Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to charts/assets/charts.swf.
CVSS Details
- CVSS 3.1 Base Score: 4.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade yahoo-ui | Dec 10, 2025 | Dec 15, 2010 |
| Suse | — | Upgrade moodle-svUpgrade moodle-huUpgrade moodle-itUpgrade moodle-mi_tnUpgrade moodle-euUpgrade moodle-idUpgrade moodle-tlUpgrade moodle-caUpgrade moodle-ltUpgrade moodle-faUpgrade moodle-knUpgrade moodle-elUpgrade moodle-noUpgrade moodle-arUpgrade moodle-slUpgrade moodle-ruUpgrade moodle-glUpgrade moodle-gaUpgrade moodle-heUpgrade moodle-daUpgrade moodle-deUpgrade moodle-hrUpgrade moodle-msUpgrade moodle-hiUpgrade moodle-skUpgrade moodle-nnUpgrade moodle-srUpgrade moodle-soUpgrade moodle-lvUpgrade moodle-afUpgrade moodle-trUpgrade moodle-koUpgrade moodle-de_duUpgrade moodle-sqUpgrade moodle-kmUpgrade moodle-beUpgrade moodle-csUpgrade moodle-bsUpgrade moodle-etUpgrade moodle-isUpgrade moodle-esUpgrade moodle-frUpgrade moodle-ukUpgrade moodle-roUpgrade moodle-ptUpgrade moodle-bgUpgrade moodle-zh_cnUpgrade moodle-viUpgrade moodle-thUpgrade moodle-kaUpgrade moodleUpgrade moodle-fiUpgrade moodle-nlUpgrade moodle-jaUpgrade moodle-pl | Feb 17, 2015 | Nov 7, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub