Read the docs

Yandex

Records42All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high25CVSS 7.0–8.9

Exploited now

Yandex records in CISA KEV

No Yandex vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Yandex Browser 22 records MEDIUM Navigator 2 records HIGH Yandex Telemost 2 records LOW Tomita-parser 1 record LOW Yandex.browser 1 record LOW Yandex.server 1 record LOW Yandex.server 2010 1 record LOW Yandex Turbo 1 record LOW

Records

22 records in Yandex Browser · all components

TI-2024-06006 CVE-2024-6473 · GHSA-p7m8-prjf-m93h

DLL Hijacking in Yandex Browser

Priority MEDIUM 40

Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.

CVSS 4.0HIGH 8.4 Local Low privileges No interaction EPSS 0.0071 Published 2024-09-03 Fixed in 24.7.1.380 CWE-426
TI-2017-04997 CVE-2017-7327 · GHSA-p586-mfg5-f272

Untrusted search path in Yandex Browser for Desktop

Priority LOW 37

Yandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path is used for dnsapi.dll, winmm.dll, ntmarta.dll, cryptbase.dll or profapi.dll.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.01395 Published 2018-01-19 No fix listed CWE-426
TI-2022-11011 CVE-2022-28225 · GHSA-9vv8-3g89-c4p4

Link following in Yandex Browser

Priority LOW 35

Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating symlinks to installation f…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00474 Published 2022-06-15 No fix listed CWE-59
TI-2021-07513 CVE-2021-25261 · GHSA-p6r9-h8xg-qhvr

Link following in Yandex Browser

Priority LOW 35

Local privilege vulnerability in Yandex Browser for Windows prior to 22.5.0.862 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating symlinks to installation f…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00474 Published 2022-06-15 No fix listed CWE-59
TI-2022-11012 CVE-2022-28226 · GHSA-j323-vp27-mqgh

Exposure of resource to wrong sphere in Yandex Browser

Priority LOW 34

Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.801 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating temporary files in directo…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00379 Published 2022-06-15 No fix listed CWE-668
TI-2021-07515 CVE-2021-25263 · GHSA-37r4-xgj4-h786

Incorrect permission assignment in Yandex Browser

Priority LOW 34

Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating files in directory with in…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00414 Published 2021-08-17 No fix listed CWE-732
TI-2017-04996 CVE-2017-7326 · GHSA-v8wr-j6wf-xmq3

Race condition in Yandex Browser for Android

Priority LOW 34

Race condition issue in Yandex Browser for Android before 17.4.0.16 allowed a remote attacker to potentially exploit memory corruption via a crafted HTML page

CVSS 3.0HIGH 7.5 Network No auth User interaction EPSS 0.00781 Published 2018-01-19 No fix listed CWE-362
TI-2016-07008 CVE-2016-8508 · GHSA-2h4m-9mfv-2j2r

Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to…

Priority LOW 32

Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special content-type, which could be used by remote attacker for prevention Protect warn…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01598 Published 2017-03-01 No fix listed CWE-254
TI-2016-07007 CVE-2016-8507 · GHSA-f5j2-5xm6-3xw5

Information disclosure in Yandex Browser for iOS

Priority LOW 32

Yandex Browser for iOS before 16.10.0.2357 does not properly restrict processing of facetime:// URLs, which allows remote attackers to initiate facetime-call without user's approval and obtain video and audio data from a…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01516 Published 2017-03-01 No fix listed CWE-200
TI-2016-07006 CVE-2016-8506 · GHSA-4887-46jh-42cg

Cross-site scripting in Yandex Browser for desktop

Priority LOW 29

XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0085 Published 2016-10-26 No fix listed CWE-79
TI-2016-07001 CVE-2016-8501 · GHSA-rm7v-gpq8-jp69

Access control flaw in Yandex Browser for desktop Versions from 15.10 to 15.12

Priority LOW 27

Security WiFi bypass in Yandex Browser from version 15.10 to 15.12 allows remote attacker to sniff traffic in open or WEP-protected wi-fi networks despite of special security mechanism is enabled.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01292 Published 2016-10-26 No fix listed CWE-264
TI-2020-05956 CVE-2020-7369 · GHSA-2q3p-j7r5-v28g

Yandex Browser Address Bar Spooofing

Priority LOW 22

User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00994 Published 2020-10-20 No fix listed CWE-451
TI-2016-07004 CVE-2016-8504 · GHSA-f23v-9crx-ggxj

Cross-site request forgery in Yandex Browser for desktop

Priority LOW 21

CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile.

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.00562 Published 2016-10-26 No fix listed CWE-352
Open these records in search →