CVEvulnerability
CVE-2013-6780
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-11-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via the allowedDomain parameter.
Affected configurations
• yahoo yui 2.5.0
• yahoo yui 2.5.1
• yahoo yui 2.5.2
• yahoo yui 2.6.0
• yahoo yui 2.7.0
• yahoo yui 2.8.0
• yahoo yui 2.8.1
• yahoo yui 2.8.2
• yahoo yui 2.9.0
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://openwall.com/lists/oss-security/2013/11/25/1 openwall.com
- http://packetstormsecurity.com/files/130527/Cisco-Ironport-AsyncOS-Cross-Site-Scripting.html Exploit
- http://www.securitytracker.com/id/1029528 www.securitytracker.com
- https://yuilibrary.com/support/20131111-vulnerability/ Exploit, Vendor Advisory
- http://openwall.com/lists/oss-security/2013/11/25/1 openwall.com
- http://packetstormsecurity.com/files/130527/Cisco-Ironport-AsyncOS-Cross-Site-Scripting.html Exploit
- http://www.securitytracker.com/id/1029528 www.securitytracker.com
- https://yuilibrary.com/support/20131111-vulnerability/ Exploit, Vendor Advisory