Yahoo!: Read arbitrary ASCII files on YQL backend servers via XSLT unparsed-entity-uri() and parameter entities

Hacker discovered a vulnerability that allowed an unauthorized actor to read arbitrary ASCII files and list directories on the Yahoo Query Language YQL backend servers. This was achieved by leveraging the unparsed-entity-uri XSLT function and the dynamic declaration of unparsed XML entities when...