CVE-2016-7103

Published: Mar 15, 2017Modified: May 13, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.

Affected (23)

Products: Jqueryui: Jquery Ui · Oracle: Application Express, Business Intelligence, Hospitality Cruise Fleet Management, Oss Support Tools, Primavera Unifier, Siebel Ui Framework, Weblogic Server · Fedoraproject: Fedora · +4 more

Show all products

1 product

7 products

Business Intelligence

Hospitality Cruise Fleet Management

1 product

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jqueryui Jquery Ui	From 1.10.0 to 1.11.4

Configuration B

13 vulnerable

Vulnerable Software	Affected Versions
Oracle Application Express	Before 19.1
Oracle Business Intelligence	Version 12.2.1.3.0
Oracle Business Intelligence	Version 12.2.1.4.0
Oracle Hospitality Cruise Fleet Management	Version 9.0.11
Oracle Oss Support Tools	Before 2.12.42
Oracle Oss Support Tools	Version 2.12.42
Oracle Primavera Unifier	From 16.0 to 16.2
Oracle Primavera Unifier	From 17.0 to 17.12.4
Oracle Primavera Unifier	From 18.0 to 18.8.4
Oracle Siebel Ui Framework	Up to 21.2
Oracle Weblogic Server	Version 10.3.6.0.0
Oracle Weblogic Server	Version 12.1.3.0.0
Oracle Weblogic Server	Version 12.2.1.3.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 35
Fedoraproject Fedora	Version 36

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Snapcenter	All versions

Configuration E

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Openstack	Version 7.0
Redhat Openstack	Version 8
Redhat Openstack	Version 9

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Juniper Junos	Version 21.2

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (56)

http://rhn.redhat.com/errata/RHSA-2016-2932.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2933.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2017-0161.html

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: cve@mitre.org

PatchThird Party Advisory

http://www.securityfocus.com/bid/104823

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

https://github.com/jquery/api.jqueryui.com/issues/281

Source: cve@mitre.org

ExploitIssue TrackingPatchThird Party Advisory

https://github.com/jquery/jquery-ui/commit/9644e7bae9116edaf8d37c5b38cb32b892f10ff6

Source: cve@mitre.org

PatchThird Party Advisory

https://jqueryui.com/changelog/1.12.0/

Source: cve@mitre.org

Release NotesVendor Advisory

https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2I4UHPIW26FIALH7GGZ3IYUUA53VOOJ/

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://nodesecurity.io/advisories/127

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20190416-0007/

Source: cve@mitre.org

Third Party Advisory

https://www.drupal.org/sa-core-2022-002

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.tenable.com/security/tns-2016-19

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2932.html