Vulnerabilities > Yandex
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-03-14 | CVE-2021-43304 | Out-of-bounds Write vulnerability in multiple products Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. | 8.8 |
| 2022-03-14 | CVE-2021-43305 | Out-of-bounds Write vulnerability in multiple products Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. | 8.8 |
| 2021-09-13 | CVE-2020-27969 | Origin Validation Error vulnerability in Yandex Browser Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing | 7.5 |
| 2021-09-13 | CVE-2020-27970 | Authentication Bypass by Spoofing vulnerability in Yandex Browser Yandex Browser before 20.10.0 allows remote attackers to spoof the address bar | 5.0 |
| 2021-08-17 | CVE-2021-25263 | Incorrect Permission Assignment for Critical Resource vulnerability in Yandex Browser Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating files in directory with insecure permissions during Yandex Browser update process. | 7.8 |
| 2021-08-02 | CVE-2021-24428 | Cross-site Scripting vulnerability in Yandex Turbo The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in the admin dashboard, leading to an Authenticated Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed. | 4.8 |
| 2020-10-20 | CVE-2020-7369 | Missing Authentication for Critical Function vulnerability in Yandex Browser User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. | 4.3 |
| 2019-12-30 | CVE-2019-16535 | Integer Underflow (Wrap or Wraparound) vulnerability in Yandex Clickhouse In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol. | 7.5 |
| 2019-12-30 | CVE-2019-15024 | Unspecified vulnerability in Yandex Clickhouse In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper. | 4.0 |
| 2019-10-31 | CVE-2019-18657 | Injection vulnerability in Yandex Clickhouse ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function. | 5.0 |