Homepage

yui@3.5.0 vulnerabilities

YUI 3 Source

  • latest version

    3.18.1

  • latest non vulnerable version

    3.18.1

  • first published

    13 years ago

  • latest version published

    10 years ago

  • licenses detected

  • View yui package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the yui package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Cross-site Scripting (XSS)

    yui is an open source JavaScript and CSS framework for building richly interactive web applications.

    Affected versions of the package are vulnerable to Cross-site Scripting (XSS) attacks via the JSON parser. It is possible to inject HTML in the "text" version of the AutoComplete result (e.g. "foo"). An attacker may manipulate the content of the results to carry out an XSS attack.

    How to fix Cross-site Scripting (XSS)?

    Upgrade yui to version 3.5.1 or higher.

    >=3.5.0-PR1 <3.5.1
    • M
    Cross-site Scripting (XSS)

    yui is an open source JavaScript and CSS framework for building richly interactive web applications.

    Affected versions of the package are vulnerable to Cross-site Scripting (XSS) via the io.swf file that was inadvertently reintroduced in version 3.10.2. A carefully constructed URL accessing io.swf directly could cause it to execute JavaScript and potentially expose cookies or other sensitive information from the hosted site.

    This vulnerability is similar to CVE-2013-4941.

    How to fix Cross-site Scripting (XSS)?

    Upgrade yui to version 3.10.3 or higher.

    >=3.0.0 <3.10.1=3.10.2
    • M
    Cross-site Scripting (XSS)

    yui is an open source JavaScript and CSS framework for building richly interactive web applications.

    Affected versions of the package are vulnerable to Cross-site Scripting (XSS) in .swf files used in the IO Utility and Uploader components. A carefully constructed URL accessing these .swf files directly could cause them to execute JavaScript in the context of the hosted .swf files and potentially expose cookies or other sensitive information from the hosted site.

    This vulnerability is similar to CVE-2013-4940.

    How to fix Cross-site Scripting (XSS)?

    Upgrade yui to version 3.10.0 or higher.

    >=3.0.0 <3.10.0
    Go back to all versions of this package