CVE-2016-8504

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Yandex N.V.	Yandex Browser for desktop	before 16.6 for OSx and Windows

References

http://www.securityfocus.com/bid/93924Third Party Advisory, VDB Entry
https://browser.yandex.com/security/changelogs/Release Notes, Vendor Advisory
http://www.securityfocus.com/bid/93924Third Party Advisory, VDB Entry
https://browser.yandex.com/security/changelogs/Release Notes, Vendor Advisory

Timeline

Published: Oct 26, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-85056.1XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arb CVE-2016-85066.1XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluati CVE-2016-85076.5Yandex Browser for iOS before 16.10.0.2357 does not properly restrict processing of facetime:// URLs, which allows remote attackers to initi CVE-2016-85086.5Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special CVE-2016-85119.8A Remote Code Execution vulnerability in HPE Network Automation using RPCServlet and Java Deserialization version v9.1x, v9.2x, v10.00, v10.CVE-2016-85129.8A Remote Code Execution vulnerability in all versions of HPE LoadRunner and Performance Center was found.CVE-2016-85138.0A Cross-Site Request Forgery (CSRF) vulnerability in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versio CVE-2016-85146.5A remote information disclosure in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions prior to 7.6.CVE-2016-85158.8A remote malicious file upload vulnerability in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions pr CVE-2016-85167.5A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.CVE-2016-85176.1A cross site scripting vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.CVE-2016-85187.5A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.