Lucene search

K
YahooMessenger

33 matches found

CVE
CVE
added 2003/04/02 5:0 a.m.81 views

CVE-2002-0032

Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary script as other users via the addview parameter of a ymsgr URI.

7.5CVSS7.4AI score0.02942EPSS
CVE
CVE
added 2007/02/09 7:28 p.m.54 views

CVE-2007-0868

Unspecified vulnerability in the Chat Room functionality in Yahoo! Messenger 8.1.0.239 and earlier allows remote attackers to cause a denial of service via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

5CVSS6.5AI score0.00518EPSS
CVE
CVE
added 2002/06/25 4:0 a.m.53 views

CVE-2002-0320

Buffer overflow in Yahoo! Messenger 5.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long (1) message or (2) IMvironment field.

7.5CVSS8AI score0.10307EPSS
CVE
CVE
added 2012/01/19 3:55 p.m.52 views

CVE-2012-0268

Integer overflow in the CYImage::LoadJPG method in YImage.dll in Yahoo! Messenger before 11.5.0.155, when photo sharing is enabled, might allow remote attackers to execute arbitrary code via a crafted JPG image that triggers a heap-based buffer overflow.

5.1CVSS8AI score0.01579EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.51 views

CVE-2005-0737

Buffer overflow in Yahoo! Messenger allows remote attackers to execute arbitrary code via the offline mode.

7.5CVSS8.3AI score0.04788EPSS
CVE
CVE
added 2002/06/25 4:0 a.m.48 views

CVE-2002-0322

Yahoo! Messenger 4.0 sends user passwords in cleartext, which could allow remote attackers to gain privileges of other users via sniffing.

7.5CVSS6.9AI score0.00717EPSS
CVE
CVE
added 2005/05/10 4:0 a.m.48 views

CVE-2003-1135

Buffer overflow in Yahoo! Messenger 5.6 allows remote attackers to cause a denial of service (crash) via a file send request (sendfile) with a large number of "%" (percent) characters after the Yahoo ID.

2.6CVSS7.2AI score0.03339EPSS
CVE
CVE
added 2006/12/15 10:28 p.m.48 views

CVE-2006-6603

Buffer overflow in the YMMAPI.YMailAttach ActiveX control (ymmapi.dll) before 2005.1.1.4 in Yahoo! Messenger allows remote attackers to execute arbitrary code via a crafted HTML document. NOTE: some details were obtained from third party information.

9.3CVSS7.7AI score0.06449EPSS
CVE
CVE
added 2007/06/11 6:30 p.m.48 views

CVE-2007-3147

Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary code via a long server property value to the send method. NOTE: some of these details are obtained from third party information.

9.3CVSS7.8AI score0.58205EPSS
CVE
CVE
added 2007/04/06 1:19 a.m.47 views

CVE-2007-1680

Stack-based buffer overflow in the createAndJoinConference function in the AudioConf ActiveX control (yacscom.dll) in Yahoo! Messenger before 20070313 allows remote attackers to execute arbitrary code via long (1) socksHostname and (2) hostname properties.

9.3CVSS7.8AI score0.51546EPSS
CVE
CVE
added 2005/02/18 5:0 a.m.46 views

CVE-2005-0242

The Audio Setup Wizard (asw.dll) in Yahoo! Messenger 6.0.0.1750, and possibly other versions, allows attackers to arbitrary code by placing a malicious ping.exe program into the Messenger program directory, which is installed with weak default permissions.

4.6CVSS7.1AI score0.00056EPSS
CVE
CVE
added 2007/02/06 2:28 a.m.44 views

CVE-2007-0768

Multiple cross-site scripting (XSS) vulnerabilities in the Contact Details functionality in Yahoo! Messenger 8.1.0.209 and earlier allow user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG element to the (1) First Name, (2) Last...

4.3CVSS5.8AI score0.00658EPSS
CVE
CVE
added 2007/08/31 10:17 p.m.44 views

CVE-2007-4515

Buffer overflow in a certain ActiveX control in YVerInfo.dll before 2007.8.27.1 in the Yahoo! services suite for Yahoo! Messenger before 8.1.0.419 allows remote attackers to execute arbitrary code via unspecified vectors involving arguments to the (1) fvCom and (2) info methods. NOTE: some of these...

9.3CVSS7.8AI score0.72612EPSS
CVE
CVE
added 2007/09/20 9:17 p.m.44 views

CVE-2007-5017

Absolute path traversal vulnerability in a certain ActiveX control in the CYFT object in ft60.dll in Yahoo! Messenger 8.1.0.421 allows remote attackers to force a download, and create or overwrite arbitrary files via a full pathname in the second argument to the GetFile method.

5CVSS6.8AI score0.05367EPSS
CVE
CVE
added 2007/08/31 11:17 p.m.43 views

CVE-2007-4635

Yahoo! Messenger 8.1.0.209 and 8.1.0.402 allows remote attackers to cause a denial of service (application crash) via certain file-transfer packets, possibly involving a buffer overflow, as demonstrated by ym8bug.exe. NOTE: this might be related to CVE-2007-4515. NOTE: the provenance of this inform...

5CVSS6.6AI score0.72612EPSS
CVE
CVE
added 2007/08/17 10:17 p.m.42 views

CVE-2007-4391

Heap-based buffer overflow in Kakadu kdu_v32m.dll in Yahoo! Messenger 8.1.0.413 allows remote attackers to cause a denial of service (application crash) via a certain length field in JPEG2000 data, as demonstrated by sending an "invite to view my webcam" request, and then injecting a DLL into the a...

9.3CVSS7AI score0.17551EPSS
CVE
CVE
added 2002/06/25 4:0 a.m.41 views

CVE-2002-0321

Yahoo! Messenger 5.0 allows remote attackers to spoof other users by modifying the username and using the spoofed username for social engineering or denial of service (flooding) attacks.

5CVSS6.7AI score0.0233EPSS
CVE
CVE
added 2004/02/03 5:0 a.m.41 views

CVE-2004-0043

Buffer overflow in Yahoo Instant Messenger 5.6.0.1351 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long filename in the download feature.

7.5CVSS8.3AI score0.03243EPSS
CVE
CVE
added 2005/02/18 5:0 a.m.41 views

CVE-2005-0243

Yahoo! Messenger 6.0.0.1750, and possibly other versions before 6.0.0.1921, does not properly display long filenames in file dialog boxes, which could allow remote attackers to trick users into downloading and executing programs via file names containing a large number of spaces and multiple file e...

5CVSS6.7AI score0.00318EPSS
CVE
CVE
added 2006/06/29 1:5 a.m.41 views

CVE-2006-3298

Yahoo! Messenger 7.5.0.814 and 7.0.438 allows remote attackers to cause a denial of service (crash) via messages that contain non-ASCII characters, which triggers the crash in jscript.dll.

5CVSS7AI score0.04913EPSS
CVE
CVE
added 2015/09/11 8:59 p.m.41 views

CVE-2014-7216

Multiple stack-based buffer overflows in Yahoo! Messenger 11.5.0.228 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the (1) shortcut or (2) title keys in an emoticons.xml file.

9.3CVSS8AI score0.05592EPSS
CVE
CVE
added 2005/05/16 4:0 a.m.40 views

CVE-2005-1618

The YMSGR URL handler in Yahoo! Messenger 5.x through 6.0 allows remote attackers to cause a denial of service (disconnect) via a room login or a room join request packet with a third : (colon) and an & (ampersand), which causes Messenger to send a corrupted packet to the server, which triggers a d...

5CVSS7AI score0.04457EPSS
CVE
CVE
added 2005/05/19 4:0 a.m.40 views

CVE-2005-1671

The Logfile feature in Yahoo! Messenger 5.x through 6.0 can be activated by a YMSGR: URL and writes all output to a single ypager.log file, even when there are multiple users, and does not properly warn later users that the feature has been enabled, which allows local users to obtain sensitive info...

2.1CVSS6.1AI score0.00034EPSS
CVE
CVE
added 2007/06/11 6:30 p.m.40 views

CVE-2007-3148

Buffer overflow in the Yahoo! Webcam Viewer ActiveX control in ywcvwr.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary code via a long server property value to the receive method.

9.3CVSS7.7AI score0.38182EPSS
CVE
CVE
added 2005/05/28 4:0 a.m.39 views

CVE-2002-1664

Yahoo! Messenger before February 2002 allows remote attackers to add arbitrary users to another user's buddy list and possibly obtain sensitive information.

6.4CVSS7.2AI score0.01488EPSS
CVE
CVE
added 2007/07/21 12:30 a.m.39 views

CVE-2007-3928

Buffer overflow in Yahoo! Messenger 8.1 allows user-assisted remote authenticated users to execute arbitrary code via a long e-mail address in an address book entry. NOTE: this might overlap CVE-2007-3638.

7.6CVSS7.4AI score0.09377EPSS
CVE
CVE
added 2005/05/28 4:0 a.m.38 views

CVE-2002-1665

Buffer overflow in Yahoo! Messenger before February 2002 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long set_buddygrp field.

7.5CVSS8.4AI score0.04794EPSS
CVE
CVE
added 2009/12/02 7:30 p.m.38 views

CVE-2009-4171

An ActiveX control in YahooBridgeLib.dll for Yahoo! Messenger 9.0.0.2162, and possibly other 9.0 versions, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by calling the RegisterMe method with a long argument.

4.3CVSS6.8AI score0.03149EPSS
CVE
CVE
added 2007/10/29 7:0 p.m.37 views

CVE-2002-2361

The installer in Yahoo! Messenger 4.0, 5.0 and 5.5 does not verify package signatures which could allow remote attackers to install trojan programs via DNS spoofing.

5.8CVSS7.1AI score0.00274EPSS
CVE
CVE
added 2002/07/26 4:0 a.m.36 views

CVE-2002-0031

Buffer overflows in Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary code via a ymsgr URI with long arguments to (1) call, (2) sendim, (3) getimv, (4) chat, (5) addview, or (6) addfriend.

4.6CVSS7.7AI score0.21415EPSS
CVE
CVE
added 2006/09/25 1:7 a.m.36 views

CVE-2006-4975

Yahoo! Messenger for WAP permits saving messages that contain JavaScript, which allows user-assisted remote attackers to inject arbitrary web script or HTML via a URL at the online service.

2.6CVSS6.7AI score0.00323EPSS
CVE
CVE
added 2007/07/10 12:30 a.m.34 views

CVE-2007-3638

Buffer overflow in Yahoo! Messenger 8.1 allows user-assisted remote authenticated users, who are listed in an address book, to execute arbitrary code via unspecified vectors, aka ZD-00000005. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization tha...

6CVSS7.3AI score0.03758EPSS
CVE
CVE
added 2006/10/27 4:7 p.m.33 views

CVE-2006-5563

Unspecified vulnerability in Yahoo! Messenger (Service 18) before 8.1.0.195 allows remote attackers to cause a denial of service (NULL dereference and application crash) via a crafted room name in a Conference Invite. NOTE: the provenance of this information is unknown; the details are obtained fro...

5CVSS6.8AI score0.01224EPSS