CVE-2016-7103
Medium
Low
Medium
High
Critical
6.1
CVSS Score
Vulnerability Description
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
N
Attack Complexity
L
Privileges Required
N
User Interaction
R
Scope
C
Confidentiality
L
Integrity
L
Availability
N
Known Affected Software
72 configuration(s) from 7 vendor(s)
debian_linux
Version:
9.0
CPE:
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
fedora
Version:
30
CPE:
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
fedora
Version:
35
CPE:
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
fedora
Version:
36
CPE:
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
jquery_ui
Version:
1.11.3
CPE:
cpe:2.3:a:jqueryui:jquery_ui:1.11.3:*:*:*:*:jquery:*:*
jquery_ui
Version:
1.11.1
CPE:
cpe:2.3:a:jqueryui:jquery_ui:1.11.1:*:*:*:*:jquery:*:*
jquery_ui
Version:
1.10.2
CPE:
cpe:2.3:a:jqueryui:jquery_ui:1.10.2:*:*:*:*:jquery:*:*
jquery_ui
Version:
1.11.0
CPE:
cpe:2.3:a:jqueryui:jquery_ui:1.11.0:rc1:*:*:*:jquery:*:*
jquery_ui
Version:
1.10.1
CPE:
cpe:2.3:a:jqueryui:jquery_ui:1.10.1:*:*:*:*:jquery:*:*
jquery_ui
Version:
1.11.2
CPE:
cpe:2.3:a:jqueryui:jquery_ui:1.11.2:*:*:*:*:jquery:*:*
jquery_ui
Version:
1.11.4
CPE:
cpe:2.3:a:jqueryui:jquery_ui:1.11.4:*:*:*:*:jquery:*:*
jquery_ui
Version:
1.10.0
CPE:
cpe:2.3:a:jqueryui:jquery_ui:1.10.0:beta1:*:*:*:jquery:*:*
jquery_ui
Version:
1.10.4
CPE:
cpe:2.3:a:jqueryui:jquery_ui:1.10.4:*:*:*:*:jquery:*:*
jquery_ui
Version:
1.10.3
CPE:
cpe:2.3:a:jqueryui:jquery_ui:1.10.3:*:*:*:*:jquery:*:*
junos
Version:
21.2
CPE:
cpe:2.3:o:juniper:junos:21.2:r3-s8:*:*:*:*:*:*
snapcenter
Version:
-
CPE:
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
application_express
Version:
4.0
CPE:
cpe:2.3:a:oracle:application_express:4.0:*:*:*:*:*:*:*
application_express
Version:
3.0
CPE:
cpe:2.3:a:oracle:application_express:3.0:*:*:*:*:*:*:*
primavera_unifier
Version:
18.3
CPE:
cpe:2.3:a:oracle:primavera_unifier:18.3:*:*:*:*:*:*:*
primavera_unifier
Version:
17.10
CPE:
cpe:2.3:a:oracle:primavera_unifier:17.10:*:*:*:*:*:*:*
primavera_unifier
Version:
18.7
CPE:
cpe:2.3:a:oracle:primavera_unifier:18.7:*:*:*:*:*:*:*
application_express
Version:
5.1.4.00.08
CPE:
cpe:2.3:a:oracle:application_express:5.1.4.00.08:*:*:*:*:*:*:*
primavera_unifier
Version:
17.12.4
CPE:
cpe:2.3:a:oracle:primavera_unifier:17.12.4:*:*:*:*:*:*:*
primavera_unifier
Version:
16.0
CPE:
cpe:2.3:a:oracle:primavera_unifier:16.0:*:*:*:*:*:*:*
application_express
Version:
3.2
CPE:
cpe:2.3:a:oracle:application_express:3.2:*:*:*:*:*:*:*
primavera_unifier
Version:
17.9
CPE:
cpe:2.3:a:oracle:primavera_unifier:17.9:*:*:*:*:*:*:*
business_intelligence
Version:
12.2.1.3.0
CPE:
cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*
primavera_unifier
Version:
16.2
CPE:
cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
oss_support_tools
Version:
2.12.42
CPE:
cpe:2.3:a:oracle:oss_support_tools:2.12.42:*:*:*:*:*:*:*
application_express
Version:
5.1.2.00.09
CPE:
cpe:2.3:a:oracle:application_express:5.1.2.00.09:*:*:*:*:*:*:*
primavera_unifier
Version:
17.1
CPE:
cpe:2.3:a:oracle:primavera_unifier:17.1:*:*:*:*:*:*:*
application_express
Version:
18.2
CPE:
cpe:2.3:a:oracle:application_express:18.2:*:*:*:*:*:*:*
primavera_unifier
Version:
17.11
CPE:
cpe:2.3:a:oracle:primavera_unifier:17.11:*:*:*:*:*:*:*
primavera_unifier
Version:
17.5
CPE:
cpe:2.3:a:oracle:primavera_unifier:17.5:*:*:*:*:*:*:*
primavera_unifier
Version:
18.6
CPE:
cpe:2.3:a:oracle:primavera_unifier:18.6:*:*:*:*:*:*:*
primavera_unifier
Version:
18.0
CPE:
cpe:2.3:a:oracle:primavera_unifier:18.0:*:*:*:*:*:*:*
business_intelligence
Version:
12.2.1.4.0
CPE:
cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*
application_express
Version:
5.0
CPE:
cpe:2.3:a:oracle:application_express:5.0:*:*:*:*:*:*:*
application_express
Version:
4.1
CPE:
cpe:2.3:a:oracle:application_express:4.1:*:*:*:*:*:*:*
primavera_unifier
Version:
18.8.4
CPE:
cpe:2.3:a:oracle:primavera_unifier:18.8.4:*:*:*:*:*:*:*
application_express
Version:
5.1.3
CPE:
cpe:2.3:a:oracle:application_express:5.1.3:*:*:*:*:*:*:*
primavera_unifier
Version:
17.0
CPE:
cpe:2.3:a:oracle:primavera_unifier:17.0:*:*:*:*:*:*:*
primavera_unifier
Version:
17.6
CPE:
cpe:2.3:a:oracle:primavera_unifier:17.6:*:*:*:*:*:*:*
primavera_unifier
Version:
17.8
CPE:
cpe:2.3:a:oracle:primavera_unifier:17.8:*:*:*:*:*:*:*
primavera_unifier
Version:
18.4
CPE:
cpe:2.3:a:oracle:primavera_unifier:18.4:*:*:*:*:*:*:*
weblogic_server
Version:
10.3.6.0.0
CPE:
cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*
primavera_unifier
Version:
18.2
CPE:
cpe:2.3:a:oracle:primavera_unifier:18.2:*:*:*:*:*:*:*
application_express
Version:
5.1.0
CPE:
cpe:2.3:a:oracle:application_express:5.1.0:*:*:*:*:*:*:*
primavera_unifier
Version:
17.7
CPE:
cpe:2.3:a:oracle:primavera_unifier:17.7:*:*:*:*:*:*:*
primavera_unifier
Version:
17.4
CPE:
cpe:2.3:a:oracle:primavera_unifier:17.4:*:*:*:*:*:*:*
application_express
Version:
4.2
CPE:
cpe:2.3:a:oracle:application_express:4.2:*:*:*:*:*:*:*
primavera_unifier
Version:
18.8.3
CPE:
cpe:2.3:a:oracle:primavera_unifier:18.8.3:*:*:*:*:*:*:*
primavera_unifier
Version:
18.5
CPE:
cpe:2.3:a:oracle:primavera_unifier:18.5:*:*:*:*:*:*:*
application_express
Version:
5.1.3.00.05
CPE:
cpe:2.3:a:oracle:application_express:5.1.3.00.05:*:*:*:*:*:*:*
application_express
Version:
5.1.1
CPE:
cpe:2.3:a:oracle:application_express:5.1.1:*:*:*:*:*:*:*
application_express
Version:
5.1.2
CPE:
cpe:2.3:a:oracle:application_express:5.1.2:*:*:*:*:*:*:*
primavera_unifier
Version:
18.8.2
CPE:
cpe:2.3:a:oracle:primavera_unifier:18.8.2:*:*:*:*:*:*:*
application_express
Version:
5.1.4
CPE:
cpe:2.3:a:oracle:application_express:5.1.4:*:*:*:*:*:*:*
primavera_unifier
Version:
17.3
CPE:
cpe:2.3:a:oracle:primavera_unifier:17.3:*:*:*:*:*:*:*
hospitality_cruise_fleet_management
Version:
9.0.11
CPE:
cpe:2.3:a:oracle:hospitality_cruise_fleet_management:9.0.11:*:*:*:*:*:*:*
primavera_unifier
Version:
17.12
CPE:
cpe:2.3:a:oracle:primavera_unifier:17.12:*:*:*:*:*:*:*
weblogic_server
Version:
12.1.3.0.0
CPE:
cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*
primavera_unifier
Version:
16.1
CPE:
cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
primavera_unifier
Version:
18.1
CPE:
cpe:2.3:a:oracle:primavera_unifier:18.1:*:*:*:*:*:*:*
primavera_unifier
Version:
17.2
CPE:
cpe:2.3:a:oracle:primavera_unifier:17.2:*:*:*:*:*:*:*
weblogic_server
Version:
12.2.1.3.0
CPE:
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
application_express
Version:
5.0.4
CPE:
cpe:2.3:a:oracle:application_express:5.0.4:*:*:*:*:*:*:*
application_express
Version:
3.1
CPE:
cpe:2.3:a:oracle:application_express:3.1:*:*:*:*:*:*:*
primavera_unifier
Version:
18.8
CPE:
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
openstack
Version:
9
CPE:
cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*
openstack
Version:
8
CPE:
cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*
openstack
Version:
7.0
CPE:
cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*
This vulnerability affects 72 software configuration(s). Ensure you patch all affected systems.
References & Resources
-
http://rhn.redhat.com/errata/RHSA-2016-2932.htmlcve@mitre.org Third Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-2933.htmlcve@mitre.org Third Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2017-0161.htmlcve@mitre.org Third Party Advisory VDB Entry
-
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlcve@mitre.org Patch Third Party Advisory
-
http://www.securityfocus.com/bid/104823cve@mitre.org Broken Link Third Party Advisory VDB Entry
-
https://github.com/jquery/api.jqueryui.com/issues/281cve@mitre.org Exploit Issue Tracking Patch Third Party Advisory
-
https://github.com/jquery/jquery-ui/commit/9644e7bae9116edaf8d37c5b38cb32b892f10ff6cve@mitre.org Patch Third Party Advisory
-
https://jqueryui.com/changelog/1.12.0/cve@mitre.org Release Notes Vendor Advisory
-
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Ecve@mitre.org Mailing List Third Party Advisory
-
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Ecve@mitre.org Mailing List Third Party Advisory
-
https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3Ecve@mitre.org Mailing List Third Party Advisory
-
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Ecve@mitre.org Mailing List Third Party Advisory
-
https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3Ecve@mitre.org Mailing List Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2022/01/msg00014.htmlcve@mitre.org Mailing List Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2I4UHPIW26FIALH7GGZ3IYUUA53VOOJ/cve@mitre.org Mailing List Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/cve@mitre.org Mailing List Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/cve@mitre.org Mailing List Third Party Advisory
-
https://nodesecurity.io/advisories/127cve@mitre.org Third Party Advisory
-
https://security.netapp.com/advisory/ntap-20190416-0007/cve@mitre.org Third Party Advisory
-
https://www.drupal.org/sa-core-2022-002cve@mitre.org Third Party Advisory
-
https://www.oracle.com//security-alerts/cpujul2021.htmlcve@mitre.org Third Party Advisory
-
https://www.oracle.com/security-alerts/cpuApr2021.htmlcve@mitre.org Third Party Advisory
-
https://www.oracle.com/security-alerts/cpuapr2020.htmlcve@mitre.org Third Party Advisory
-
https://www.oracle.com/security-alerts/cpujan2022.htmlcve@mitre.org Third Party Advisory
-
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlcve@mitre.org Patch Third Party Advisory
-
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlcve@mitre.org Patch Third Party Advisory
-
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlcve@mitre.org Patch Third Party Advisory
-
https://www.tenable.com/security/tns-2016-19cve@mitre.org Third Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-2932.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-2933.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2017-0161.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory VDB Entry
-
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlaf854a3a-2127-422b-91ae-364da2661108 Patch Third Party Advisory
-
http://www.securityfocus.com/bid/104823af854a3a-2127-422b-91ae-364da2661108 Broken Link Third Party Advisory VDB Entry
-
https://github.com/jquery/api.jqueryui.com/issues/281af854a3a-2127-422b-91ae-364da2661108 Exploit Issue Tracking Patch Third Party Advisory
-
https://github.com/jquery/jquery-ui/commit/9644e7bae9116edaf8d37c5b38cb32b892f10ff6af854a3a-2127-422b-91ae-364da2661108 Patch Third Party Advisory
-
https://jqueryui.com/changelog/1.12.0/af854a3a-2127-422b-91ae-364da2661108 Release Notes Vendor Advisory
-
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Eaf854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Eaf854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3Eaf854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Eaf854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3Eaf854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2022/01/msg00014.htmlaf854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2I4UHPIW26FIALH7GGZ3IYUUA53VOOJ/af854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/af854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/af854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
https://nodesecurity.io/advisories/127af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://security.netapp.com/advisory/ntap-20190416-0007/af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://www.drupal.org/sa-core-2022-002af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://www.oracle.com//security-alerts/cpujul2021.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://www.oracle.com/security-alerts/cpuApr2021.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://www.oracle.com/security-alerts/cpuapr2020.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://www.oracle.com/security-alerts/cpujan2022.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlaf854a3a-2127-422b-91ae-364da2661108 Patch Third Party Advisory
-
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlaf854a3a-2127-422b-91ae-364da2661108 Patch Third Party Advisory
-
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlaf854a3a-2127-422b-91ae-364da2661108 Patch Third Party Advisory
-
https://www.tenable.com/security/tns-2016-19af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
Severity Details
6.1
out of 10.0
Medium
Weakness Type (CWE)
CWE-79
Top 25 #1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Description
- The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- Exploit Likelihood
- High
- Typical Severity
- Medium
- OWASP Top 10
- A03:2021-Injection
- Abstraction Level
- Base
Key Information
- Published Date
- March 15, 2017
