Description
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web script or HTML via vectors related to swfstore.swf, a similar issue to CVE-2010-4209.
CVSS Metrics
- Vector
- AV:N/AC:M/Au:N/C:N/I:P/A:N
- Access Vector
- network
- Access Cmplx
- medium
- Auth
- none
- Confidentiality
- none
- Integrity
- partial
- Availability
- none
- Weaknesses
- CWE-79
Metadata
- Primary Vendor
- MOZILLA
- Published
- 11/16/2012
- Last Modified
- 4/11/2025
- Source
- NIST NVD
- Note: Verify all details with official vendor sources before applying patches.
Affected Products
mozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillamozilla : bugzillayahoo : yuiyahoo : yuiyahoo : yuiyahoo : yuiyahoo : yuiyahoo : yuiyahoo : yui
AI-Powered Remediation
Generate remediation guidance or a C-suite brief for this vulnerability.