CVE-2013-6780 Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via the allowedDomai...
MediumCVSS 4.3
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via the allowedDomain parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yahoo yui | = 2.5.0 | No fix listed |
| yahoo yui | = 2.5.1 | No fix listed |
| yahoo yui | = 2.5.2 | No fix listed |
| yahoo yui | = 2.6.0 | No fix listed |
| yahoo yui | = 2.7.0 | No fix listed |
| yahoo yui | = 2.8.0 | No fix listed |
| yahoo yui | = 2.8.1 | No fix listed |
| yahoo yui | = 2.8.2 | No fix listed |
| yahoo yui | = 2.9.0 | No fix listed |
References
- [oss-security] 20131125 Moodle security notifications public mailing-list
- packetstormsecurity.com exploit
- 1029528 vdb-entry
- yuilibrary.com exploit vendor-advisory