Yahoo email hijack possible with $700 XSS exploit

Share this article:

Yahoo reportedly has yet to fix vulnerable code that is allowing a hacker to sell a $700 exploit capable of undermining a cross-site scripting (XSS) issue in Yahoo's website. The company still is in search of the malicious URL that is being used to spread the inject, which would allow successful bidders to hijack Yahoo webmail users' accounts. The bug first was reported Friday by security blogger Brian Krebs, who wrote that the malicious marketer was offering to sell the exploit only to “trusted people,” so as to keep news of the flaw unknown to those aiming to patch it. A Yahoo spokesperson did not respond to a request for comment made by SCMagazine.com on Tuesday.


Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Court shutters NY co. selling security software with "no value"

A federal court shut down Pairsys at the request of the Federal Trade Commission.

Franchises to get assistance on cybersecurity strategy

The National Cyber Security Alliance has teamed up with the International Franchise Association to promote cybersecurity awareness among franchise businesses in the U.S.

Bulgarian national sentenced 30 months for role in ID theft ring

Aleksi Kolarov was a vendor on Shadowcrew.com, an online cybercrime marketplace that sold stolen credit and bank cards and caused millions of dollars in damages.