Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
yandex vulnerabilities and exploits
(subscribe to this query)
5.5
CVSSv2
CVE-2021-42387
Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a c...
Yandex Clickhouse
Debian Debian Linux 10.0
5.5
CVSSv2
CVE-2021-42388
Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a c...
Yandex Clickhouse
Debian Debian Linux 10.0
6.5
CVSSv2
CVE-2021-43304
Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t...
Yandex Clickhouse
Debian Debian Linux 10.0
1 Github repository
4.3
CVSSv2
CVE-2020-7363
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an malicious user to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior...
Ucweb Uc Browser
1 Article
4.3
CVSSv2
CVE-2020-7371
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an malicious user to obfuscate the true source of data as presented in the browser. This issue affects the RITS Browser version 3.3.9 and prior versions.
Raiseitsolutions Rits Browser
1 Article
4.3
CVSSv2
CVE-2020-9987
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 14.0. Visiting a malicious website may lead to address bar spoofing.
Apple Safari
1 Article
NA
CVE-2023-26531
Cross-Site Request Forgery (CSRF) vulnerability in ??? ?????????????-??Baidu/Google/Bing/IndexNow/Yandex/?? plugin <= 4.2.7 versions.
Wbolt All-in-one Search Automatic Push Management
5
CVSSv2
CVE-2011-4279
Moodle 2.0.x prior to 2.0.2 does not use the forceloginforprofiles setting for course-profiles access control, which makes it easier for remote malicious users to obtain potentially sensitive information via vectors involving use of a search engine, as demonstrated by the search ...
Moodle Moodle 2.0.1
Moodle Moodle 2.0.0
9.3
CVSSv2
CVE-2016-10626
mystem3 is a NodeJS wrapper for the Yandex MyStem 3. mystem3 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the at...
Mystem3 Project Mystem3
9.3
CVSSv2
CVE-2016-10662
tomita is a node wrapper for Yandex Tomita Parser tomita downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attac...
Tomita Project Tomita -
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-26925
CVE-2023-41826
LFI
CVE-2022-22364
CVE-2024-2887
command injection
remote code execution
CVE-2024-34446
CVE-2022-48699
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
NEXT »