Cross site scripting

Cross-site scripting XSS vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via the allowedDomain parameter...

CVE-2013-6780

Cross-site scripting XSS vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via the allowedDomain parameter...

CVE-2013-6780

Cross-site scripting XSS vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via the allowedDomain parameter...

CVE-2013-6780

CVE-2013-6780 is a cross-site scripting (XSS) vulnerability in Yahoo! YUI uploader.swf (Uploader component) affecting Yahoo! YUI versions 2.5.0 through 2.9.0. The flaw allows remote attackers to inject arbitrary web script or HTML via the allowedDomain parameter. Public writeups reference the vul...

CVE-2013-6780

Cross-site scripting XSS vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via the allowedDomain parameter...

PT-2013-6107

Name of the Vulnerable Software and Affected Versions Yahoo! YUI versions 2.5.0 through 2.9.0 Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the allowedDomain parameter in the Uploader component, specifically...

CVE-2013-6780: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via the allowedDomain parameter...

Yahoo Formally Launches Bug Bounty Program

As promised, Yahoo formally kicked off its bug bounty program late last week, aiming to correct what many in the security industry viewed as misstep after it handed out a paltry $12.50 credit to a researcher for discovering a cross-site scripting error. The company caught flak when in September...

Dennis Fisher and Mike Mimoso Discuss Truecrypt, iMessage Security and More

Dennis Fisher and Mike Mimoso discuss the big stories of the last couple of weeks, including the grassroots effort to audit the TrueCrypt source code, the Apple iMessage security model and Yahoo enabling SSL by default. Download: digitalunderground129.mp3...

HTTPS, SSL Minimal Security, Privacy Standard for Email

Yahoo is being second-guessed more today than a mediocre baseball manager. Two days after announcing it would finally turn SSL on by default for its email users starting in January, the company is getting a halfhearted pat on the back from the security industry, which can’t help but ask: “What to...

Yahoo Turns on SSL by Default for Email Users

Yahoo, one of the last email holdouts to implement SSL by default, announced it will do so in January. The company has been criticized as one of the few remaining giant Internet companies for its delay in turning on encryption by default for its web-based email users. It will now do so on Jan. 8,...

Yahoo is now offering up to $15,000 in bug bounty after policy review

Offering cash rewards for vulnerability reports has become something of a norm when it comes to big tech companies these days. Yahoo has changed its bug bounty policies following a deluge of negative feedback in the wake of the news that ethical hackers were rewarded with $12.50 in gift vouchers...

Yahoo Revamps Bug Bounty Vulnerability Rewards Program

Yahoo has promised to put the finishing touches on a new vulnerability reporting and rewards policy by Halloween after finding itself in the throes of a mini scandal this week over two $12.50 Yahoo company store discount codes handed out to one researcher in thanks for turning in a pair of...

Yahoo is now offering up to $15,000 in bug bounty after policy review

Offering cash rewards for vulnerability reports has become something of a norm when it comes to big tech companies these days. Yahoo has changed its bug bounty policies following a deluge of negative feedback in the wake of the news that ethical hackers were rewarded with $12.50 in gift vouchers...

Yahoo! discourages Security Researchers with just $12.50 bug bounty for vulnerability reporting

Today more and more companies are looking for external security researchers to help identify vulnerabilities and weaknesses in their applications through Bug Bounty Programs. While companies like Facebook and Google are paying out hundreds of dollars to researchers for reporting security...

Yahoo! discourages Security Researchers with just $12.50 bug bounty for vulnerability reporting

Today more and more companies are looking for external security researchers to help identify vulnerabilities and weaknesses in their applications through Bug Bounty Programs. While companies like Facebook and Google are paying out hundreds of dollars to researchers for reporting security...

Yahoo Transparency Report Reveals More Than 12K U.S. Government Data Requests

Following the lead of Google, Twitter and other major Internet companies, Yahoo has issued its first transparency report, revealing that it received more than 12,000 requests for user data from the U.S. government in the first half of 2013. The company disclosed user content in nearly a third of...

How I Got Here: Jeremiah Grossman

Dennis Fisher talks with Jeremiah Grossman about his days cobbling together old x8s machines, designing Web sites in the heyday of the spinning GIF, becoming Yahoo’s first hacker and then founding WhiteHat Security. Download: 09grossman.mp3...

CVE-2013-4700

The Yahoo! Japan Shopping application 1.4 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2013-4699

The Yahoo! Japan Yafuoku! application 4.3.0 and earlier for iOS and Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...