Kaspersky ID:
KLA10893
Дата обнаружения:
26/10/2016
Обновлено:
22/01/2024

Описание

Multiple serious vulnerabilities have been found in Yandex Browser. Malicious users can exploit these vulnerabilities to inject arbitrary code or obtain sensitive information.

Below is a complete list of vulnerabilities

  1. Cross-site scripting vulnerabilities at Translator and BookReader can be exploited to inject arbitrary JavaScript code;
  2. CSRF vulnerability at synchronization form can be exploited to obtain sensitive information;
  3. An unknown vulnerability at Anti-phishing warning can be exploited remotely to brute-force passwords via injected JavaScript;
  4. An unknown vulnerability at Security WiFi can be exploited remotely to obtain sensitive information.

Technical details

Vulnerability (2) can be exploited to steal data saved in browser profile.

Vulnerability (4) can be exploited to sniff traffic from open or protected wi-fi networks.

Первичный источник обнаружения

Связанные продукты

Список CVE

  • CVE-2016-8506
    warning
  • CVE-2016-8505
    warning
  • CVE-2016-8504
    warning
  • CVE-2016-8503
    warning
  • CVE-2016-8502
    warning
  • CVE-2016-8501
    warning

Смотрите также

Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com

Нашли неточность в описании этой уязвимости? Дайте нам знать!
Kaspersky IT Security Calculator:
Оцените ваш профиль кибербезопасности
Узнать больше
Встречай новый Kaspersky!
Каждая минута твоей онлайн-жизни заслуживает топовой защиты.
Узнать больше
Confirm changes?
Your message has been sent successfully.