Yandex vulnerabilities, page 2
41 vulnerabilities
Known vulnerabilities in Yandex products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 16 products.
MediumCVE-2016-8508yandex n.v. · yandex browser for desktop +1 moreyandex n.v. yandex browser for desktopYandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special content-type, which could be used by remote attacker for prevention Protect warning on own malicious web-site.EPSS1.60%MediumCVE-2016-8501yandex · yandex_browseryandex yandex_browserSecurity WiFi bypass in Yandex Browser from version 15.10 to 15.12 allows remote attacker to sniff traffic in open or WEP-protected wi-fi networks despite of special security mechanism is enabled.EPSS1.29%HighCVE-2025-5471yandex · telemost +1 moreDylib Hijacking in Yandex TelemostUncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.19.1.EPSS0.18%HighCVE-2025-5469yandex · messengerDylib Hijacking in Yandex MessengerUncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.245EPSS0.17%HighCVE-2025-5470yandex · diskDylib Hijacking in Yandex DiskUncontrolled Search Path Element vulnerability in Yandex Disk on MacOS allows Search Order Hijacking.This issue affects Disk: before 3.2.45.3275.EPSS0.18%MediumCVE-2020-7369yandex · yandex_browserYandex Browser Address Bar SpooofingUser Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Yandex Browser version 20.8.3 and prior versions, and was fixed in version 20.8.4 released October 1, 2020.EPSS0.99%MediumCVE-2020-27970yandex · yandex_browseryandex yandex_browserYandex Browser before 20.10.0 allows remote attackers to spoof the address barEPSS1.80%HighCVE-2020-27969yandex · yandex_browseryandex yandex_browserYandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofingEPSS0.53%HighCVE-2022-28226yandex · yandex_browseryandex yandex_browserLocal privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.801 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating temporary files in directory with insecure permissions during Yandex Browser update process.EPSS0.37%HighCVE-2022-28225yandex · yandex_browseryandex yandex_browserLocal privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating symlinks to installation file during Yandex Browser update process.EPSS0.47%MediumCVE-2012-2941yandex · yandex.server_2010yandex yandex.server_2010Cross-site scripting (XSS) vulnerability in search/ in Yandex.Server 2010 9.0 Enterprise allows remote attackers to inject arbitrary web script or HTML via the text parameter.EPSS1.62%HighCVE-2017-7327yandex n.v. · yandex browser for desktop +1 moreyandex n.v. yandex browser for desktopYandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path is used for dnsapi.dll, winmm.dll, ntmarta.dll, cryptbase.dll or profapi.dll.EPSS1.40%HighCVE-2017-7325yandex n.v. · yandex browser +1 moreyandex n.v. yandex browserYandex Browser before 16.9.0 allows remote attackers to spoof the address bar via window.open.EPSS1.05%HighCVE-2017-7326yandex n.v. · yandex browser for android +1 moreyandex n.v. yandex browser for androidRace condition issue in Yandex Browser for Android before 17.4.0.16 allowed a remote attacker to potentially exploit memory corruption via a crafted HTML pageEPSS0.78%HighCVE-2024-6473yandex · browser +1 moreDLL Hijacking in Yandex BrowserYandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.EPSS0.71%HighCVE-2024-12168yandex · telemost +1 moreDLL Hijacking in Yandex TelemostYandex Telemost for Desktop before 2.7.0 has a DLL Hijacking Vulnerability because an untrusted search path is used.EPSS0.16%HighCVE-2026-25865yandex · punto switcherPunto Switcher 4.5.0.583 Unquoted Search Path via WinExecPunto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's call to WinExec without a fully qualified path for RunDll32.exe when invoking shell32.dll Control_RunDLL input.dll. Attackers can place a malicious executable earlier in the search order to achieve arbitrary code execution in the context of the affected user.EPSS0.20%MediumCVE-2026-10549yandex · yandex databasePrivilege escalation in Yandex DatabaseLDAP filter injection vulnerability in Yandex Database prior to 25.3.1.25 allows a remote attacker with valid LDAP credentials to bypass group membership checks resulting in unauthorized access to the database.EPSS0.27%CriticalCVE-2023-26226yandex · browser +1 moreA use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682EPSS0.37%HighCVE-2023-29749yandex · navigatoryandex navigatorAn issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files.EPSS0.36%