CVE-2007-0768 Multiple cross-site scripting (XSS) vulnerabilities in the Contact Details functionality in Yahoo! Messenger 8.1.0.209 and earlier allow user-assisted remote attackers to inject arbitrary web script o...
MediumCVSS 4.3
EPSS 1.8%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Contact Details functionality in Yahoo! Messenger 8.1.0.209 and earlier allow user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG element to the (1) First Name, (2) Last Name, and (3) Nickname fields. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yahoo messenger | <= 8.1.0.209 | No fix listed |
References
- 31674 vdb-entry
- 23928 third-party-advisory vendor-advisory
- 20070126 Cross-site Scripting with Local Privilege Vulnerability in Yahoo Messenger mailing-list
- 20070127 RE: Cross-site Scripting with Local Privilege Vulnerability in Yahoo Messenger mailing-list
- 20070127 Re: Cross-site Scripting with Local Privilege Vulnerability in Yahoo Messenger mailing-list
- 22269 vdb-entry