CVE-2010-4207 Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary....
MediumCVSS 4.3
EPSS 5.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to charts/assets/charts.swf.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yahoo yui | = 2.4.0 | No fix listed |
| yahoo yui | = 2.5.0 | No fix listed |
| yahoo yui | = 2.5.1 | No fix listed |
| yahoo yui | = 2.5.2 | No fix listed |
| yahoo yui | = 2.6.0 | No fix listed |
| yahoo yui | = 2.7.0 | No fix listed |
| yahoo yui | = 2.8.0 | No fix listed |
| yahoo yui | = 2.8.1 | No fix listed |
| ubuntu/loggerhead(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/loggerhead(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/loggerhead(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/loggerhead(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- FEDORA-2010-17280 vendor-advisory
- FEDORA-2010-17274 vendor-advisory
- FEDORA-2010-17235 vendor-advisory
- SUSE-SR:2010:021 vendor-advisory
- moodle.org
- 41955 third-party-advisory vendor-advisory
- 42271 third-party-advisory
- www.bugzilla.org
- [oss-security] 20101107 Re: CVE request: moodle 1.9.10 mailing-list
- 20101103 Security Advisory for Bugzilla 3.2.8, 3.4.8, 3.6.2, and 3.7.3 mailing-list
- 44420 vdb-entry
- 1024683 vdb-entry
- ADV-2010-2878 vdb-entry vendor-advisory
- ADV-2010-2975 vdb-entry
- yuilibrary.com patch vendor-advisory