PT-2009-6279 · Yoono · Yoono

Nick Freeman + 1 · Publicado 2009-11-28 · Atualizado 2024-03-12 · CVE-2009-4100

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Yoono extension versions prior to 6.1.1

Description The issue allows user-assisted remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via DOM event handlers such as onload. This is due to the extension performing certain operations with chrome privileges.

Recommendations For versions prior to 6.1.1, update to version 6.1.1 or later to resolve the issue. As a temporary workaround, consider disabling the Yoono extension until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-4100

ROSA-SA-2024-2370

Produtos afetados

Yoono

Referências · 57

• https://nvd.nist.gov/vuln/detail/CVE-2007-5274 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-02790 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2009-3478 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2009-1597 · Nota de Segurança
• http://securityfocus.com/archive/1/319919 · Nota
• http://vuln.sg/fireftp105-en.html · Nota
• https://bdu.fstec.ru/vul/2015-01739 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2003-1492 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2007-6715 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-02793 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-02789 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2007-1970 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2010-2794 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-06539 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-03444 · Nota de Segurança