[GHSA-h6gj-6jjq-h8g9] jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label #5757
Conversation
|
Hi there @mgol! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
Pull Request Overview
This PR updates the advisory for the jQuery UI XSS vulnerability by revising package ecosystems, names, and fixed version ranges to accurately reflect the patched vulnerabilities.
- Updated the modified timestamp.
- Swapped package ecosystem and name assignments between RubyGems and NuGet entries.
- Updated the fixed version numbers and added a database-specific field for the RubyGems entry.
Comments suppressed due to low confidence (2)
advisories/github-reviewed/2022/07/GHSA-h6gj-6jjq-h8g9/GHSA-h6gj-6jjq-h8g9.json:58
- The package details have been swapped between RubyGems and NuGet; please confirm that the new assignments correctly reflect the intended vulnerability mapping and that the package names are accurate for each ecosystem.
"ecosystem": "NuGet",
advisories/github-reviewed/2022/07/GHSA-h6gj-6jjq-h8g9/GHSA-h6gj-6jjq-h8g9.json:88
- The fixed version for the RubyGems entry is updated to '8.0.0' while the NuGet entry uses '1.13.2'; please verify that these differing version numbers are correct according to each ecosystem's versioning scheme.
"fixed": "8.0.0"
|
@mgol I used the "See something to contribute? Suggest improvements for this vulnerability." link on the advisory page which opens up a form; the only thing I did there is added 8.0.0 to jquery-ui-rails' "Patched versions" field. I guess the form's parameter parsing doesn't preserve package list. |
befd568
into
Borzik/advisory-improvement-5757
|
Hi @Borzik! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
Updates
Comments
jquery-ui-rails has been updated to use jquery-ui 1.14.1 which does not have this vulnerability.