PatchTheCVEyellowfinbi vulnerabilities
Recent CVEs affecting yellowfinbi products. 4 tracked.
yellowfinbi has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2022-09-14. Highest priority: CVE-2020-19586 (score 55/100).
- CVE-2021-36389 HIGH 7.5 UPGRADE In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct
- CVE-2021-36388 HIGH 7.5 UPGRADE In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure
- CVE-2021-36387 MEDIUM 5.4 UPGRADE In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionalit
- CVE-2020-19586 CRITICAL 9.0 DOWNGRADE Incorrect Access Control issue in Yellowfin Business Intelligence 7.3 allows remote attackers to escalate priv
FAQ
How do I fix yellowfinbi vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is yellowfinbi being exploited right now?
None of the tracked yellowfinbi CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which yellowfinbi CVE should I patch first?
CVE-2020-19586 currently ranks highest (55/100): Incorrect Access Control issue in Yellowfin Business Intelligence 7.3 allows remote attackers to escalate priv.