NetSight
IP …
medium4.3Public exploit code

CVE-2007-0768

Multiple cross-site scripting (XSS) vulnerabilities in the Contact Details functionality in Yahoo!

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Multiple cross-site scripting (XSS) vulnerabilities in the Contact Details functionality in Yahoo! Messenger 8.1.0.209 and earlier allow user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG element to the (1) First Name, (2) Last Name, and (3) Nickname fields. NOTE: some of these details are obtained from third party information.

Affected products

VendorProductAffected versions
YahooMessenger
through 8.1.0.209

References