Browse / Yahoo!

Yahoo!

See its reports on the map

What gets reported to Yahoo!

• Cross-site Scripting21
• Information Disclosure14
• Misconfiguration12
• Code Execution7
• Open Redirect7
• Authentication6

Most upvoted reports

AllValidInformativeN/ADuplicate

1. YQL: From CR/LF injection to root compromiseCode Injection
   67 votes
2. Out-of-band read of arbitrary ASCII files on YQL backend servers via XML external parameter entitiesInformation Disclosure
   46 votes
3. Read arbitrary ASCII files on YQL backend servers via XSLT unparsed-entity-uri() and parameter entitiesInformation Disclosure
   35 votes
4. Read arbitrary XML files on YQL backend servers via XSLT document()Information Disclosure
   34 votes
5. Bitly link takeover Misconfiguration
   32 votes
6. Code execution in "ymon" WebService, reached after bypassing the anti-loopback blacklist through YQL and HTTP redirectsCode Injection
   31 votes
7. Local File Include on marketing-dam.yahoo.comCryptographic Issues - Generic
   24 votes
8. Header injection on rmaitrack.ads.vip.bf1.yahoo.comOpen Redirect
   20 votes
9. Cross-site scripting on the main page of flickr by tagging a user.Cross-site Scripting (XSS) - Generic
   18 votes
10. XSS Yahoo Messenger Via Calendar.Yahoo.Com Cross-site Scripting (XSS) - Generic
    16 votes
11. Store XSS Flicker main pageCross-site Scripting (XSS) - Generic
    13 votes
12. REMOTE CODE EXECUTION/LOCAL FILE INCLUSION/XSPA/SSRF, view-source:http://sb*.geo.sp1.yahoo.com/, 4/6/14, #SpringCleanCode Injection
    12 votes
13. Loadbalancer + URI XSS #3Cross-site Scripting (XSS) - Generic
    11 votes
14. Information Disclosure Information Disclosure
    10 votes
15. readble .htaccess + Source Code Disclosure (+ .SVN repository)Information Disclosure
    9 votes
16. Bypass of the Clickjacking protection on Flickr using data URL in iframesUI Redressing (Clickjacking)
    9 votes
17. HK.Yahoo.Net Remote Command ExecutionCommand Injection - Generic
    9 votes
18. Directory Traversal Code Injection
    9 votes
19. From Unrestricted File Upload to Remote Command ExecutionCommand Injection - Generic
    7 votes
20. HTML Injection on flickr screename using IOS AppCross-site Scripting (XSS) - Generic
    7 votes
21. Java Applet Execution On Y! MessengerCross-site Scripting (XSS) - Generic
    7 votes
22. Local file inclusion Cryptographic Issues - Generic
    6 votes
23. SQLi on http://sports.yahoo.com/nfl/draftSQL Injection
    6 votes
24. ads.yahoo.com Unvalidate open url redirectionOpen Redirect
    5 votes
25. reflected XSS, http://extprodweb11.cc.gq1.yahoo.com/, 4/8/14, #SpringCleanCross-site Scripting (XSS) - Reflected
    5 votes
26. Significant Information Disclosure/Load balancer access, http://extprodweb11.cc.gq1.yahoo.com/, 4/8/14, #SpringCleanInformation Disclosure
    5 votes
27. SQL Injection ON HK.PromotionSQL Injection
    5 votes
28. Flickr: Invitations disclosure (resend feature)Information Disclosure
    5 votes
29. Yahoo YQL Injection? SQL Injection
    5 votes
30. Vulnerability found, XSS (Cross site Scripting)Cross-site Scripting (XSS) - Generic
    5 votes
31. ClickJacking on http://au.launch.yahoo.comUI Redressing (Clickjacking)
    5 votes
32. caesary.yahoo.net Blind Sql InjectionSQL Injection
    4 votes
33. Default /docs folder of PHPBB3 installation on gamesnet.yahoo.comInformation Disclosure
    4 votes
34. https://caldav.calendar.yahoo.com/ - XSS (STORED) Cross-site Scripting (XSS) - Generic
    4 votes
35. invite1.us2.msg.vip.bf1.yahoo.com/ - CSRF/email disclosureInformation Disclosure
    4 votes
36. Stored Cross Site Scripting Vulnerability in Yahoo MailCross-site Scripting (XSS) - Generic
    4 votes
37. XSS Vulnerability (my.yahoo.com)Cross-site Scripting (XSS) - Generic
    4 votes
38. http://conf.member.yahoo.com configuration file disclosureInformation Disclosure
    4 votes
39. In Fantasy Sports iOS app, signup page is requested over HTTPCryptographic Issues - Generic
    4 votes
40. HTML Code Injection Cross-site Scripting (XSS) - Generic
    4 votes
41. XSS in my yahooCross-site Scripting (XSS) - Generic
    4 votes
42. Security.allowDomain("*") in SWFs on img.autos.yahoo.com allows data theft from Yahoo Mail (and others)Information Disclosure
    4 votes
43. Bypass of anti-SSRF defenses in YahooCacheSystem (affecting at least YQL and Pipes)Information Disclosure
    4 votes
44. Yahoo! Reflected XSSCross-Site Request Forgery (CSRF)
    3 votes
45. Open Redirect via Request-URIOpen Redirect
    3 votes
46. http://us.rd.yahoo.com/UI Redressing (Clickjacking)
    3 votes
47. information disclosure (LOAD BALANCER + URI XSS)Information Disclosure
    3 votes
48. XSS in Yahoo! Web AnalyticsCross-site Scripting (XSS) - Generic
    3 votes
49. Almost all the subdomains are infected.Cross-site Scripting (XSS) - Generic
    3 votes
50. Clickjacking at surveylink.yahoo.comUI Redressing (Clickjacking)
    3 votes
51. Yahoo mail login page bruteforce protection bypassImproper Authentication - Generic
    3 votes
52. Yahoo open redirect using adOpen Redirect
    3 votes
53. XSS Reflected - Yahoo TravelCross-site Scripting (XSS) - Generic
    3 votes
54. XSS using yql and developers console proxyCross-site Scripting (XSS) - Generic
    3 votes
55. Yahoo! Messenger v11.5.0.228 emoticons.xml shortcut Value Handling Stack-Based Buffer OverflowMemory Corruption - Generic
    2 votes
56. clickjacking on leaving group(flick)UI Redressing (Clickjacking)
    2 votes
57. XSS in https://hk.user.auctions.yahoo.comCross-site Scripting (XSS) - Generic
    2 votes
58. Comment Spoofing at http://suggestions.yahoo.com/detail/?prop=directory&fid=97721Improper Authentication - Generic
    2 votes
59. Cross-origin issue on rmaiauth.ads.vip.bf1.yahoo.comViolation of Secure Design Principles
    2 votes
60. Information Disclosure, groups.yahoo.com,6-april-2014, #SpringCleanInformation Disclosure
    2 votes
61. Open redirect on tw.money.yahoo.comOpen Redirect
    2 votes
62. Open URL RedirectionUI Redressing (Clickjacking)
    2 votes
63. Server Side Request ForgeryServer-Side Request Forgery (SSRF)
    2 votes
64. Authentication bypass at fast.corp.yahoo.comImproper Authentication - Generic
    2 votes
65. Reflected XSS in mail.yahoo.comCross-site Scripting (XSS) - Generic
    2 votes
66. XSS on Every sports.yahoo.com pageCross-site Scripting (XSS) - Generic
    2 votes
67. Insufficient validation of redirect URL on login page allows hijacking user name and passwordViolation of Secure Design Principles
    2 votes
68. A csrf vulnerability which add and remove a favorite team from a user account.Cross-Site Request Forgery (CSRF)
    2 votes
69. Yahoo Sports Fantasy Golf (Join Public Group)Cross-Site Request Forgery (CSRF)
    1 votes
70. Multiple vulnerabilitiesCode Injection
    1 votes
71. Testing for user enumeration (OWASP‐AT‐002) - https://gh.bouncer.login.yahoo.comImproper Authentication - Generic
    1 votes
72. Authorization issue on creative.yahoo.comViolation of Secure Design Principles
    1 votes
73. TESTING FOR REFLECTED CROSS SITE SCRIPTING (OWASP‐DV‐001)Cross-site Scripting (XSS) - Generic
    1 votes
74. Infrastructure and Application Admin Interfaces (OWASP‐CM‐007)Privilege Escalation
    1 votes
75. Authentication Bypass due to Session MismanagementImproper Authentication - Generic
    1 votes
76. Open Proxy, http://www.smushit.com/ysmush.it/, 4/09/14, #SpringCleanOpen Redirect
    1 votes
77. CSRF Token is missing on DELETE message option on http://baseball.fantasysports.yahoo.com/b1/127146/messagesCross-Site Request Forgery (CSRF)
    1 votes
78. CSRF Token missing on http://baseball.fantasysports.yahoo.com/b1/127146/messagesCross-Site Request Forgery (CSRF)
    1 votes
79. Out of date versionViolation of Secure Design Principles
    1 votes
80. URL RedirectionOpen Redirect
    1 votes
81. Authentication Bypass in Yahoo GroupsImproper Authentication - Generic
    1 votes
82. clickjacking UI Redressing (Clickjacking)
    1 votes