netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-9ww8-j8j2-3788
GHSA-9ww8-j8j2-3788
This commit is contained in:
advisory-database[bot]
2025-04-12 03:29:09 +00:00
parent 6d07427c03
commit e00a7303bc
2 changed files with 141 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-9ww8-j8j2-3788/GHSA-9ww8-j8j2-3788.json
+141
View File
@@ -0,0 +1,141 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9ww8-j8j2-3788",
"modified": "2025-04-12T03:26:53Z",
"published": "2022-05-13T01:12:55Z",
"aliases": [
"CVE-2013-4942"
],
"summary": "YUI Cross-site Scripting (XSS) vulnerability",
"details": "Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "yui"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2.0"
},
{
"last_affected": "3.9.1"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.4.0-rc1"
},
{
"fixed": "2.4.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0-beta"
},
{
"fixed": "2.5.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4942"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=232496"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20130909203912/http://yuilibrary.com/support/20130515-vulnerability"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-04-12T03:26:53Z",
"nvd_published_at": "2013-07-29T13:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-9ww8-j8j2-3788/GHSA-9ww8-j8j2-3788.json
-39
View File
@@ -1,39 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9ww8-j8j2-3788",
"modified": "2025-04-11T04:12:21Z",
"published": "2022-05-13T01:12:55Z",
"aliases": [
"CVE-2013-4942"
],
"details": "Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4942"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=232496"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678"
},
{
"type": "WEB",
"url": "http://yuilibrary.com/support/20130515-vulnerability"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-07-29T13:59:00Z"
}
}