The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6419-1 advisory.

    Hong Phat Ly discovered that jQuery UI did not properly manage parameters from untrusted sources, which     could lead to arbitrary web script or HTML code injection. A remote attacker could possibly use this issue     to perform a cross-site scripting (XSS) attack. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04     LTS. (CVE-2016-7103)

    Esben Sparre Andreasen discovered that jQuery UI did not properly handle values from untrusted sources in     the Datepicker widget. A remote attacker could possibly use this issue to perform a cross-site scripting     (XSS) attack and execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,     Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-41182, CVE-2021-41183)

    It was discovered that jQuery UI did not properly validate values from untrusted sources. An attacker     could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only     affected Ubuntu 20.04 LTS. (CVE-2021-41184)

    It was discovered that the jQuery UI checkboxradio widget did not properly decode certain values from HTML     entities. An attacker could possibly use this issue to perform a cross-site scripting (XSS) attack and     cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS.
    (CVE-2022-31160)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : jQuery UI vulnerabilities (USN-6419-1)

medium Nessus Plugin ID 182583

Version 1.3

Version 1.2

Version 1.1

Version 1.1

Version 1.0

Version 1.3 Aug 28, 2024, 7:43 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408281943
Version 1.2 Oct 13, 2023, 11:16 PM Detection Plugin metadata Plugin Feed: 202310132316
Version 1.1 Oct 5, 2023, 10:10 PM CEA reference Plugin Feed: 202310052210
Version 1.1 Oct 13, 2023, 9:18 PM Plugin metadata Detection Plugin Feed: 202310132118
Version 1.0 Oct 5, 2023, 4:14 PM New Plugin Feed: 202310051614