VulnerabilityModified
CVE-2012-6662
Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly…
MEDIUM 4.3EPSS 6.46%
Does this matter?
Lower severity and a low EPSS score (6.46%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 6.46% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- redhat/enterprise linux desktop · redhat/enterprise linux hpc node · redhat/enterprise linux server · redhat/enterprise linux workstation · jqueryui/jquery ui
- Source
- cve@mitre.org
References
- http://bugs.jqueryui.com/ticket/8859Issue Tracking, Vendor Advisory
- http://bugs.jqueryui.com/ticket/8861Issue Tracking, Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0442.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1462.html
- http://seclists.org/oss-sec/2014/q4/613Third Party Advisory, VDB Entry
- http://seclists.org/oss-sec/2014/q4/616Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/71107
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98697
- https://github.com/jquery/jquery-ui/commit/5fee6fd5000072ff32f2d65b6451f39af9e0e39eIssue Tracking, Patch, Third Party Advisory
- https://github.com/jquery/jquery-ui/commit/f2854408cce7e4b7fc6bf8676761904af9c96bdeIssue Tracking, Patch, Third Party Advisory
- https://github.com/jquery/jquery/issues/2432
- http://bugs.jqueryui.com/ticket/8859Issue Tracking, Vendor Advisory
- http://bugs.jqueryui.com/ticket/8861Issue Tracking, Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0442.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1462.html
- http://seclists.org/oss-sec/2014/q4/613Third Party Advisory, VDB Entry
- http://seclists.org/oss-sec/2014/q4/616Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/71107
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98697
- https://github.com/jquery/jquery-ui/commit/5fee6fd5000072ff32f2d65b6451f39af9e0e39eIssue Tracking, Patch, Third Party Advisory
- https://github.com/jquery/jquery-ui/commit/f2854408cce7e4b7fc6bf8676761904af9c96bdeIssue Tracking, Patch, Third Party Advisory
- https://github.com/jquery/jquery/issues/2432
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.