yui@3.5.0 vulnerabilities

yui is an open source JavaScript and CSS framework for building richly interactive web applications.

Affected versions of the package are vulnerable to Cross-site Scripting (XSS) attacks via the JSON parser. It is possible to inject HTML in the "text" version of the AutoComplete result (e.g. "foo"). An attacker may manipulate the content of the results to carry out an XSS attack.

Upgrade yui to version 3.5.1 or higher.

yui is an open source JavaScript and CSS framework for building richly interactive web applications.

Affected versions of the package are vulnerable to Cross-site Scripting (XSS) via the io.swf file that was inadvertently reintroduced in version 3.10.2. A carefully constructed URL accessing io.swf directly could cause it to execute JavaScript and potentially expose cookies or other sensitive information from the hosted site.

This vulnerability is similar to CVE-2013-4941.

Upgrade yui to version 3.10.3 or higher.

yui is an open source JavaScript and CSS framework for building richly interactive web applications.

Affected versions of the package are vulnerable to Cross-site Scripting (XSS) in .swf files used in the IO Utility and Uploader components. A carefully constructed URL accessing these .swf files directly could cause them to execute JavaScript in the context of the hosted .swf files and potentially expose cookies or other sensitive information from the hosted site.

This vulnerability is similar to CVE-2013-4940.

Upgrade yui to version 3.10.0 or higher.