Yahoo! Messenger before February 2002 allows remote malicious users to add arbitrary users to another user's buddy list and possibly obtain sensitive information.
yahoo messenger 5.0