Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/yui@3.0.0
purl pkg:npm/yui@3.0.0
Tags Ghost
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 2.4
Vulnerabilities affecting this package (4)
Advisory Summary Fixed in package version
npm-332
Aliases:
CVE-2013-4939
CVE-2013-4940
CVE-2013-4941
CVE-2013-4942
XSS via .swf files YUI is a free, open source JavaScript and CSS framework for building richly interactive web applications. …
3.10.3
Vulnerable
3.10.1
Vulnerable
CVE-2013-4939

XSS via .swf files In the vulnerable versions, the `uploader.swf` and `io.swf` utilities contain a vulnerability allowing cross-site scripting through …
3.10.0
Vulnerable
3.10.3
Vulnerable
CVE-2013-4940
Aliases:
GHSA-x5hj-47vv-53p8
YUI Cross-site Scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, … There are no reported fixed by versions.
GHSA-x5hj-47vv-53p8
Aliases:
CVE-2013-4940
YUI Cross-site Scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, … There are no reported fixed by versions.
This package is not known to fix any advisories.