Vulnerability Details CVE-2010-4710
Cross-site scripting (XSS) vulnerability in the addItem method in the Menu widget in YUI before 2.9.0 allows remote attackers to inject arbitrary web script or HTML via a field that is added to a menu, related to documentation that specifies this field as a text field rather than an HTML field, a similar issue to CVE-2010-4569 and CVE-2010-4570.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 46.3%
CVSS Severity
CVSS v2 Score 4.3
References
- http://yuilibrary.com/forum/viewtopic.php?p=12923
- http://yuilibrary.com/projects/yui2/ticket/2529228
- http://yuilibrary.com/projects/yui2/ticket/2529231
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65180
- http://yuilibrary.com/forum/viewtopic.php?p=12923
- http://yuilibrary.com/projects/yui2/ticket/2529228
- http://yuilibrary.com/projects/yui2/ticket/2529231
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65180
Products affected by CVE-2010-4710
-
cpe:2.3:a:yahoo:yui:2.2.0
-
cpe:2.3:a:yahoo:yui:2.2.2
-
cpe:2.3:a:yahoo:yui:2.3.0
-
cpe:2.3:a:yahoo:yui:2.3.1
-
cpe:2.3:a:yahoo:yui:2.4.0
-
cpe:2.3:a:yahoo:yui:2.4.1
-
cpe:2.3:a:yahoo:yui:2.5.0
-
cpe:2.3:a:yahoo:yui:2.5.1
-
cpe:2.3:a:yahoo:yui:2.5.2
-
cpe:2.3:a:yahoo:yui:2.6.0
-
cpe:2.3:a:yahoo:yui:2.7.0
-
cpe:2.3:a:yahoo:yui:2.8.0
-
cpe:2.3:a:yahoo:yui:2.8.1
-
cpe:2.3:a:yahoo:yui:2.8.2