CVE-2010-4207

Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to charts/assets/charts.swf.

• CWE-79

• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050813.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050820.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050830.html
• http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html
• http://moodle.org/mod/forum/discuss.php?d=160910
• http://secunia.com/advisories/41955Vendor Advisory
• http://secunia.com/advisories/42271
• http://www.bugzilla.org/security/3.2.8/
• http://www.openwall.com/lists/oss-security/2010/11/07/1
• http://www.securityfocus.com/archive/1/514622
• http://www.securityfocus.com/bid/44420
• http://www.securitytracker.com/id?1024683
• http://www.vupen.com/english/advisories/2010/2878Vendor Advisory
• http://www.vupen.com/english/advisories/2010/2975
• http://yuilibrary.com/support/2.8.2/Patch, Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050813.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050820.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050830.html
• http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html
• http://moodle.org/mod/forum/discuss.php?d=160910
• http://secunia.com/advisories/41955Vendor Advisory
• http://secunia.com/advisories/42271
• http://www.bugzilla.org/security/3.2.8/
• http://www.openwall.com/lists/oss-security/2010/11/07/1
• http://www.securityfocus.com/archive/1/514622
• http://www.securityfocus.com/bid/44420
• http://www.securitytracker.com/id?1024683
• http://www.vupen.com/english/advisories/2010/2878Vendor Advisory
• http://www.vupen.com/english/advisories/2010/2975
• http://yuilibrary.com/support/2.8.2/Patch, Vendor Advisory

Published

Nov 7, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-4201Use-after-free vulnerability in Google Chrome before 7.0.517…9.8
• CVE-2010-4202Multiple integer overflows in Google Chrome before 7.0.517.4…9.8
• CVE-2010-4203WebM libvpx (aka the VP8 Codec SDK) before 0.9.5, as used in…9.8
• CVE-2010-4204WebKit, as used in Google Chrome before 7.0.517.44, webkitgt…9.8
• CVE-2010-4205Google Chrome before 7.0.517.44 does not properly handle the…9.8
• CVE-2010-4206Array index error in the FEBlend::apply function in WebCore/…8.8
• CVE-2010-4208Cross-site scripting (XSS) vulnerability in the Flash compon…
• CVE-2010-4209Cross-site scripting (XSS) vulnerability in the Flash compon…
• CVE-2010-4210The pfs_getextattr function in FreeBSD 7.x before 7.3-RELEAS…7.8
• CVE-2010-4211The PayPal app before 3.0.1 for iOS does not verify that the…
• CVE-2010-4212The USAA application 3.0 for Android stores a mirror image o…
• CVE-2010-4213The Bank of America application 2.12 for Android stores a se…