Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-7pnw-f1rw-kydp
Summary
XSS via .swf files
In the vulnerable versions, the `uploader.swf` and `io.swf` utilities contain a vulnerability allowing cross-site scripting through the `.swf` files used in these components. Through a url accessing these files, and attacker can inject script in the context of these files, potentially exposing cookies or other sensitive information. The vulnerability resurfaced in v0.10.2, but only with `io.swf`.
Aliases
0
alias CVE-2013-4939
1
alias GHSA-mj87-8xf8-fp4w
Fixed_packages
0
url pkg:npm/yui@3.10.0
purl pkg:npm/yui@3.10.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-bkcw-p2su-pkde
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.10.0
1
url pkg:npm/yui@3.10.3
purl pkg:npm/yui@3.10.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-bkcw-p2su-pkde
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.10.3
Affected_packages
0
url pkg:npm/yui@3.0.0
purl pkg:npm/yui@3.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.0.0
1
url pkg:npm/yui@3.5.0PR1
purl pkg:npm/yui@3.5.0PR1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.5.0PR1
2
url pkg:npm/yui@3.5.0pr2
purl pkg:npm/yui@3.5.0pr2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.5.0pr2
3
url pkg:npm/yui@3.5.0pr4
purl pkg:npm/yui@3.5.0pr4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.5.0pr4
4
url pkg:npm/yui@3.5.0
purl pkg:npm/yui@3.5.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.5.0
5
url pkg:npm/yui@3.5.1-1
purl pkg:npm/yui@3.5.1-1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.5.1-1
6
url pkg:npm/yui@3.5.1-2
purl pkg:npm/yui@3.5.1-2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.5.1-2
7
url pkg:npm/yui@3.5.1
purl pkg:npm/yui@3.5.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.5.1
8
url pkg:npm/yui@3.6.0pr1
purl pkg:npm/yui@3.6.0pr1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.6.0pr1
9
url pkg:npm/yui@3.6.0pr2
purl pkg:npm/yui@3.6.0pr2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.6.0pr2
10
url pkg:npm/yui@3.6.0pr3
purl pkg:npm/yui@3.6.0pr3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.6.0pr3
11
url pkg:npm/yui@3.6.0
purl pkg:npm/yui@3.6.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.6.0
12
url pkg:npm/yui@3.7.0pr1
purl pkg:npm/yui@3.7.0pr1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.7.0pr1
13
url pkg:npm/yui@3.7.0pr2
purl pkg:npm/yui@3.7.0pr2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.7.0pr2
14
url pkg:npm/yui@3.7.0pr3
purl pkg:npm/yui@3.7.0pr3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.7.0pr3
15
url pkg:npm/yui@3.7.0pr4
purl pkg:npm/yui@3.7.0pr4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.7.0pr4
16
url pkg:npm/yui@3.7.0
purl pkg:npm/yui@3.7.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.7.0
17
url pkg:npm/yui@3.7.1
purl pkg:npm/yui@3.7.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.7.1
18
url pkg:npm/yui@3.7.2
purl pkg:npm/yui@3.7.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.7.2
19
url pkg:npm/yui@3.7.3
purl pkg:npm/yui@3.7.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.7.3
20
url pkg:npm/yui@3.8.0pr1
purl pkg:npm/yui@3.8.0pr1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.8.0pr1
21
url pkg:npm/yui@3.8.0pr2
purl pkg:npm/yui@3.8.0pr2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.8.0pr2
22
url pkg:npm/yui@3.8.0
purl pkg:npm/yui@3.8.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.8.0
23
url pkg:npm/yui@3.8.1
purl pkg:npm/yui@3.8.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.8.1
24
url pkg:npm/yui@3.9.0pr1
purl pkg:npm/yui@3.9.0pr1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.9.0pr1
25
url pkg:npm/yui@3.9.0pr2
purl pkg:npm/yui@3.9.0pr2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.9.0pr2
26
url pkg:npm/yui@3.9.0pr3
purl pkg:npm/yui@3.9.0pr3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.9.0pr3
27
url pkg:npm/yui@3.9.0
purl pkg:npm/yui@3.9.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.9.0
28
url pkg:npm/yui@3.9.1
purl pkg:npm/yui@3.9.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.9.1
29
url pkg:npm/yui@3.10.0pr1
purl pkg:npm/yui@3.10.0pr1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7pnw-f1rw-kydp
1
vulnerability VCID-bkcw-p2su-pkde
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.10.0pr1
30
url pkg:npm/yui@3.10.2
purl pkg:npm/yui@3.10.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fdn-sk73-zqe2
1
vulnerability VCID-7pnw-f1rw-kydp
2
vulnerability VCID-bkcw-p2su-pkde
3
vulnerability VCID-kjwa-ezsm-pbg7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/yui@3.10.2
References
0
reference_url http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-4939
reference_id
reference_type
scores
0
value 0.0031
scoring_system epss
scoring_elements 0.54294
published_at 2026-05-14T12:55:00Z
1
value 0.0031
scoring_system epss
scoring_elements 0.54258
published_at 2026-04-18T12:55:00Z
2
value 0.0031
scoring_system epss
scoring_elements 0.54239
published_at 2026-04-21T12:55:00Z
3
value 0.0031
scoring_system epss
scoring_elements 0.54205
published_at 2026-04-24T12:55:00Z
4
value 0.0031
scoring_system epss
scoring_elements 0.54219
published_at 2026-04-26T12:55:00Z
5
value 0.0031
scoring_system epss
scoring_elements 0.54195
published_at 2026-04-29T12:55:00Z
6
value 0.0031
scoring_system epss
scoring_elements 0.54143
published_at 2026-05-05T12:55:00Z
7
value 0.0031
scoring_system epss
scoring_elements 0.54185
published_at 2026-05-07T12:55:00Z
8
value 0.0031
scoring_system epss
scoring_elements 0.5424
published_at 2026-05-09T12:55:00Z
9
value 0.0031
scoring_system epss
scoring_elements 0.542
published_at 2026-05-11T12:55:00Z
10
value 0.0031
scoring_system epss
scoring_elements 0.54226
published_at 2026-05-12T12:55:00Z
11
value 0.0031
scoring_system epss
scoring_elements 0.54135
published_at 2026-04-01T12:55:00Z
12
value 0.0031
scoring_system epss
scoring_elements 0.54152
published_at 2026-04-02T12:55:00Z
13
value 0.0031
scoring_system epss
scoring_elements 0.54182
published_at 2026-04-04T12:55:00Z
14
value 0.0031
scoring_system epss
scoring_elements 0.54156
published_at 2026-04-07T12:55:00Z
15
value 0.0031
scoring_system epss
scoring_elements 0.54208
published_at 2026-04-08T12:55:00Z
16
value 0.0031
scoring_system epss
scoring_elements 0.54204
published_at 2026-04-09T12:55:00Z
17
value 0.0031
scoring_system epss
scoring_elements 0.54254
published_at 2026-04-11T12:55:00Z
18
value 0.0031
scoring_system epss
scoring_elements 0.54236
published_at 2026-04-12T12:55:00Z
19
value 0.0031
scoring_system epss
scoring_elements 0.54216
published_at 2026-04-13T12:55:00Z
20
value 0.0031
scoring_system epss
scoring_elements 0.54255
published_at 2026-04-16T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-4939
2
reference_url https://lists.apache.org/thread.html/72837f969cdf9b63a7e7337edd069fa3b3950eea7c997cc2ff61aa0c@%3Cissues.zookeeper.apache.org%3E
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/72837f969cdf9b63a7e7337edd069fa3b3950eea7c997cc2ff61aa0c@%3Cissues.zookeeper.apache.org%3E
3
reference_url https://lists.apache.org/thread.html/d8b9403dbab85a51255614949938b619bd03b1c944c76c48c6996a0e@%3Cdev.zookeeper.apache.org%3E
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/d8b9403dbab85a51255614949938b619bd03b1c944c76c48c6996a0e@%3Cdev.zookeeper.apache.org%3E
4
reference_url https://moodle.org/mod/forum/discuss.php?d=232496
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://moodle.org/mod/forum/discuss.php?d=232496
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-4939
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-4939
6
reference_url https://www.npmjs.com/advisories/332
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.npmjs.com/advisories/332
7
reference_url https://yuilibrary.com/support/20130515-vulnerability
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://yuilibrary.com/support/20130515-vulnerability
8
reference_url https://yuilibrary.com/support/20130515-vulnerability/
reference_id
reference_type
scores
url https://yuilibrary.com/support/20130515-vulnerability/
9
reference_url https://yuilibrary.com/support/20130515-vulnerability/)
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements
url https://yuilibrary.com/support/20130515-vulnerability/)
10
reference_url http://yuilibrary.com/support/20130515-vulnerability
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://yuilibrary.com/support/20130515-vulnerability
11
reference_url http://yuilibrary.com/support/20130515-vulnerability/
reference_id
reference_type
scores
url http://yuilibrary.com/support/20130515-vulnerability/
12
reference_url https://github.com/nodejs/security-wg/blob/main/vuln/npm/332.json
reference_id 332
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements
url https://github.com/nodejs/security-wg/blob/main/vuln/npm/332.json
13
reference_url https://github.com/advisories/GHSA-mj87-8xf8-fp4w
reference_id GHSA-mj87-8xf8-fp4w
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-mj87-8xf8-fp4w
Weaknesses
0
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
1
cwe_id 79
name Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
description The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
Exploits
Severity_range_score4.0 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-7pnw-f1rw-kydp