Security feature bypass

Security WiFi bypass in Yandex Browser from version 15.10 to 15.12 allows remote attacker to sniff traffic in open or WEP-protected wi-fi networks despite of special security mechanism is enabled...

CVE-2016-8501

Security WiFi bypass in Yandex Browser from version 15.10 to 15.12 allows remote attacker to sniff traffic in open or WEP-protected wi-fi networks despite of special security mechanism is enabled...

Code injection

XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript code...

Cross site request forgery (csrf)

CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile...

Design/Logic Flaw

Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript...

Design/Logic Flaw

Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript...

CVE-2016-8501

Security WiFi bypass in Yandex Browser from version 15.10 to 15.12 allows remote attacker to sniff traffic in open or WEP-protected wi-fi networks despite of special security mechanism is enabled...

CVE-2016-8504

CVE-2016-8504 describes a Cross-Site Request Forgery in the Yandex Browser desktop synchronization form prior to version 16.6, which could allow a remote attacker to steal data saved in the browser profile. Root cause: CSRF on the synchronization form. Affected product: Yandex Browser for desktop...

CVE-2016-8504

CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile...

CVE-2016-8505

Vulnerability summary (CVE-2016-8505) : A cross-site scripting flaw in Yandex Browser for desktop, specifically in BookReader, affects versions prior to 16.6. A remote attacker could execute arbitrary JavaScript in the context of BookReader. The issue is tied to the BookReader component of Yandex...

CVE-2016-8505

XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript code...

CVE-2016-8503

CVE-2016-8503 affects Yandex Browser for desktop with Yandex Protect Anti-phishing warning (versions before 16.9, 16.7–16.9 range). Connected sources corroborate a remote attacker could use JavaScript in conjunction with the anti-phishing warning to brute-force passwords on important web-resource...

CVE-2016-8506

XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code...

CVE-2016-8506

CVE-2016-8506 affects Yandex Browser for desktop, specifically the Translator component. The vulnerability is an Cross-Site Scripting flaw in Yandex Browser Translator present in versions 15.12 through 16.2, allowing a remote attacker to execute arbitrary JavaScript. No patch/version remediation ...

CVE-2016-8502

Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript...

CVE-2016-8501

Security WiFi bypass in Yandex Browser from version 15.10 to 15.12 allows remote attacker to sniff traffic in open or WEP-protected wi-fi networks despite of special security mechanism is enabled...

CVE-2016-8502

CVE-2016-8502 concerns Yandex Browser (desktop) where the Yandex Protect Anti-phishing warning, in versions 15.12.0 to 16.2, could be exploited by a remote attacker to brute-force passwords on important web resources via crafted JavaScript. The issue is described as an authentication bypass/anti-...

CVE-2016-8501

CVE-2016-8501 relates to a security bypass in Yandex Browser that could allow a remote attacker to sniff traffic over open or wireless networks. Connected sources indicate the issue manifests as a security bypass enabling interception of network traffic in certain Wi‑Fi scenarios. Affected produc...

CVE-2016-8503

Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript...

KLA10893 Multiple vulnerabilities in Yandex browser

Multiple serious vulnerabilities have been found in Yandex Browser. Malicious users can exploit these vulnerabilities to inject arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities 1. Cross-site scripting vulnerabilities at Translator and BookReader can be...