漏洞标题
jQuery UI 在更新具有HTML初始文本标签的复选框复选框时可能存在XSS漏洞。
漏洞描述信息
当使用类似HTML的初始文本标签刷新jQuery UI中的checkboxradio时，可能存在XSS漏洞
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
漏洞类别
N/A
漏洞标题
jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label
漏洞描述信息
jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
漏洞类别
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
漏洞标题
jQuery 跨站脚本漏洞
漏洞描述信息
jQuery是美国John Resig个人开发者的一套开源、跨浏览器的JavaScript库。该库简化了HTML与JavaScript之间的操作，并具有模块化、插件扩展等特点。 jQuery UI 1.13.2 之前版本存在跨站脚本漏洞，该漏洞源于容易受到跨站点脚本的攻击。
CVSS信息
N/A
漏洞类别
跨站脚本