CVSS: 5.1EPSS: 0%CPEs: 83EXPL: 0CVE-2012-0268
https://notcve.org/view.php?id=CVE-2012-0268
Integer overflow in the CYImage::LoadJPG method in YImage.dll in Yahoo! Messenger before 11.5.0.155, when photo sharing is enabled, might allow remote attackers to execute arbitrary code via a crafted JPG image that triggers a heap-based buffer overflow. Un desbordamiento de entero en el método CYImage::LoadJPG en YImage.dll en Yahoo! Messenger antes de v11.5.0.155, cuando la compartición fotos está activada, podría permitir a atacantes remotos ejecutar código de su elección a través de una imagen JPG modificada a mano que genera un desbordamiento de búfer basado en memoria dinámica(montículo). • http://secunia.com/advisories/47041 • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 42%CPEs: 8EXPL: 0CVE-2011-3179
https://notcve.org/view.php?id=CVE-2011-3179
The server process in Novell Messenger 2.1 and 2.2.x before 2.2.1, and Novell GroupWise Messenger 2.04 and earlier, allows remote attackers to read from arbitrary memory locations via a crafted command. El proceso server en Novell Messenger v2.1 y v2.2.x antes de v2.2.1 y GroupWise Messenger v2.04 y anteriores permite a atacantes remotos leer direcciones de memoria de su elección a través de comandos modificados. • http://www.novell.com/support/viewContent.do?externalId=7009634 https://bugzilla.novell.com/show_bug.cgi?id=712158 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 3CVE-2009-4171 – Yahoo! Messenger 9.0.0.2162 - 'YahooBridgeLib.dll' ActiveX Control Remote Denial of Service
https://notcve.org/view.php?id=CVE-2009-4171
An ActiveX control in YahooBridgeLib.dll for Yahoo! Messenger 9.0.0.2162, and possibly other 9.0 versions, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by calling the RegisterMe method with a long argument. Un control ActiveX en YahooBridgeLib.dll para Yahoo! Messenger v9.0.0.2162, y posiblemente otras versiones 9.0, permite a atacantes remotos producir una denegación de servicio (desreferencia a un puntero NULL y caída de aplicación ) mediante una llamada al método RegisterMe con un argumento largo. • https://www.exploit-db.com/exploits/10092 https://www.exploit-db.com/exploits/33350 http://www.securityfocus.com/archive/1/507818/100/0/threaded http://www.securityfocus.com/bid/37007 https://exchange.xforce.ibmcloud.com/vulnerabilities/54263 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 11%CPEs: 1EXPL: 2CVE-2007-5017 – Yahoo! Messenger 8.1.0.421 - CYFT Object Arbitrary File Download
https://notcve.org/view.php?id=CVE-2007-5017
Absolute path traversal vulnerability in a certain ActiveX control in the CYFT object in ft60.dll in Yahoo! Messenger 8.1.0.421 allows remote attackers to force a download, and create or overwrite arbitrary files via a full pathname in the second argument to the GetFile method. Vulnerabilidad de escalado de rutas absolutas en ciertos controles de ActiveX en el objeto CYFT del ft60.dll del Yahoo! Messenger 8.1.0.421 permite a atacantes remotos forzar una descarga y crear o sobrescribir ficheros de su elección a través de un nombre de ruta completa como segundo argumento del método GetFile. • https://www.exploit-db.com/exploits/4428 http://osvdb.org/38296 http://www.securityfocus.com/bid/25727 http://www.securitytracker.com/id?1018715 http://www.shinnai.altervista.org/exploits/txt/TXT_KJDPaI2IlM5P9PP6N6dI.html https://exchange.xforce.ibmcloud.com/vulnerabilities/36694 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 2CVE-2007-4635 – Yahoo! Messenger 8.1 - File Transfer Denial of Service
https://notcve.org/view.php?id=CVE-2007-4635
Yahoo! Messenger 8.1.0.209 and 8.1.0.402 allows remote attackers to cause a denial of service (application crash) via certain file-transfer packets, possibly involving a buffer overflow, as demonstrated by ym8bug.exe. NOTE: this might be related to CVE-2007-4515. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Yahoo! • https://www.exploit-db.com/exploits/30544 http://www.securityfocus.com/bid/25484 • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •