Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to uploader/assets/uploader.swf.
CVSS Details
- CVSS 3.1 Base Score: 4.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade yahoo-ui | Dec 10, 2025 | Dec 15, 2010 |
| Suse | — | Upgrade moodle-hrUpgrade moodle-thUpgrade moodle-arUpgrade moodle-skUpgrade moodle-srUpgrade moodle-soUpgrade moodle-fiUpgrade moodle-kaUpgrade moodle-roUpgrade moodle-plUpgrade moodle-caUpgrade moodleUpgrade moodle-bgUpgrade moodle-afUpgrade moodle-csUpgrade moodle-etUpgrade moodle-ruUpgrade moodle-frUpgrade moodle-ptUpgrade moodle-jaUpgrade moodle-elUpgrade moodle-msUpgrade moodle-beUpgrade moodle-nnUpgrade moodle-kmUpgrade moodle-gaUpgrade moodle-lvUpgrade moodle-viUpgrade moodle-esUpgrade moodle-trUpgrade moodle-heUpgrade moodle-ukUpgrade moodle-glUpgrade moodle-bsUpgrade moodle-noUpgrade moodle-mi_tnUpgrade moodle-knUpgrade moodle-slUpgrade moodle-de_duUpgrade moodle-sqUpgrade moodle-itUpgrade moodle-daUpgrade moodle-hiUpgrade moodle-nlUpgrade moodle-zh_cnUpgrade moodle-idUpgrade moodle-koUpgrade moodle-euUpgrade moodle-huUpgrade moodle-deUpgrade moodle-svUpgrade moodle-faUpgrade moodle-ltUpgrade moodle-isUpgrade moodle-tl | Feb 17, 2015 | Nov 7, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub