CVE-2010-4710
published 2011-01-28CVE-2010-4710: Cross-site scripting (XSS) vulnerability in the addItem method in the Menu widget in YUI before 2.9.0 allows remote attackers to inject arbitrary web script or…
PriorityP418medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
2.23%
80.9th percentile
Cross-site scripting (XSS) vulnerability in the addItem method in the Menu widget in YUI before 2.9.0 allows remote attackers to inject arbitrary web script or HTML via a field that is added to a menu, related to documentation that specifies this field as a text field rather than an HTML field, a similar issue to CVE-2010-4569 and CVE-2010-4570.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| yahoo | yui | <= 2.8.2 | — |
| yahoo | yui | — | — |
| yahoo | yui | — | — |
| yahoo | yui | — | — |
| yahoo | yui | — | — |
| yahoo | yui | — | — |
| yahoo | yui | — | — |
| yahoo | yui | — | — |
| yahoo | yui | — | — |
| yahoo | yui | — | — |
| yahoo | yui | — | — |
| yahoo | yui | — | — |
| yahoo | yui | — | — |
| yahoo | yui | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_cisco7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qv3f-mvrx-9wqv: Cross-site scripting (XSS) vulnerability in the addItem method in the Menu widget in YUI before 2
ghsa_unreviewed·2022-05-17·CVSS 4.3
CVE-2010-4710 [MEDIUM] CWE-79 GHSA-qv3f-mvrx-9wqv: Cross-site scripting (XSS) vulnerability in the addItem method in the Menu widget in YUI before 2
Cross-site scripting (XSS) vulnerability in the addItem method in the Menu widget in YUI before 2.9.0 allows remote attackers to inject arbitrary web script or HTML via a field that is added to a menu, related to documentation that specifies this field as a text field rather than an HTML field, a similar issue to CVE-2010-4569 and CVE-2010-4570.
Cisco
Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
vendor_cisco·2010-08-11·CVSS 7.8
CVE-2010-2822 [HIGH] CWE-399 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
The Cisco ACE Application Control Engine Module and Cisco ACE 4710
Application Control Engine contain the following DoS vulnerabilities:
Real-Time Streaming Protocol (RTSP) inspection DoS
vulnerability
HTTP, RTSP, and Session Initiation Protocol (SIP) inspection DoS
vulnerability
Secure Socket Layer (SSL) DoS vulnerability
SIP inspection DoS vulnerability
Cisco has released free software updates for affected customers.
Workarounds that mitigate some of the vulnerabilities are available.
Note: These vulnerabilities are independent of each other. A device may be
affected by one vulnerability and not affected by another.
This advisory is posted at
https://sec.clo
Cisco
Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
vendor_cisco
CVE-2010-2823 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
CVE-2010-2823: Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
The Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine contain the following DoS vulnerabilities: Real-Time Streaming Protocol (RTSP) inspection DoS vulnerability HTTP, RTSP, and Session Initiation Protocol (SIP) inspection DoS vulnerability Secure Socket Layer (SSL) DoS vulnerability SIP inspection DoS vulnerability Cisco has released free software updates for affected customers.
CWE: CWE-399, CWE-399
Bug IDs: CSCta85227, CSCtg14858, CSCtb54493, CSCta20756, CSCta65603
Cisco
Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
vendor_cisco
CVE-2010-2824 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
CVE-2010-2824: Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
The Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine contain the following DoS vulnerabilities: Real-Time Streaming Protocol (RTSP) inspection DoS vulnerability HTTP, RTSP, and Session Initiation Protocol (SIP) inspection DoS vulnerability Secure Socket Layer (SSL) DoS vulnerability SIP inspection DoS vulnerability Cisco has released free software updates for affected customers.
CWE: CWE-399, CWE-399
Bug IDs: CSCta85227, CSCtg14858, CSCtb54493, CSCta20756, CSCta65603
Cisco
Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
vendor_cisco
CVE-2010-2822 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
CVE-2010-2822: Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
The Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine contain the following DoS vulnerabilities: Real-Time Streaming Protocol (RTSP) inspection DoS vulnerability HTTP, RTSP, and Session Initiation Protocol (SIP) inspection DoS vulnerability Secure Socket Layer (SSL) DoS vulnerability SIP inspection DoS vulnerability Cisco has released free software updates for affected customers.
CWE: CWE-399, CWE-399
Bug IDs: CSCta85227, CSCtg14858, CSCtb54493, CSCta20756, CSCta65603
Cisco
Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
vendor_cisco
CVE-2010-2825 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
CVE-2010-2825: Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
The Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine contain the following DoS vulnerabilities: Real-Time Streaming Protocol (RTSP) inspection DoS vulnerability HTTP, RTSP, and Session Initiation Protocol (SIP) inspection DoS vulnerability Secure Socket Layer (SSL) DoS vulnerability SIP inspection DoS vulnerability Cisco has released free software updates for affected customers.
CWE: CWE-399, CWE-399
Bug IDs: CSCta85227, CSCtg14858, CSCtb54493, CSCta20756, CSCta65603
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://yuilibrary.com/forum/viewtopic.php?p=12923http://yuilibrary.com/projects/yui2/ticket/2529228http://yuilibrary.com/projects/yui2/ticket/2529231https://exchange.xforce.ibmcloud.com/vulnerabilities/65180http://yuilibrary.com/forum/viewtopic.php?p=12923http://yuilibrary.com/projects/yui2/ticket/2529228http://yuilibrary.com/projects/yui2/ticket/2529231https://exchange.xforce.ibmcloud.com/vulnerabilities/65180
2011-01-28
Published