CVE-2021-36387

Published: Oct 14, 2021

Modified: Aug 4, 2024

PUBLISHED

Description

In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4".

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecure-Direct-Object-Reference.html

https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6

https://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecure-Direct-Object-Reference.html

https://github.com/cyberaz0r/Yellowfin-Multiple-Vulnerabilities/blob/main/README.md

20211019 Yellowfin < 9.6.1 Multiple Vulnerabilities

mailing-list

https://cyberaz0r.info/2021/10/yellowfin-multiple-vulnerabilities/

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2021-36387

Description

Affected Products

References