Yahoo
Monthly
Cross-site request forgery in Yahoo CMAK (Cluster Manager for Apache Kafka) through 3.0.0.6 allows an attacker to make a logged-in operator's browser silently submit forged POST requests that delete topics or change cluster configuration, riding the operator's existing HTTP Basic credentials or play-basic-authentication cookie. The root cause is a confirmed missing CSRF filter combined with an authentication cookie that has no SameSite protection, so no per-request token stands between the forged request and destructive state-changing endpoints. The attacker needs no account of their own, but exploitation does require a valid authenticated operator session plus user interaction (luring that operator to attacker-controlled content), and no public exploit code has been identified at time of analysis.
Cross-site scripting in serialize-javascript before 7.1.3 lets an attacker who controls the source text of a serialized function (in practice via a spoofed toString()) break out of an HTML <script> element and introduce live markup, but only in a narrow configuration: the function body must end exactly at a bare '</script' with no trailing delimiter character, the surrounding serialized output must then supply the delimiter (for example the newline emitted by the 'space' pretty-print option), and a later serialized value must supply the closing '>' plus injected markup. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, a scope-changing low-impact injection that requires a victim to load the affected page; ordinary functions (which end in '}') and non-function values, including strings containing '</script', are escaped correctly and are not affected. There is no CISA KEV entry and no confirmed active exploitation; a public reproducer is documented in the upstream advisory, and the vendor-released fix is version 7.1.3.
Cross-site scripting in serialize-javascript 7.0.1 before 7.1.3 occurs when a serialized function's attacker-influenced source text ends in a bare `</script`, letting surrounding output and a later serialized value complete the tag and inject live markup such as an `img onerror` handler. The flaw only affects applications that serialize attacker-controlled function values via a spoofed `toString()` and embed the result inside an HTML `<script>` element; ordinary functions and non-function values are escaped correctly. The vendor fixed this in 7.1.3, no KEV listing or confirmed active exploitation is reported, the advisory's demonstration payload is not verified as working exploit code, and the decision label is monitor.
Yahoo CMAK through 3.0.0.6 fails to enforce its scheduled leader election feature toggle on the PreferredReplicaElection HTML form routes, allowing an authenticated user (CVSS PR:L) with network access to the web UI to start or stop the recurring election scheduler and disrupt leadership across the Kafka clusters managed by that instance. This is a protection-mechanism failure (CWE-693) with no confidentiality impact (C:N) and limited integrity/availability impact (I:L/A:L); the assessed severity is low-to-moderate (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), and no public exploit code has been identified at time of analysis. Environments are at risk only if they run CMAK 3.0.0.6 or earlier and actively manage live Kafka clusters.
Open redirect vulnerability in Athenz v1.8.24 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Untrusted search path vulnerability in Installer of Yahoo!. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Multiple stack-based buffer overflows in Yahoo!. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The Yahoo!. Rated medium severity (CVSS 5.4). No vendor patch available.
Cross-site scripting (XSS) vulnerability in clickstream.js in Y!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The Yahoo!. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
The Yahoo!. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
The Yahoo!. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
The Yahoo!. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
The Yahoo!. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Yahoo!. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
The Yahoo!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Integer overflow in the CYImage::LoadJPG method in YImage.dll in Yahoo!. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site request forgery in Yahoo CMAK (Cluster Manager for Apache Kafka) through 3.0.0.6 allows an attacker to make a logged-in operator's browser silently submit forged POST requests that delete topics or change cluster configuration, riding the operator's existing HTTP Basic credentials or play-basic-authentication cookie. The root cause is a confirmed missing CSRF filter combined with an authentication cookie that has no SameSite protection, so no per-request token stands between the forged request and destructive state-changing endpoints. The attacker needs no account of their own, but exploitation does require a valid authenticated operator session plus user interaction (luring that operator to attacker-controlled content), and no public exploit code has been identified at time of analysis.
Cross-site scripting in serialize-javascript before 7.1.3 lets an attacker who controls the source text of a serialized function (in practice via a spoofed toString()) break out of an HTML <script> element and introduce live markup, but only in a narrow configuration: the function body must end exactly at a bare '</script' with no trailing delimiter character, the surrounding serialized output must then supply the delimiter (for example the newline emitted by the 'space' pretty-print option), and a later serialized value must supply the closing '>' plus injected markup. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, a scope-changing low-impact injection that requires a victim to load the affected page; ordinary functions (which end in '}') and non-function values, including strings containing '</script', are escaped correctly and are not affected. There is no CISA KEV entry and no confirmed active exploitation; a public reproducer is documented in the upstream advisory, and the vendor-released fix is version 7.1.3.
Cross-site scripting in serialize-javascript 7.0.1 before 7.1.3 occurs when a serialized function's attacker-influenced source text ends in a bare `</script`, letting surrounding output and a later serialized value complete the tag and inject live markup such as an `img onerror` handler. The flaw only affects applications that serialize attacker-controlled function values via a spoofed `toString()` and embed the result inside an HTML `<script>` element; ordinary functions and non-function values are escaped correctly. The vendor fixed this in 7.1.3, no KEV listing or confirmed active exploitation is reported, the advisory's demonstration payload is not verified as working exploit code, and the decision label is monitor.
Yahoo CMAK through 3.0.0.6 fails to enforce its scheduled leader election feature toggle on the PreferredReplicaElection HTML form routes, allowing an authenticated user (CVSS PR:L) with network access to the web UI to start or stop the recurring election scheduler and disrupt leadership across the Kafka clusters managed by that instance. This is a protection-mechanism failure (CWE-693) with no confidentiality impact (C:N) and limited integrity/availability impact (I:L/A:L); the assessed severity is low-to-moderate (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), and no public exploit code has been identified at time of analysis. Environments are at risk only if they run CMAK 3.0.0.6 or earlier and actively manage live Kafka clusters.
Open redirect vulnerability in Athenz v1.8.24 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Untrusted search path vulnerability in Installer of Yahoo!. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Multiple stack-based buffer overflows in Yahoo!. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The Yahoo!. Rated medium severity (CVSS 5.4). No vendor patch available.
Cross-site scripting (XSS) vulnerability in clickstream.js in Y!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The Yahoo!. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
The Yahoo!. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
The Yahoo!. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
The Yahoo!. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
The Yahoo!. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Yahoo!. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
The Yahoo!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Integer overflow in the CYImage::LoadJPG method in YImage.dll in Yahoo!. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable. No vendor patch available.