PatchTheCVEyellowfin vulnerabilities and fixes
Recent CVEs affecting yellowfin, with upgrade or downgrade steps. 3 tracked.
yellowfin has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2021-10-14. Highest priority: CVE-2021-36389 (score 53/100).
- CVE-2021-36389 HIGH 7.5 UPGRADE In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct
- CVE-2021-36388 HIGH 7.5 UPGRADE In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure
- CVE-2021-36387 MEDIUM 5.4 UPGRADE In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionalit
FAQ
How do I fix yellowfin vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is yellowfin being exploited right now?
None of the tracked yellowfin CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which yellowfin CVE should I patch first?
CVE-2021-36389 currently ranks highest (53/100): In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct .