CVE-2010-4710 — Cross-site Scripting in YUI

CWE-79 — Cross-site ScriptingCWE-3994 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 53.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Yahoo YUI
Timeline
PublishedJan 28
Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in the addItem method in the Menu widget in YUI before 2.9.0 allows remote attackers to inject arbitrary web script or HTML via a field that is added to a menu, related to documentation that specifies this field as a text field rather than an HTML field, a similar issue to CVE-2010-4569 and CVE-2010-4570.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDyahoo/yui2.8.2+13

🔴Vulnerability Details

2
GHSA
GHSA-qv3f-mvrx-9wqv: Cross-site scripting (XSS) vulnerability in the addItem method in the Menu widget in YUI before 2↗2022-05-17
▶
CVEList
CVE-2010-4710: Cross-site scripting (XSS) vulnerability in the addItem method in the Menu widget in YUI before 2↗2011-01-28
▶

📋Vendor Advisories

1
Cisco
Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine↗2010-08-11
▶
CVE-2010-4710 — Cross-site Scripting in Yahoo YUI | cvebase