Cross site scripting

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to charts.swf, a similar issue to CVE-2010-4207...

Cross site scripting

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to uploader.swf, a similar issue to CVE-2010-4208...

UBUNTU-CVE-2012-5882

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to uploader.swf, a similar issue to CVE-2010-4208...

CVE-2012-5881

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to charts.swf, a similar issue to CVE-2010-4207...

CVE-2012-5882

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to uploader.swf, a similar issue to CVE-2010-4208...

CVE-2012-5883

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web script or HTML via vectors...

CVE-2012-5881

CVE-2012-5881 concerns a cross-site scripting (XSS) vulnerability in the YUI library’s Flash component infrastructure (charts.swf) affecting YUI versions 2.4.0–2.9.0. An attacker could inject arbitrary script/HTML via vectors related to charts.swf, allowing execution of code in a victim’s browser...

CVE-2012-5883

CVE-2012-5883 is a cross-site scripting (XSS) vulnerability in the Flash component infrastructure of YUI (versions 2.8.0–2.9.0) used by Bugzilla 3.7.x/4.0.x (before 4.0.9), 4.1.x/4.2.x (before 4.2.4), and 4.3.x/4.4.x (before 4.4rc1). The issue allows remote attackers to inject arbitrary script/HT...

CVE-2012-5881

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to charts.swf, a similar issue to CVE-2010-4207...

CVE-2012-5882

The CVE-2012-5882 entry covers an XSS vulnerability in the YUI Flash uploader infrastructure. Affected are YUI versions 2.5.0 through 2.9.0; the issue stems from the uploader.swf component, enabling remote attackers to inject arbitrary web script/HTML and execute in a victim’s browser, potentiall...

PT-2012-6162

Name of the Vulnerable Software and Affected Versions YUI versions 2.4.0 through 2.9.0 Description A cross-site scripting XSS issue exists in the Flash component infrastructure, allowing remote attackers to inject arbitrary web script or HTML via vectors related to charts.swf. This is similar to ...

PT-2012-6163

Name of the Vulnerable Software and Affected Versions YUI versions 2.5.0 through 2.9.0 Description A cross-site scripting XSS issue exists in the Flash component infrastructure, allowing remote attackers to inject arbitrary web script or HTML via vectors related to uploader.swf. This is similar t...

PT-2012-6164

Name of the Vulnerable Software and Affected Versions YUI versions 2.8.0 through 2.9.0 Bugzilla versions 3.7.x and earlier Bugzilla versions 4.0.x through 4.0.8 Bugzilla versions 4.1.x through 4.2.3 Bugzilla versions 4.3.x through 4.4rc1 Description A cross-site scripting XSS issue exists in the...

CVE-2012-5882: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to uploader.swf, a similar issue to CVE-2010-4208...

CVE-2012-5883: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web script or HTML via vectors...

CVE-2012-5881: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to charts.swf, a similar issue to CVE-2010-4207...

bugzilla -- multiple vulnerabilities

A Bugzilla Security Advisory reports: The following security issues have been discovered in Bugzilla: Information Leak If the visibility of a custom field is controlled by a product or a component of a product you cannot see, their names are disclosed in the JavaScript code generated for this...

YUI JavaScript library -- JavaScript injection exploits in Flash components

The YUI team reports: Vulnerability in YUI 2.4.0 through YUI 2.9.0 A XSS vulnerability has been discovered in some YUI 2 .swf files from versions 2.4.0 through 2.9.0. This defect allows JavaScript injection exploits to be created against domains that host affected YUI .swf files. If your site loa...

CVE-2012-4403

theme/yuicombo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response...

PT-2012-5377

Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.x through 2.3.1 Description The issue concerns the construction of error responses for the drag-and-drop script in the theme/yui combo.php file. This allows remote attackers to obtain the installation path by sending a...