GitHub Advisoryadvisory · npm

GHSA-jjg9-mf63-vqrp Cross-site scripting in yui 2.4.0

MEDIUM Published 2022-05-17 Modified 2024-01-09 Official page ↗
Aliases
CVE-2012-5881
Ecosystem
npm
Packages
yui2
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-01-09

Affected packages

• npm yui2: >= 2.4.0, <= 2.9.0 (no fix yet)

Description

Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to charts.swf, a similar issue to CVE-2010-4207.

Related

Alias · CVE (1)

  • CVE-2012-5881 Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References