Homepage

org.webjars:yui@3.7.3 vulnerabilities

  • latest version

    2.6.0

  • latest non vulnerable version

    3.18.1

  • first published

    12 years ago

  • latest version published

    5 years ago

  • licenses detected

  • package manager

    View on Maven Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars:yui package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Cross-site Scripting (XSS)

    yui is an open source JavaScript and CSS framework for building richly interactive web applications.

    Affected versions of the package are vulnerable to Cross-site Scripting (XSS) in .swf files used in the IO Utility and Uploader components. A carefully constructed URL accessing these .swf files directly could cause them to execute JavaScript in the context of the hosted .swf files and potentially expose cookies or other sensitive information from the hosted site.

    This vulnerability is similar to CVE-2013-4940.

    How to fix Cross-site Scripting (XSS)?

    Upgrade yui to version 3.10.0 or higher.

    [3.0.0,3.10.0)
    Go back to all versions of this package