"https://bugzilla.suse.com/1193597","tags":["report"]},{"url":"https://bugzilla.suse.com/1193688","tags":["report"]},{"url":"https://bugzilla.suse.com/1193752","tags":["report"]},{"url":"https://bugzilla.suse.com/1194521","tags":["report"]},{"url":"https://bugzilla.suse.com/1194551","tags":["report"]},{"url":"https://bugzilla.suse.com/1194552","tags":["report"]},{"url":"https://bugzilla.suse.com/1194952","tags":["report"]},{"url":"https://bugzilla.suse.com/1194954","tags":["report"]},{"url":"https://bugzilla.suse.com/1199138","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29970","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-41182","tags":["report"]},{"url":"https://github.com/jquery/jquery-ui/commit/32850869d308d5e7c9bf3e3b4d483ea886d373ce","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6419-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-7103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-31160","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-41182","title":"XSS in the `altField` option of the Datepicker widget","description":"jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.","status":"published","published":"2021-10-26T00:00:00Z","modified":"2025-02-13T16:28:30.239Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:59.430294Z"}],"euvd":[{"id":"EUVD-2021-2186","description":"jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.","status":"published","published":"2021-10-26T00:00:00Z","modified":"2025-02-13T16:28:30Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:52.752782Z"}],"ghsa":[{"id":"GHSA-9gj3-hwp5-pmwc","title":"XSS in the `altField` option of the Datepicker widget in jquery-ui","description":"### Impact\nAccepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:\n```js\n$( \"#datepicker\" ).datepicker( {\n\taltField: \"\u003cimg onerror='doEvilThing()' src='/404' /\u003e\",\n} );\n```\nwill call the `doEvilThing` function.\n\n### Patches\nThe issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector.\n\n### Workarounds\nA workaround is to not accept the value of the `altField` option from untrusted sources.\n\n### For more information\nIf you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.","status":"published","published":"2021-10-26T14:55:02Z","modified":"2023-09-26T21:52:24Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:06.913882Z"}],"nvd":[{"id":"CVE-2021-41182","description":"jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.","status":"published","published":"2021-10-26T15:15:10.313Z","modified":"2026-08-25T16:28:27.31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:00.549994Z"}],"osv":[{"id":"ALPINE-CVE-2021-41182","description":"jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.","status":"published","published":"2021-10-26T15:15:10.313Z","modified":"2026-11-03T06:32:41.321280482Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2021-41182","description":"jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.","status":"published","published":"2021-10-26T15:15:10.313Z","modified":"2026-10-24T10:51:25.622878242Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:21.249056Z"},{"id":"DEBIAN-CVE-2021-41182","description":"jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.","status":"published","published":"2021-10-26T15:15:10.313Z","modified":"2026-10-23T18:03:38.808041529Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"GHSA-9gj3-hwp5-pmwc","title":"XSS in the `altField` option of the Datepicker widget in jquery-ui","description":"### Impact\nAccepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:\n```js\n$( \"#datepicker\" ).datepicker( {\n\taltField: \"\u003cimg onerror='doEvilThing()' src='/404' /\u003e\",\n} );\n```\nwill call the `doEvilThing` function.\n\n### Patches\nThe issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector.\n\n### Workarounds\nA workaround is to not accept the value of the `altField` option from untrusted sources.\n\n### For more information\nIf you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.","status":"published","published":"2021-10-26T14:55:02Z","modified":"2026-07-08T06:29:23.458833655Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"RHSA-2022:4711","title":"Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.0] security update","status":"published","published":"2024-09-16T06:52:10Z","modified":"2026-10-14T10:02:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"UBUNTU-CVE-2021-41182","description":"jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.","status":"published","published":"2021-10-26T15:15:00Z","modified":"2026-03-14T08:59:48.517462Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"BIT-drupal-2021-41182","title":"XSS in the `altField` option of the Datepicker widget","description":"jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.","status":"published","published":"2024-03-06T10:54:54.794Z","modified":"2026-09-08T08:47:04.435898813Z","updated_at":"2026-11-02T15:28:29.563843Z"},{"id":"CLSA-2026-1773188127","title":"TuxCare security update for jquery-ui (5 CVEs)","description":"TuxCare rebuilt jquery-ui to address 5 CVEs. Fixed in 1.10.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:27.746326008Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1792502475","title":"TuxCare security update for jquery-ui (5 CVEs)","description":"TuxCare rebuilt jquery-ui to address 5 CVEs. Fixed in 1.10.3-tuxcare.1.","status":"published","published":"2026-10-20T13:21:15Z","modified":"2026-10-20T19:30:09.970385564Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"DLA-2889-1","title":"drupal7 - security update","status":"published","published":"2022-01-19T00:00:00Z","modified":"2026-03-09T01:20:29.641946Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3230-1","title":"jqueryui - security update","status":"published","published":"2022-12-07T00:00:00Z","modified":"2026-03-09T01:20:13.766837Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3551-1","title":"otrs2 - security update","status":"published","published":"2023-08-31T00:00:00Z","modified":"2026-03-09T01:23:23.492308Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"SUSE-SU-2022:1729-1","title":"Security update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud","description":"This update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud fixes the following issues:\n\nSecurity fixes included on the update:\n\nardana-barbican:\n\n- Update policies to protect container secret access (SOC-11621)\n- Update policies to protect secret metadata access (SOC-11620)\n\nopenstack-neutron:\n\n- CVE-2021-40085: Fixed arbitrary dnsmasq reconfiguration via extra_dhcp_opts (bsc#1189794).\n\nrubygem-sinatra:\n\n- CVE-2022-29970: Fixed path traversal possible outside of public_dir when serving static files (bsc#1199138).\n\npython-XStatic-jquery-ui:\n\n- CVE-2021-41182: Fixed XSS in the `altField` option of the Datepicker widget (bsc#1192070)\n- CVE-2021-41183: Fixed XSS in the `of` option of the `.position()` util (bsc#1192073)\n- CVE-2021-41184: Fixed XSS in `*Text` options of the Datepicker widget (bsc#1192075)\n\npython-lxml:\n\n- CVE-2018-19787: Fixed that the lxml.html.clean module does remove javascript in lxml/html/clean.py (bsc#1118088).\n- CVE-2020-27783: Fixed mXSS due to the use of improper parser (bsc#1179534).\n- CVE-2021-28957: Fixed missing input sanitization for formaction HTML5 attributes that may have led to XSS (bsc#1184177).\n- CVE-2021-43818: Fixed HTML Cleaner that allowed crafted and SVG embedded scripts to pass through (bsc#1193752).\n\nopenstack-barbican:\n\n- CVE-2022-23451: Disallows authenticated users to add/modify/delete arbitrary metadata on any secret (bsc#1194952).\n- CVE-2022-23452: Disallows anyone with an admin role to add their secrets to a different project's containers (bsc#1194954).\n\ngrafana:\n\n- CVE-2021-44716: Fixed net/http: limit growth of header canonicalization cache (bsc#1193597).\n\nopenstack-keystone:\n\n- CVE-2021-38155: Fixed information disclosure during account locking (bsc#1189390).\n\nNon-security fixes included on the update:\n\nChanges in ardana-barbican:\n- Update to version 9.0+git.1644879908.8a641c1:\n  * Update policies to protect container secret access (SOC-11621)\n\n- Update to version 9.0+git.1643052417.9a3348e:\n  * update policies to protect secret metadata access (SOC-11620)\n\nChanges in grafana:\n- Add CVE-2021-43813.patch (bsc#1193688, CVE-2021-43813)\n  * directory traversal vulnerability for .md files \n\n- Bump Go to 1.16 (bsc#1193597, CVE-2021-44716)\n  * Fix Go net/http: limit growth of header canonicalization cache\n\nChanges in openstack-barbican:\n- Add patches (0001-Fix-RBAC-and-ACL-access-for-managing-secret-containe.patch\n  and 0001-Fix-policy-for-adding-a-secret-to-a-container.patch) to fix\n  the legacy policy rules for adding a secret to a container and removing\n  a secret from a container. bsc#1194954,CVE-2022-23452\n\n- Add patch (0001-Fix-secret-metadata-access-rules.patch) to fix the\n  legacy policy rules for accessing secret metadata by checking that\n  the user making the request is authenticated for the project that\n  owns the secret. bsc#1194952,CVE-2022-23451\n\nChanges in openstack-cinder:\n- Update to version cinder-13.0.10.dev24:\n  * Correct group:reset\\_group\\_snapshot\\_status policy\n\nChanges in openstack-cinder:\n- Update to version cinder-13.0.10.dev24:\n  * Correct group:reset\\_group\\_snapshot\\_status policy\n\nChanges in openstack-heat-gbp:\n- Update to version group-based-policy-automation-14.0.1.dev4:\n  * Add support for yoga\n\n- Update to version group-based-policy-automation-14.0.1.dev3:\n  * Python2/3 compatibility fixes\n\n- Update to version group-based-policy-automation-14.0.1.dev2:\n  * Add support for xena\n\n- Update to version group-based-policy-automation-14.0.1.dev1:\n  * Remove py27 from gate jobs\n  14.0.0\n\nChanges in openstack-horizon-plugin-gbp-ui:\n- Update to version group-based-policy-ui-14.0.1.dev3:\n  * Add support for yoga\n\n- Update to version group-based-policy-ui-14.0.1.dev2:\n  * Python2/3 compatibility changes\n\n- Update to version group-based-policy-ui-14.0.1.dev1:\n  * Add support for xena\n  14.0.0\n\nChanges in openstack-ironic:\n- Update to version ironic-11.1.5.dev18:\n  * Cleanup stable/rocky legacy jobs\n\nChanges in openstack-ironic:\n- Update to version ironic-11.1.5.dev18:\n  * Cleanup stable/rocky legacy jobs\n\nChanges in openstack-keystone:\n- Update to version keystone-14.2.1.dev9:\n  * Delete system role assignments from system\\_assignment table\n\nChanges in openstack-keystone:\n- Add patch (0001-Hide-AccountLocked-exception-from-end-users.patch) to fix\n  the problem where AccountLocked exception discloses sensitive information.\n  bsc#1189390,CVE-2021-38155\n\n- Update to version keystone-14.2.1.dev9:\n  * Delete system role assignments from system\\_assignment table\n\nChanges in openstack-neutron-gbp:\n- Update to version group-based-policy-14.0.1.dev33:\n  * Populate network mtu for erspan\n\n- Update to version group-based-policy-14.0.1.dev32:\n  * ERSPAN config error when Openstack port is created in a different project than network it belongs to\n  2014.2.rc1\n\n- Update to version group-based-policy-14.0.1.dev31:\n  * Python2/3 compatibility fixes\n  2014.2.0rc1\n\n- Update to version group-based-policy-14.0.1.dev29:\n  * Fix oslo\\_i18n usage\n\n- Update to version group-based-policy-14.0.1.dev27:\n  * Update mechanism\\_driver cache\n  2014.2.rc1\n\n- Update to version group-based-policy-14.0.1.dev26:\n  * Add support for xena\n\n- Update to version group-based-policy-14.0.1.dev24:\n  * update\\_floatingip\\_status\\_while\\_deleting\\_the\\_vm\n\n- Update to version group-based-policy-14.0.1.dev22:\n  * Updating host id by appending pid in existing host id\n  2014.2.0rc1\n\n- Update to version group-based-policy-14.0.1.dev20:\n  * Revert 'Add workaround to get\\_subnets'\n\nChanges in python-lxml:\n- Fix bsc#1179534 (CVE-2020-27783)\n  mXSS due to the use of improper parser \n  Patch files: 0001-CVE-2020-27783.patch 0002-CVE-2020-27783.patch\n- Fix bsc#1118088 (CVE-2018-19787)\n  lxml/html/clean.py in the lxml.html.clean module does not remove\n  javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks\n  Patch file: 0001-CVE-2018-19787.patch\n- Fix bsc#1184177 (CVE-2021-28957)\n  missing input sanitization for formaction HTML5 attributes may lead to XSS\n  Patch file: 0001-CVE-2021-28957.patch\n- Fix bsc#1193752 (CVE-2021-43818)\n  Cleaner: Remove SVG image data URLs since they can embed script content.\n  Reported as GHSL-2021-1037 and GHSL-2021-1038 \n  Patch files 0001-CVE-2021-43818.patch 0002-CVE-2021-43818.patch\n\nChanges in openstack-neutron-doc:\n- Update to version neutron-13.0.8.dev206:\n  * Wait longer before deleting DPDK vhu trunk bridges\n\n- Update to version neutron-13.0.8.dev205:\n  * Do no use '--strict' for OF deletion in TRANSIENT\\_TABLE\n\n- Update to version neutron-13.0.8.dev203:\n  * Populate self.floating\\_ips\\_dict using 'ip rule' information\n\n- Update to version neutron-13.0.8.dev201:\n  * [Functional] Wait for the initial state of ha router before test\n  * Don't setup bridge controller if it is already set\n\n- Update to version neutron-13.0.8.dev198:\n  * Remove dhcp\\_extra\\_opt name after first newline character\n\n- Update to version neutron-13.0.8.dev196:\n  * [L3] Use processing queue for network update events\n  * Add extra logs to the network update callback in L3 agent\n\n- Update to version neutron-13.0.8.dev192:\n  * Remove dhcp\\_extra\\_opt value after first newline character\n\n- Update to version neutron-13.0.8.dev190:\n  * Don't use singleton in routes.middleware.RoutesMiddleware\n\n- Update to version neutron-13.0.8.dev189:\n  * Fix notify listener syntax for SEGMENT\\_HOST\\_MAPPING\n\n- Update to version neutron-13.0.8.dev188:\n  * Clean port forwarding cache when router is DOWN\n\n- Update to version neutron-13.0.8.dev186:\n  * Remove FIP agent's gw port when L3 agent is deleted\n\n- Update to version neutron-13.0.8.dev184:\n  * Force to close http connection after notify about HA router status\n\n- Update to version neutron-13.0.8.dev183:\n  * Don't configure dnsmasq entries for 'network' ports\n\n- Update to version neutron-13.0.8.dev181:\n  * Exclude fallback tunnel devices from netns cleanup\n\n- Update to version neutron-13.0.8.dev180:\n  * [DVR] Send allowed address pairs info to the L3 agents\n  * designate: allow PTR zone creation to fail\n  * Don't try to create default SG when security groups are disabled\n\n- Update to version neutron-13.0.8.dev174:\n  * Fix update of trunk subports during live migration\n\n- Update to version neutron-13.0.8.dev172:\n  * [ovs fw] Restrict IPv6 NA and DHCP(v6) IP and MAC source addresses\n\n- Update to version neutron-13.0.8.dev170:\n  * Call install\\_ingress\\_direct\\_goto\\_flows() when ovs restarts\n\n- Update to version neutron-13.0.8.dev168:\n  * Fix multicast traffic with IGMP snooping enabled\n\n- Update to version neutron-13.0.8.dev166:\n  * Fix OVS conjunctive IP flows cleanup\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev206:\n  * Wait longer before deleting DPDK vhu trunk bridges\n\n- Update to version neutron-13.0.8.dev205:\n  * Do no use '--strict' for OF deletion in TRANSIENT\\_TABLE\n\n- Update to version neutron-13.0.8.dev203:\n  * Populate self.floating\\_ips\\_dict using 'ip rule' information\n\n- Update to version neutron-13.0.8.dev201:\n  * [Functional] Wait for the initial state of ha router before test\n  * Don't setup bridge controller if it is already set\n\n- Update to version neutron-13.0.8.dev198:\n  * Remove dhcp\\_extra\\_opt name after first newline character\n\n- Update to version neutron-13.0.8.dev196:\n  * [L3] Use processing queue for network update events\n  * Add extra logs to the network update callback in L3 agent\n\n- Remove cve-2021-40085-stable-rocky.patch (merged upstream)\n\n- Update to version neutron-13.0.8.dev192:\n  * Remove dhcp\\_extra\\_opt value after first newline character\n\n- Update to version neutron-13.0.8.dev190:\n  * Don't use singleton in routes.middleware.RoutesMiddleware\n\n- Update to version neutron-13.0.8.dev189:\n  * Fix notify listener syntax for SEGMENT\\_HOST\\_MAPPING\n\n- Add cve-2021-40085-stable-rocky.patch (bsc#1189794, CVE-2021-40085) \n  * Remove dhcp_extra_opt value after first newline character\n\n- Update to version neutron-13.0.8.dev188:\n  * Clean port forwarding cache when router is DOWN\n\n- Update to version neutron-13.0.8.dev186:\n  * Remove FIP agent's gw port when L3 agent is deleted\n\n- Update to version neutron-13.0.8.dev184:\n  * Force to close http connection after notify about HA router status\n\n- Update to version neutron-13.0.8.dev183:\n  * Don't configure dnsmasq entries for 'network' ports\n\n- Update to version neutron-13.0.8.dev181:\n  * Exclude fallback tunnel devices from netns cleanup\n\n- Update to version neutron-13.0.8.dev180:\n  * [DVR] Send allowed address pairs info to the L3 agents\n  * designate: allow PTR zone creation to fail\n  * Don't try to create default SG when security groups are disabled\n\n- Update to version neutron-13.0.8.dev174:\n  * Fix update of trunk subports during live migration\n\n- Update to version neutron-13.0.8.dev172:\n  * [ovs fw] Restrict IPv6 NA and DHCP(v6) IP and MAC source addresses\n\n- Update to version neutron-13.0.8.dev170:\n  * Call install\\_ingress\\_direct\\_goto\\_flows() when ovs restarts\n\n- Update to version neutron-13.0.8.dev168:\n  * Fix multicast traffic with IGMP snooping enabled\n\n- Update to version neutron-13.0.8.dev166:\n  * Fix OVS conjunctive IP flows cleanup\n\nChanges in python-Pillow:\n- Add 030-CVE-2022-22817.patch\n   * From upstream, backported\n   * Fixes CVE-2022-22817, bsc#1194521 \n   * test from upstream updated for python2\n\n- Add 028-CVE-2022-22815.patch\n   * From upstream, backported\n   * Fixes CVE-2022-22815, bsc#1194552\n- Add 029-CVE-2022-22816.patch\n   * From upstream, backported\n   * Fixes CVE-2022-22816, bsc#1194551\n\nChanges in python-XStatic-jquery-ui:\n- Update to version 1.13.0.1 (bsc#1192070, CVE-2021-41182, bsc#1192073,\n  CVE-2021-41184, bsc#1192075,  CVE-2021-41183)\n    * Fix XSS in the altField option of the Datepicker widget \n     (CVE-2021-41182)\n    * Fix XSS in *Text options of the Datepicker widget\n     (CVE-2021-41183)\n    * Fix XSS in the of option of the .position() util\n      (CVE-2021-41184)\n    * Drop support for Query 1.7\n    * Accordion: allow function parameter for selecting header\n      elements\n    * Datepicker: add optional onUpdateDatepicker callback\n\nChanges in release-notes-suse-openstack-cloud:\n- Update to version 9.20220413:\n  * Update release notes to indicate support for SES7\n- Update to version 9.20220112:\n  * Add reference to keystone bcrypt issue to known limitations (bsc#1186380)\n\nChanges in rubygem-sinatra:\n- Add CVE-2022-29970.patch (bsc#1199138, CVE-2022-29970)\n\n  ","status":"published","published":"2022-05-18T14:55:52Z","modified":"2026-02-04T03:56:30.500919Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-6419-1","title":"jqueryui vulnerabilities","description":"Hong Phat Ly discovered that jQuery UI did not properly manage parameters\nfrom untrusted sources, which could lead to arbitrary web script or HTML\ncode injection. A remote attacker could possibly use this issue to perform\na cross-site scripting (XSS) attack. This issue only affected\nUbuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-7103)\n\nEsben Sparre Andreasen discovered that jQuery UI did not properly handle\nvalues from untrusted sources in the Datepicker widget. A remote attacker\ncould possibly use this issue to perform a cross-site scripting (XSS)\nattack and execute arbitrary code. This issue only affected\nUbuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n(CVE-2021-41182, CVE-2021-41183)\n\nIt was discovered that jQuery UI did not properly validate values from\nuntrusted sources. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. This issue only affected\nUbuntu 20.04 LTS. (CVE-2021-41184)\n\nIt was discovered that the jQuery UI checkboxradio widget did not properly\ndecode certain values from HTML entities. An attacker could possibly use\nthis issue to perform a cross-site scripting (XSS) attack and cause a\ndenial of service or execute arbitrary code. This issue only affected\nUbuntu 20.04 LTS. (CVE-2022-31160)\n","status":"published","published":"2023-10-05T12:36:27Z","modified":"2026-06-29T13:50:58.084523349Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}