CVE-2010-4207

The CVE-2010-4207 entry concerns a Cross-site Scripting (XSS) flaw in the YUI Flash-based Chart infrastructure. Affected are YUI library versions 2.4.0 through 2.8.1 (and related charts.swf usage in Bugzilla, Moodle, etc.). Root cause stated in sources is improper validation in the Flash componen...

CVE-2010-4208

CVE-2010-4208 is an XSS vulnerability in the Flash component infrastructure of YUI, specifically in the uploader.swf used by YUI 2.5.0 through 2.8.1 (and related references indicate continued concern up to 2.9.0). The root cause is improper validation in the Flash uploader assets, allowing remote...

CVE-2010-4209

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.8.1, as used in Bugzilla 3.7.1 through 3.7.3 and 4.1, allows remote attackers to inject arbitrary web script or HTML via vectors related to swfstore/swfstore.swf...

CVE-2010-4208: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to uploader/assets/uploader.swf...

CVE-2010-4207: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to charts/assets/charts.swf...

httpd: Expect header XSS

httpprotocol.c in 1 IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and 2 Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site...