CVE-2010-2273

Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before
1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and
1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or
HTML via unspecified vectors, possibly related to
dojo/resources/iframe_history.html, dojox/av/FLAudio.js,
dojox/av/FLVideo.js, dojox/av/resources/audio.swf,
dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and
util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl
and (2) testUrl parameters to util/doh/runner.html.