{"uuid": "e1600a9c-9f8b-4d48-a6ed-7c450393f424", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36387", "type": "seen", "source": "https://t.me/hacking_Attack/27658", "content": "Exploit Collector\nYellowfin Cross Site Scripting / Insecure Direct Object Reference\n\nhttps://4.bp.blogspot.com/-dyIqvjR3K84/WWlvfXt5NkI/AAAAAAAAIQA/Fvmwfk3J4TgcxqdY3USv0_rN_ZW9VtW1ACLcBGAs/s1600/h85.png \nYellowfin versions prior to 9.6.1 suffer from persistent cross site scripting and insecure direct object reference vulnerabilities.\n\nMD5 | ca807ea57006fe0e0063b6d15f7fb00d\n\nDownload\nYELLOWFIN < 9.6.1 MULTIPLE VULNERABILITIES\n----------------------------------------------------\n\nVulnerability:\n==============\nStored Cross-Site Scripting\n\nAffected Products and Versions:\n===============================\nYellowfin < 9.6.1\n\nCVEID:\n======\nCVE-2021-36387\n\nCVSSv3.1 Score:\n===============\n5.4 (Medium)\n\nCVSSv3.1 Attack Vector:\n=======================\nAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\n\nShort Description:\n==================\nIn Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page \"ActivityStreamAjax.i4\".\n\nRemediation:\n============\nUpdate Yellowfin to the latest version available\n\nDiscoverer:\n===========\nMichele Di Bonaventura (cyberaz0r)\n\nReference:\n==========\nhttps://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6\n\n----------------------------------------------------\n\nVulnerability:\n==============\nInsecure Direct Object Reference\n\nAffected Products and Versions:\n===============================\nYellowfin < 9.6.1\n\nCVEID:\n======\nCVE-2021-36388\n\nCVSSv3.1 Score:\n===============\n7.5 (High)\n\nCVSSv3.1 Attack Vector:\n=======================\nAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\nShort Description:\n==================\nIn Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page \"MIIAvatarImage.i4\".\n\nRemediation:\n============\nUpdate Yellowfin to the latest version available\n\nDiscoverer:\n===========\nMichele Di Bonaventura (cyberaz0r)\n\nReference:\n==========\nhttps://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6\n\n----------------------------------------------------\n\nVulnerability:\n==============\nInsecure Direct Object Reference\n\nAffected Products and Versions:\n===============================\nYellowfin < 9.6.1\n\nCVEID:\n======\nCVE-2021-36389\n\nCVSSv3.1 Score:\n===============\n7.5 (High)\n\nCVSSv3.1 Attack Vector:\n=======================\nAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\nShort Description:\n==================\nIn Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page \"MIImage.i4\".\n\nRemediation:\n============\nUpdate Yellowfin to the latest version available\n\nDiscoverer:\n===========\nMichele Di Bonaventura (cyberaz0r)\n\nReference:\n==========\nhttps://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6\n\n----------------------------------------------------\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:13.533917Z"}