Homepage

Cross-site Scripting (XSS) The advisory has been revoked - it doesn't affect any version of package pcs-snmp  (opens in a new tab)

Threat Intelligence

EPSS
39.36% (99th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-PCSSNMP-1909568
  • published2 Nov 2021
  • disclosed25 Oct 2021
Report a new vulnerability Found a mistake?

Introduced: 25 Oct 2021

CVE-2021-41182  (opens in a new tab)
CWE-79  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcs-snmp package and not the pcs-snmp package as distributed by RHEL.

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. A workaround is to not accept the value of the altField option from untrusted sources.

References