● CVE — Medium
CVE-2021-41182
Vendordebian, fedoraproject, netapp, oracle, drupalProductdebian linux, fedora, h300e firmware, h300s firmware, h410c firmware, h410s firmware, h500e firmware, h500s firmware, h700e firmware, h700s firmware, agile product lifecycle management, primavera unifier, weblogic server, application express, banking platform, communications interactive session recorder, drupal, hospitality suite8, agile plm, mysql enterprise monitor, communications operations monitor, tenable.sc, big data spatial and graph, hospitality inventory management, jquery ui, hospitality materials controlDiscoveredOct 26, 2021UpdatedAug 25, 2026
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. A workaround is to not accept the value of the altField option from untrusted sources.