Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

14 vulnerabilities found for Yandex Browser for desktop by Yandex N.V.

CVE-2017-7327 (GCVE-0-2017-7327)

Vulnerability from nvd – Published: 2018-01-19 17:00 – Updated: 2024-09-16 21:57
VLAI?
Summary
Yandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path is used for dnsapi.dll, winmm.dll, ntmarta.dll, cryptbase.dll or profapi.dll.
Severity ?
No CVSS data available.
CWE
  • Dll hijacking
Assigner
References
Impacted products
Vendor Product Version
Yandex N.V. Yandex Browser for Desktop Affected: All versions prior to version 17.4.1
Create a notification for this product.
Date Public ?
2018-01-18 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:56:36.464Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://browser.yandex.com/security/changelogs/fixed-in-version-17-4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Yandex Browser for Desktop",
          "vendor": "Yandex N.V.",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to version 17.4.1"
            }
          ]
        }
      ],
      "datePublic": "2018-01-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Yandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path is used for dnsapi.dll, winmm.dll, ntmarta.dll, cryptbase.dll or profapi.dll."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Dll hijacking",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-19T16:57:01.000Z",
        "orgId": "a51c9250-e584-488d-808b-03e6f1386796",
        "shortName": "yandex"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://browser.yandex.com/security/changelogs/fixed-in-version-17-4"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "browser-security@yandex-team.ru",
          "DATE_PUBLIC": "2018-01-18T00:00:00",
          "ID": "CVE-2017-7327",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Yandex Browser for Desktop",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions prior to version 17.4.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yandex N.V."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Yandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path is used for dnsapi.dll, winmm.dll, ntmarta.dll, cryptbase.dll or profapi.dll."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Dll hijacking"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://browser.yandex.com/security/changelogs/fixed-in-version-17-4",
              "refsource": "CONFIRM",
              "url": "https://browser.yandex.com/security/changelogs/fixed-in-version-17-4"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796",
    "assignerShortName": "yandex",
    "cveId": "CVE-2017-7327",
    "datePublished": "2018-01-19T17:00:00.000Z",
    "dateReserved": "2017-03-30T00:00:00.000Z",
    "dateUpdated": "2024-09-16T21:57:43.175Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8508 (GCVE-0-2016-8508)

Vulnerability from nvd – Published: 2017-03-01 15:00 – Updated: 2024-08-06 02:27
VLAI?
Summary
Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special content-type, which could be used by remote attacker for prevention Protect warning on own malicious web-site.
Severity ?
No CVSS data available.
CWE
  • Yandex Browser Protect mechanism bypass
Assigner
References
Impacted products
Vendor Product Version
Yandex N.V. Yandex Browser for desktop Affected: before 17.1.1.227 for OSx and Windows
Create a notification for this product.
Date Public ?
2017-02-27 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:40.931Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "96514",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96514"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://yandex.com/blog/security-changelogs/fixed-in-version-17-1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Yandex Browser for desktop",
          "vendor": "Yandex N.V.",
          "versions": [
            {
              "status": "affected",
              "version": "before 17.1.1.227 for OSx and Windows"
            }
          ]
        }
      ],
      "datePublic": "2017-02-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special content-type, which could be used by remote attacker for prevention Protect warning on own malicious web-site."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Yandex Browser Protect mechanism bypass",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-03-03T10:57:02.000Z",
        "orgId": "a51c9250-e584-488d-808b-03e6f1386796",
        "shortName": "yandex"
      },
      "references": [
        {
          "name": "96514",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96514"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://yandex.com/blog/security-changelogs/fixed-in-version-17-1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "browser-security@yandex-team.ru",
          "ID": "CVE-2016-8508",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Yandex Browser for desktop",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 17.1.1.227 for OSx and Windows"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yandex N.V."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special content-type, which could be used by remote attacker for prevention Protect warning on own malicious web-site."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Yandex Browser Protect mechanism bypass"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "96514",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96514"
            },
            {
              "name": "https://yandex.com/blog/security-changelogs/fixed-in-version-17-1",
              "refsource": "CONFIRM",
              "url": "https://yandex.com/blog/security-changelogs/fixed-in-version-17-1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796",
    "assignerShortName": "yandex",
    "cveId": "CVE-2016-8508",
    "datePublished": "2017-03-01T15:00:00.000Z",
    "dateReserved": "2016-10-07T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:27:40.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8506 (GCVE-0-2016-8506)

Vulnerability from nvd – Published: 2016-10-26 18:00 – Updated: 2024-08-06 02:27
VLAI?
Summary
XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code.
Severity ?
No CVSS data available.
CWE
  • Yandex Browser Translater XSS
Assigner
References
Impacted products
Vendor Product Version
Yandex N.V. Yandex Browser for desktop Affected: 15.12 to 16.2 for OSx and Linux
Create a notification for this product.
Date Public ?
2016-10-25 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:40.870Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://browser.yandex.com/security/changelogs/"
          },
          {
            "name": "93927",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93927"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Yandex Browser for desktop",
          "vendor": "Yandex N.V.",
          "versions": [
            {
              "status": "affected",
              "version": "15.12 to 16.2 for OSx and Linux"
            }
          ]
        }
      ],
      "datePublic": "2016-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Yandex Browser Translater XSS",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "a51c9250-e584-488d-808b-03e6f1386796",
        "shortName": "yandex"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://browser.yandex.com/security/changelogs/"
        },
        {
          "name": "93927",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93927"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "browser-security@yandex-team.ru",
          "ID": "CVE-2016-8506",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Yandex Browser for desktop",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "15.12 to 16.2 for OSx and Linux"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yandex N.V."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Yandex Browser Translater XSS"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://browser.yandex.com/security/changelogs/",
              "refsource": "CONFIRM",
              "url": "https://browser.yandex.com/security/changelogs/"
            },
            {
              "name": "93927",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93927"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796",
    "assignerShortName": "yandex",
    "cveId": "CVE-2016-8506",
    "datePublished": "2016-10-26T18:00:00.000Z",
    "dateReserved": "2016-10-07T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:27:40.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8505 (GCVE-0-2016-8505)

Vulnerability from nvd – Published: 2016-10-26 18:00 – Updated: 2024-08-06 02:27
VLAI?
Summary
XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript code.
Severity ?
No CVSS data available.
CWE
  • Yandex Browser BookReader XSS
Assigner
References
Impacted products
Vendor Product Version
Yandex N.V. Yandex Browser for desktop Affected: before 16.6 for OSx and Windows
Create a notification for this product.
Date Public ?
2016-10-25 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:39.642Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "93925",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93925"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://browser.yandex.com/security/changelogs/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Yandex Browser for desktop",
          "vendor": "Yandex N.V.",
          "versions": [
            {
              "status": "affected",
              "version": "before 16.6 for OSx and Windows"
            }
          ]
        }
      ],
      "datePublic": "2016-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Yandex Browser BookReader XSS",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "a51c9250-e584-488d-808b-03e6f1386796",
        "shortName": "yandex"
      },
      "references": [
        {
          "name": "93925",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93925"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://browser.yandex.com/security/changelogs/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "browser-security@yandex-team.ru",
          "ID": "CVE-2016-8505",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Yandex Browser for desktop",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 16.6 for OSx and Windows"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yandex N.V."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript code."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Yandex Browser BookReader XSS"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "93925",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93925"
            },
            {
              "name": "https://browser.yandex.com/security/changelogs/",
              "refsource": "CONFIRM",
              "url": "https://browser.yandex.com/security/changelogs/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796",
    "assignerShortName": "yandex",
    "cveId": "CVE-2016-8505",
    "datePublished": "2016-10-26T18:00:00.000Z",
    "dateReserved": "2016-10-07T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:27:39.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8504 (GCVE-0-2016-8504)

Vulnerability from nvd – Published: 2016-10-26 18:00 – Updated: 2024-08-06 02:27
VLAI?
Summary
CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile.
Severity ?
No CVSS data available.
CWE
  • Profile synchronization form CSRF
Assigner
References
Impacted products
Vendor Product Version
Yandex N.V. Yandex Browser for desktop Affected: before 16.6 for OSx and Windows
Create a notification for this product.
Date Public ?
2016-10-25 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:40.997Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "93924",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93924"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://browser.yandex.com/security/changelogs/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Yandex Browser for desktop",
          "vendor": "Yandex N.V.",
          "versions": [
            {
              "status": "affected",
              "version": "before 16.6 for OSx and Windows"
            }
          ]
        }
      ],
      "datePublic": "2016-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Profile synchronization form CSRF",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "a51c9250-e584-488d-808b-03e6f1386796",
        "shortName": "yandex"
      },
      "references": [
        {
          "name": "93924",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93924"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://browser.yandex.com/security/changelogs/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "browser-security@yandex-team.ru",
          "ID": "CVE-2016-8504",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Yandex Browser for desktop",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 16.6 for OSx and Windows"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yandex N.V."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Profile synchronization form CSRF"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "93924",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93924"
            },
            {
              "name": "https://browser.yandex.com/security/changelogs/",
              "refsource": "CONFIRM",
              "url": "https://browser.yandex.com/security/changelogs/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796",
    "assignerShortName": "yandex",
    "cveId": "CVE-2016-8504",
    "datePublished": "2016-10-26T18:00:00.000Z",
    "dateReserved": "2016-10-07T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:27:40.997Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8503 (GCVE-0-2016-8503)

Vulnerability from nvd – Published: 2016-10-26 18:00 – Updated: 2024-08-06 02:27
VLAI?
Summary
Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript.
Severity ?
No CVSS data available.
CWE
  • Password brute-force through Yandex Protect Anti-phishing message
Assigner
References
Impacted products
Vendor Product Version
Yandex N.V. Yandex Browser for desktop Affected: 16.7 to 16.9 for Windows and OSx.
Create a notification for this product.
Date Public ?
2016-10-25 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:39.638Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "93921",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93921"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://browser.yandex.com/security/changelogs/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Yandex Browser for desktop",
          "vendor": "Yandex N.V.",
          "versions": [
            {
              "status": "affected",
              "version": "16.7 to 16.9 for Windows and OSx."
            }
          ]
        }
      ],
      "datePublic": "2016-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Password brute-force through Yandex Protect Anti-phishing message",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "a51c9250-e584-488d-808b-03e6f1386796",
        "shortName": "yandex"
      },
      "references": [
        {
          "name": "93921",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93921"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://browser.yandex.com/security/changelogs/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "browser-security@yandex-team.ru",
          "ID": "CVE-2016-8503",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Yandex Browser for desktop",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "16.7 to 16.9 for Windows and OSx."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yandex N.V."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Password brute-force through Yandex Protect Anti-phishing message"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "93921",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93921"
            },
            {
              "name": "https://browser.yandex.com/security/changelogs/",
              "refsource": "CONFIRM",
              "url": "https://browser.yandex.com/security/changelogs/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796",
    "assignerShortName": "yandex",
    "cveId": "CVE-2016-8503",
    "datePublished": "2016-10-26T18:00:00.000Z",
    "dateReserved": "2016-10-07T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:27:39.638Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8502 (GCVE-0-2016-8502)

Vulnerability from nvd – Published: 2016-10-26 18:00 – Updated: 2024-08-06 02:27
VLAI?
Summary
Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript.
Severity ?
No CVSS data available.
CWE
  • Password brute-force through Yandex Protect Anti-phishing message
Assigner
References
Impacted products
Vendor Product Version
Yandex N.V. Yandex Browser for desktop Affected: 15.12.0 to 16.2 for Windows and OSx.
Create a notification for this product.
Date Public ?
2016-10-25 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:40.173Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "93923",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93923"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://browser.yandex.com/security/changelogs/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Yandex Browser for desktop",
          "vendor": "Yandex N.V.",
          "versions": [
            {
              "status": "affected",
              "version": "15.12.0 to 16.2 for Windows and OSx."
            }
          ]
        }
      ],
      "datePublic": "2016-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Password brute-force through Yandex Protect Anti-phishing message",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "a51c9250-e584-488d-808b-03e6f1386796",
        "shortName": "yandex"
      },
      "references": [
        {
          "name": "93923",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93923"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://browser.yandex.com/security/changelogs/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "browser-security@yandex-team.ru",
          "ID": "CVE-2016-8502",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Yandex Browser for desktop",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "15.12.0 to 16.2 for Windows and OSx."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yandex N.V."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Password brute-force through Yandex Protect Anti-phishing message"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "93923",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93923"
            },
            {
              "name": "https://browser.yandex.com/security/changelogs/",
              "refsource": "CONFIRM",
              "url": "https://browser.yandex.com/security/changelogs/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796",
    "assignerShortName": "yandex",
    "cveId": "CVE-2016-8502",
    "datePublished": "2016-10-26T18:00:00.000Z",
    "dateReserved": "2016-10-07T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:27:40.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7327 (GCVE-0-2017-7327)

Vulnerability from cvelistv5 – Published: 2018-01-19 17:00 – Updated: 2024-09-16 21:57
VLAI?
Summary
Yandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path is used for dnsapi.dll, winmm.dll, ntmarta.dll, cryptbase.dll or profapi.dll.
Severity ?
No CVSS data available.
CWE
  • Dll hijacking
Assigner
References
Impacted products
Vendor Product Version
Yandex N.V. Yandex Browser for Desktop Affected: All versions prior to version 17.4.1
Create a notification for this product.
Date Public ?
2018-01-18 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:56:36.464Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://browser.yandex.com/security/changelogs/fixed-in-version-17-4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Yandex Browser for Desktop",
          "vendor": "Yandex N.V.",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to version 17.4.1"
            }
          ]
        }
      ],
      "datePublic": "2018-01-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Yandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path is used for dnsapi.dll, winmm.dll, ntmarta.dll, cryptbase.dll or profapi.dll."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Dll hijacking",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-19T16:57:01.000Z",
        "orgId": "a51c9250-e584-488d-808b-03e6f1386796",
        "shortName": "yandex"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://browser.yandex.com/security/changelogs/fixed-in-version-17-4"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "browser-security@yandex-team.ru",
          "DATE_PUBLIC": "2018-01-18T00:00:00",
          "ID": "CVE-2017-7327",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Yandex Browser for Desktop",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions prior to version 17.4.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yandex N.V."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Yandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path is used for dnsapi.dll, winmm.dll, ntmarta.dll, cryptbase.dll or profapi.dll."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Dll hijacking"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://browser.yandex.com/security/changelogs/fixed-in-version-17-4",
              "refsource": "CONFIRM",
              "url": "https://browser.yandex.com/security/changelogs/fixed-in-version-17-4"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796",
    "assignerShortName": "yandex",
    "cveId": "CVE-2017-7327",
    "datePublished": "2018-01-19T17:00:00.000Z",
    "dateReserved": "2017-03-30T00:00:00.000Z",
    "dateUpdated": "2024-09-16T21:57:43.175Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8508 (GCVE-0-2016-8508)

Vulnerability from cvelistv5 – Published: 2017-03-01 15:00 – Updated: 2024-08-06 02:27
VLAI?
Summary
Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special content-type, which could be used by remote attacker for prevention Protect warning on own malicious web-site.
Severity ?
No CVSS data available.
CWE
  • Yandex Browser Protect mechanism bypass
Assigner
References
Impacted products
Vendor Product Version
Yandex N.V. Yandex Browser for desktop Affected: before 17.1.1.227 for OSx and Windows
Create a notification for this product.
Date Public ?
2017-02-27 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:40.931Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "96514",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96514"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://yandex.com/blog/security-changelogs/fixed-in-version-17-1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Yandex Browser for desktop",
          "vendor": "Yandex N.V.",
          "versions": [
            {
              "status": "affected",
              "version": "before 17.1.1.227 for OSx and Windows"
            }
          ]
        }
      ],
      "datePublic": "2017-02-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special content-type, which could be used by remote attacker for prevention Protect warning on own malicious web-site."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Yandex Browser Protect mechanism bypass",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-03-03T10:57:02.000Z",
        "orgId": "a51c9250-e584-488d-808b-03e6f1386796",
        "shortName": "yandex"
      },
      "references": [
        {
          "name": "96514",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96514"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://yandex.com/blog/security-changelogs/fixed-in-version-17-1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "browser-security@yandex-team.ru",
          "ID": "CVE-2016-8508",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Yandex Browser for desktop",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 17.1.1.227 for OSx and Windows"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yandex N.V."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special content-type, which could be used by remote attacker for prevention Protect warning on own malicious web-site."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Yandex Browser Protect mechanism bypass"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "96514",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96514"
            },
            {
              "name": "https://yandex.com/blog/security-changelogs/fixed-in-version-17-1",
              "refsource": "CONFIRM",
              "url": "https://yandex.com/blog/security-changelogs/fixed-in-version-17-1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796",
    "assignerShortName": "yandex",
    "cveId": "CVE-2016-8508",
    "datePublished": "2017-03-01T15:00:00.000Z",
    "dateReserved": "2016-10-07T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:27:40.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8504 (GCVE-0-2016-8504)

Vulnerability from cvelistv5 – Published: 2016-10-26 18:00 – Updated: 2024-08-06 02:27
VLAI?
Summary
CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile.
Severity ?
No CVSS data available.
CWE
  • Profile synchronization form CSRF
Assigner
References
Impacted products
Vendor Product Version
Yandex N.V. Yandex Browser for desktop Affected: before 16.6 for OSx and Windows
Create a notification for this product.
Date Public ?
2016-10-25 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:40.997Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "93924",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93924"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://browser.yandex.com/security/changelogs/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Yandex Browser for desktop",
          "vendor": "Yandex N.V.",
          "versions": [
            {
              "status": "affected",
              "version": "before 16.6 for OSx and Windows"
            }
          ]
        }
      ],
      "datePublic": "2016-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Profile synchronization form CSRF",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "a51c9250-e584-488d-808b-03e6f1386796",
        "shortName": "yandex"
      },
      "references": [
        {
          "name": "93924",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93924"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://browser.yandex.com/security/changelogs/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "browser-security@yandex-team.ru",
          "ID": "CVE-2016-8504",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Yandex Browser for desktop",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 16.6 for OSx and Windows"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yandex N.V."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Profile synchronization form CSRF"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "93924",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93924"
            },
            {
              "name": "https://browser.yandex.com/security/changelogs/",
              "refsource": "CONFIRM",
              "url": "https://browser.yandex.com/security/changelogs/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796",
    "assignerShortName": "yandex",
    "cveId": "CVE-2016-8504",
    "datePublished": "2016-10-26T18:00:00.000Z",
    "dateReserved": "2016-10-07T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:27:40.997Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8502 (GCVE-0-2016-8502)

Vulnerability from cvelistv5 – Published: 2016-10-26 18:00 – Updated: 2024-08-06 02:27
VLAI?
Summary
Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript.
Severity ?
No CVSS data available.
CWE
  • Password brute-force through Yandex Protect Anti-phishing message
Assigner
References
Impacted products
Vendor Product Version
Yandex N.V. Yandex Browser for desktop Affected: 15.12.0 to 16.2 for Windows and OSx.
Create a notification for this product.
Date Public ?
2016-10-25 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:40.173Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "93923",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93923"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://browser.yandex.com/security/changelogs/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Yandex Browser for desktop",
          "vendor": "Yandex N.V.",
          "versions": [
            {
              "status": "affected",
              "version": "15.12.0 to 16.2 for Windows and OSx."
            }
          ]
        }
      ],
      "datePublic": "2016-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Password brute-force through Yandex Protect Anti-phishing message",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "a51c9250-e584-488d-808b-03e6f1386796",
        "shortName": "yandex"
      },
      "references": [
        {
          "name": "93923",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93923"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://browser.yandex.com/security/changelogs/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "browser-security@yandex-team.ru",
          "ID": "CVE-2016-8502",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Yandex Browser for desktop",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "15.12.0 to 16.2 for Windows and OSx."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yandex N.V."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Password brute-force through Yandex Protect Anti-phishing message"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "93923",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93923"
            },
            {
              "name": "https://browser.yandex.com/security/changelogs/",
              "refsource": "CONFIRM",
              "url": "https://browser.yandex.com/security/changelogs/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796",
    "assignerShortName": "yandex",
    "cveId": "CVE-2016-8502",
    "datePublished": "2016-10-26T18:00:00.000Z",
    "dateReserved": "2016-10-07T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:27:40.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8503 (GCVE-0-2016-8503)

Vulnerability from cvelistv5 – Published: 2016-10-26 18:00 – Updated: 2024-08-06 02:27
VLAI?
Summary
Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript.
Severity ?
No CVSS data available.
CWE
  • Password brute-force through Yandex Protect Anti-phishing message
Assigner
References
Impacted products
Vendor Product Version
Yandex N.V. Yandex Browser for desktop Affected: 16.7 to 16.9 for Windows and OSx.
Create a notification for this product.
Date Public ?
2016-10-25 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:39.638Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "93921",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93921"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://browser.yandex.com/security/changelogs/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Yandex Browser for desktop",
          "vendor": "Yandex N.V.",
          "versions": [
            {
              "status": "affected",
              "version": "16.7 to 16.9 for Windows and OSx."
            }
          ]
        }
      ],
      "datePublic": "2016-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Password brute-force through Yandex Protect Anti-phishing message",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "a51c9250-e584-488d-808b-03e6f1386796",
        "shortName": "yandex"
      },
      "references": [
        {
          "name": "93921",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93921"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://browser.yandex.com/security/changelogs/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "browser-security@yandex-team.ru",
          "ID": "CVE-2016-8503",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Yandex Browser for desktop",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "16.7 to 16.9 for Windows and OSx."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yandex N.V."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Password brute-force through Yandex Protect Anti-phishing message"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "93921",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93921"
            },
            {
              "name": "https://browser.yandex.com/security/changelogs/",
              "refsource": "CONFIRM",
              "url": "https://browser.yandex.com/security/changelogs/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796",
    "assignerShortName": "yandex",
    "cveId": "CVE-2016-8503",
    "datePublished": "2016-10-26T18:00:00.000Z",
    "dateReserved": "2016-10-07T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:27:39.638Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8505 (GCVE-0-2016-8505)

Vulnerability from cvelistv5 – Published: 2016-10-26 18:00 – Updated: 2024-08-06 02:27
VLAI?
Summary
XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript code.
Severity ?
No CVSS data available.
CWE
  • Yandex Browser BookReader XSS
Assigner
References
Impacted products
Vendor Product Version
Yandex N.V. Yandex Browser for desktop Affected: before 16.6 for OSx and Windows
Create a notification for this product.
Date Public ?
2016-10-25 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:39.642Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "93925",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93925"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://browser.yandex.com/security/changelogs/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Yandex Browser for desktop",
          "vendor": "Yandex N.V.",
          "versions": [
            {
              "status": "affected",
              "version": "before 16.6 for OSx and Windows"
            }
          ]
        }
      ],
      "datePublic": "2016-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Yandex Browser BookReader XSS",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "a51c9250-e584-488d-808b-03e6f1386796",
        "shortName": "yandex"
      },
      "references": [
        {
          "name": "93925",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93925"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://browser.yandex.com/security/changelogs/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "browser-security@yandex-team.ru",
          "ID": "CVE-2016-8505",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Yandex Browser for desktop",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 16.6 for OSx and Windows"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yandex N.V."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript code."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Yandex Browser BookReader XSS"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "93925",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93925"
            },
            {
              "name": "https://browser.yandex.com/security/changelogs/",
              "refsource": "CONFIRM",
              "url": "https://browser.yandex.com/security/changelogs/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796",
    "assignerShortName": "yandex",
    "cveId": "CVE-2016-8505",
    "datePublished": "2016-10-26T18:00:00.000Z",
    "dateReserved": "2016-10-07T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:27:39.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8506 (GCVE-0-2016-8506)

Vulnerability from cvelistv5 – Published: 2016-10-26 18:00 – Updated: 2024-08-06 02:27
VLAI?
Summary
XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code.
Severity ?
No CVSS data available.
CWE
  • Yandex Browser Translater XSS
Assigner
References
Impacted products
Vendor Product Version
Yandex N.V. Yandex Browser for desktop Affected: 15.12 to 16.2 for OSx and Linux
Create a notification for this product.
Date Public ?
2016-10-25 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:40.870Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://browser.yandex.com/security/changelogs/"
          },
          {
            "name": "93927",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93927"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Yandex Browser for desktop",
          "vendor": "Yandex N.V.",
          "versions": [
            {
              "status": "affected",
              "version": "15.12 to 16.2 for OSx and Linux"
            }
          ]
        }
      ],
      "datePublic": "2016-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Yandex Browser Translater XSS",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01.000Z",
        "orgId": "a51c9250-e584-488d-808b-03e6f1386796",
        "shortName": "yandex"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://browser.yandex.com/security/changelogs/"
        },
        {
          "name": "93927",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93927"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "browser-security@yandex-team.ru",
          "ID": "CVE-2016-8506",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Yandex Browser for desktop",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "15.12 to 16.2 for OSx and Linux"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yandex N.V."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Yandex Browser Translater XSS"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://browser.yandex.com/security/changelogs/",
              "refsource": "CONFIRM",
              "url": "https://browser.yandex.com/security/changelogs/"
            },
            {
              "name": "93927",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93927"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796",
    "assignerShortName": "yandex",
    "cveId": "CVE-2016-8506",
    "datePublished": "2016-10-26T18:00:00.000Z",
    "dateReserved": "2016-10-07T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:27:40.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}