CVE-2021-41183

Published: Oct 26, 2021Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.

Affected (46)

Products: Jqueryui: Jquery Ui · Fedoraproject: Fedora · Netapp: H300s Firmware, H500s Firmware, H700s Firmware, H300e Firmware, H500e Firmware, H700e Firmware, H410s Firmware, H410c Firmware · +4 more

Show all products

1 product

1 product

8 products

1 product

1 product

15 products

Big Data Spatial And Graph

Communications Interactive Session Recorder

Communications Operations Monitor

Hospitality Inventory Management

Hospitality Suite8

Jd Edwards Enterpriseone Tools

Mysql Enterprise Monitor

Peoplesoft Enterprise Peopletools

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jqueryui Jquery Ui	Before 1.13.0

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 33
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35
Fedoraproject Fedora	Version 36

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300s Firmware	All versions

Running on/with	Platform Versions
Netapp H300s	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500s Firmware	All versions

Running on/with	Platform Versions
Netapp H500s	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700s Firmware	All versions

Running on/with	Platform Versions
Netapp H700s	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300e Firmware	All versions

Running on/with	Platform Versions
Netapp H300e	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500e Firmware	All versions

Running on/with	Platform Versions
Netapp H500e	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700e Firmware	All versions

Running on/with	Platform Versions
Netapp H700e	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410s Firmware	All versions

Running on/with	Platform Versions
Netapp H410s	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410c Firmware	All versions

Running on/with	Platform Versions
Netapp H410c	All versions

Configuration K

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration L

3 vulnerable

Vulnerable Software	Affected Versions
Drupal Drupal	From 7.0 to 7.86
Drupal Drupal	From 9.2.0 to 9.2.11
Drupal Drupal	From 9.3.0 to 9.3.3

Configuration M

28 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Plm	Version 9.3.6
Oracle Application Express	Before 22.1.1
Oracle Banking Platform	Version 2.12.0
Oracle Banking Platform	Version 2.9.0
Oracle Big Data Spatial And Graph	Before 23.1
Oracle Big Data Spatial And Graph	Version 23.1
Oracle Communications Interactive Session Recorder	Version 6.4
Oracle Communications Operations Monitor	Version 4.3
Oracle Communications Operations Monitor	Version 4.4
Oracle Communications Operations Monitor	Version 5.0
Oracle Hospitality Inventory Management	Version 9.1.0
Oracle Hospitality Suite8	From 8.11.0 to 11.14.0
Oracle Hospitality Suite8	Version 8.10.2
Oracle Jd Edwards Enterpriseone Tools	Up to 9.2.6.3
Oracle Mysql Enterprise Monitor	Up to 8.0.29
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Peoplesoft Enterprise Peopletools	Version 8.59
Oracle Policy Automation	From 12.2.0 to 12.2.5
Oracle Primavera Gateway	From 17.7 to 17.12
Oracle Primavera Gateway	Version 18.8.0
Oracle Primavera Gateway	Version 19.12.0
Oracle Primavera Gateway	Version 20.12.0
Oracle Primavera Gateway	Version 21.12.0
Oracle Rest Data Services	Before 22.1.1
Oracle Rest Data Services	Version 22.1.1
Oracle Weblogic Server	Version 12.2.1.3.0
Oracle Weblogic Server	Version 12.2.1.4.0
Oracle Weblogic Server	Version 14.1.1.0.0

Configuration N

1 vulnerable

Vulnerable Software	Affected Versions
Tenable Tenable.sc	Before 5.21.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.