Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4
CVE-2021-36387
- EPSS 3.09%
- Veröffentlicht 14.10.2021 19:15:09
- Zuletzt bearbeitet 21.11.2024 06:13:39
In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4".
7.5
CVE-2021-36388
- EPSS 1.61%
- Veröffentlicht 14.10.2021 19:15:09
- Zuletzt bearbeitet 21.11.2024 06:13:39
In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".
7.5
CVE-2021-36389
- EPSS 3.02%
- Veröffentlicht 14.10.2021 19:15:09
- Zuletzt bearbeitet 21.11.2024 06:13:40
In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4".
1