Rule Definition
While some known vulnerabilities lead to only minor impacts, some of the largest breaches to date have relied on exploiting known vulnerabilities in components. Depending on the assets you are protecting, perhaps this risk should be at the top of the list. Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option. This rule has been listed as CVE-2010-5312 in the CVE registry.

Remediation
Do not use .dialog() or update the version of jQuery

Violation Code Sample

// version of library vulnerable
<script src="https://code.jquery.com/ui/1.9.1/jquery-ui.js"></script> 
...
$('<div>Hi</div>').dialog({title:'<script type="text/javascript">alert("XSS");</script>"});
..

Fixed Code Sample

// version of library is NOT vulnerable
<script src="https://code.jquery.com/ui/1.10.0/jquery-ui.js"></script> 
...
$('<div>Hi</div>').dialog({title:'<script type="text/javascript">alert("XSS");</script>"});
..

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5312