Cross site scripting

Cross-site scripting XSS vulnerability in the mycodeparsevideo function in inc/classparser.php in MyBB aka MyBulletinBoard before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via vectors related to Yahoo video URLs...

CVE-2013-7288

Cross-site scripting XSS vulnerability in the mycodeparsevideo function in inc/classparser.php in MyBB aka MyBulletinBoard before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via vectors related to Yahoo video URLs...

CVE-2013-7288

The CVE-2013-7288 entry concerns MyBB (MyBulletinBoard)

CVE-2013-7288: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the mycodeparsevideo function in inc/classparser.php in MyBB aka MyBulletinBoard before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via vectors related to Yahoo video URLs...

PT-2014-3334

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.6.12 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is related to the handling of Yahoo video URLs in the mycode parse video function...

Yahoo Encryption Slammed for Lack of Forward Secrecy, HSTS

Yahoo, as promised, rolled out HTTPs by default this week for its email service, bringing it in line with other Internet companies that have been securing users’ communication for years. But if Yahoo expected applause from security experts, it can think again. The response from those well-versed ...

Yahoo Mail turns on HTTPS encryption by default to protect users

After the release of NSA Secret spying over Internet communications, I am expecting from all tech companies to make surveillance significantly harder. Yahoo has HTTPS encryption support since late 2012, but users had to opt in to use the feature. Documents revealed by the Edward Snowden shows tha...

DailyMotion Hosting Malvertising Leading to Fake AV Attack

Video-sharing site DailyMotion, one of the most popular destinations on the Web, is in the throes of an attack where it is serving malicious ads redirecting users to a fake AV scam. Security firm Invincea reported the issue to the website, and as of 4 p.m. ET, DailyMotion was still serving the fa...

Tajikistan Domain Registrar hacked; Google, Yahoo, Twitter, Amazon also defaced

Google’s primary search domain for Tajikistan had seemingly been hacked yesterday, along with other high profile domains including Yahoo, Twitter, Amazon -- redirected to a defaced page. Actually neither Google, nor Twitter servers have been hacked, rather website of Tajikistan's Domain registrar...

Yahoo Removes Ads Redirecting to Magnitude Exploit Kit

The race to replace the Blackhole Exploit Kit as the web exploit pack of choice for cybercriminals seems to have an early leader in Magnitude. Researchers at Dutch security firm Fox-IT reported over the weekend that European visitors to Yahoo were falling victim to malicious ads hosted on the sit...

Yahoo Ad Network abused to redirect users to malicious websites serving Magnitude Exploit Kit

Internet advertisement networks provide hackers with an effective venue for targeting wide range computers through malicious advertisements. Previously it was reported by some security researchers that Yahoo's online advertising Network is one of the top ad networks were being abused to spread...

Cross site scripting

Cross-site scripting XSS vulnerability in the Yahoo! User Interface Library in Cybozu Garoon before 3.7.2, when Internet Explorer 9 or 10 or Chrome is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6916

CVE-2013-6916 covers multiple XSS vulnerabilities in Cybozu Garoon’s Yahoo! UI Library prior to 3.7.2, exploitable when using IE9/10 or Chrome. Attackers could inject arbitrary script/HTML via unspecified vectors in the web application. Connected sources (JVN entries) confirm Cybozu Garoon 3.7.2-...

CVE-2013-6916

Cross-site scripting XSS vulnerability in the Yahoo! User Interface Library in Cybozu Garoon before 3.7.2, when Internet Explorer 9 or 10 or Chrome is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6916: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Yahoo! User Interface Library in Cybozu Garoon before 3.7.2, when Internet Explorer 9 or 10 or Chrome is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Pony Botnet Controller Has 2 Million Stolen, Weak Passwords

So what’s worse: Finding two million passwords harvested by a botnet, or learning that most of the stolen passwords are terribly weak? Researchers at Trustwave found another Pony botnet controller recently that oversees a trove of close to two million website logins, email account credentials, as...

Fedora 19 : moodle-2.4.7-1.fc19 (2013-21397)

Latest upstreams, multiple security fixes. Name: CVE-2013-6780 URL: https://vulners.com/cve/CVE-2013-6780 Assigned: 20131112 Reference: https://yuilibrary.com/support/20131111-vulnerability/ Cross-site scripting XSS vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 throu...

Fedora 20 : moodle-2.5.3-1.fc20 (2013-21312)

Latest upstreams, multiple security fixes. Name: CVE-2013-6780 URL: https://vulners.com/cve/CVE-2013-6780 Assigned: 20131112 Reference: https://yuilibrary.com/support/20131111-vulnerability/ Cross-site scripting XSS vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 throu...

Yahoo to Give Users Option for SSL on All Web Properties

Following months of criticism from security experts and privacy advocates for not deploying SSL across its Web offerings, Yahoo on Monday announced that it will be giving users the option to encrypt all of the data they exchange with the company by the end of the first quarter next year. The chan...

CVE-2013-6780

Cross-site scripting XSS vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via the allowedDomain parameter...