PT-2009-6279 · Yoono · Yoono

Nick Freeman + 1 · Published 2009-11-28 · Updated 2024-03-12 · CVE-2009-4100

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Yoono extension versions prior to 6.1.1

Description The issue allows user-assisted remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via DOM event handlers such as onload. This is due to the extension performing certain operations with chrome privileges.

Recommendations For versions prior to 6.1.1, update to version 6.1.1 or later to resolve the issue. As a temporary workaround, consider disabling the Yoono extension until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-4100

ROSA-SA-2024-2370

Affected Products

Yoono

References · 57

• https://nvd.nist.gov/vuln/detail/CVE-2007-5274 · Security Note
• https://bdu.fstec.ru/vul/2015-02790 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-3478 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-1597 · Security Note
• https://bdu.fstec.ru/vul/2015-01739 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2003-1492 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-6715 · Security Note
• https://bdu.fstec.ru/vul/2015-02793 · Security Note
• https://bdu.fstec.ru/vul/2015-02789 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-1970 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-2794 · Security Note
• https://bdu.fstec.ru/vul/2015-06539 · Security Note
• https://bdu.fstec.ru/vul/2015-03444 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-4102 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-2404 · Security Note