CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2012-2645
https://notcve.org/view.php?id=CVE-2012-2645
The Yahoo! Japan Yahoo! Browser application 1.2.0 and earlier for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application. La aplicación Navegador Yahoo! Yahoo! • http://jvn.jp/en/jp/JVN46088915/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2012-000070 http://secunia.com/advisories/49905 http://www.securityfocus.com/bid/54488 https://play.google.com/store/apps/details?id=jp.co.yahoo.android.ybrowser • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.1EPSS: 0%CPEs: 83EXPL: 0CVE-2012-0268
https://notcve.org/view.php?id=CVE-2012-0268
Integer overflow in the CYImage::LoadJPG method in YImage.dll in Yahoo! Messenger before 11.5.0.155, when photo sharing is enabled, might allow remote attackers to execute arbitrary code via a crafted JPG image that triggers a heap-based buffer overflow. Un desbordamiento de entero en el método CYImage::LoadJPG en YImage.dll en Yahoo! Messenger antes de v11.5.0.155, cuando la compartición fotos está activada, podría permitir a atacantes remotos ejecutar código de su elección a través de una imagen JPG modificada a mano que genera un desbordamiento de búfer basado en memoria dinámica(montículo). • http://secunia.com/advisories/47041 • CWE-189: Numeric Errors •
CVSS: 4.3EPSS: 0%CPEs: 15EXPL: 0CVE-2010-4710
https://notcve.org/view.php?id=CVE-2010-4710
Cross-site scripting (XSS) vulnerability in the addItem method in the Menu widget in YUI before 2.9.0 allows remote attackers to inject arbitrary web script or HTML via a field that is added to a menu, related to documentation that specifies this field as a text field rather than an HTML field, a similar issue to CVE-2010-4569 and CVE-2010-4570. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el accesorio Menu en YUI anteriores a v2.9.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un campo que se añade al menú, relacionado con la documentación que especifica que es un campo de texto más que un campo HTML, problema similar a CVE-2010-4569 y CVE-2010-4570. • http://yuilibrary.com/forum/viewtopic.php?p=12923 http://yuilibrary.com/projects/yui2/ticket/2529228 http://yuilibrary.com/projects/yui2/ticket/2529231 https://exchange.xforce.ibmcloud.com/vulnerabilities/65180 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2010-4207
https://notcve.org/view.php?id=CVE-2010-4207
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to charts/assets/charts.swf. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la infraestructura del componente de Flash en YUI v2.4.0 hasta v2.8.1, tal como se emplea en Bugzilla, Moodle y otros productos, permite a atacantes remotos inyectar secuencias de comandos web o HTML mediante vectores relacionados con charts/assets/charts.swf. • http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050813.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050820.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050830.html http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html http://moodle.org/mod/forum/discuss.php?d=160910 http://secunia.com/advisories/41955 http://secunia.com/advisories/42271 http://www.bugzilla.org/security/3.2.8 http://www& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2010-4209
https://notcve.org/view.php?id=CVE-2010-4209
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.8.1, as used in Bugzilla 3.7.1 through 3.7.3 and 4.1, allows remote attackers to inject arbitrary web script or HTML via vectors related to swfstore/swfstore.swf. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la infraestructura del componente de Flash en YUI v2.8.0 hasta v2.8.1, tal como se emplea en Bugzilla v3.7.1 hasta v3.7.3 y v4.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML mediante vectores relacionados con swfstore/swfstore.swf • http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050813.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050820.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050830.html http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html http://secunia.com/advisories/41955 http://secunia.com/advisories/42271 http://www.bugzilla.org/security/3.2.8 http://www.openwall.com/lists/oss-security/2010/11/07/1 http • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •