Filtered by vendor Yellowfinbi Subscriptions
Filtered by product Yellowfin Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-36387 1 Yellowfinbi 1 Yellowfin 2024-06-04 5.4 Medium
In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4".
CVE-2021-36388 1 Yellowfinbi 1 Yellowfin 2024-06-04 7.5 High
In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".
CVE-2021-36389 1 Yellowfinbi 1 Yellowfin 2024-05-14 7.5 High
In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4".