CVE-2024-28895

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

'Yahoo! JAPAN' App for Android v2.3.1 to v3.161.1 and 'Yahoo! JAPAN' App for iOS v3.2.2 to v4.109.0 contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the WebView of 'Yahoo! JAPAN' App via other app installed on the user's device.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 1, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-288967.5Secure Boot Security Feature Bypass VulnerabilityCVE-2024-288976.8Secure Boot Security Feature Bypass VulnerabilityCVE-2024-288986.3Secure Boot Security Feature Bypass VulnerabilityCVE-2024-288998.8Secure Boot Security Feature Bypass VulnerabilityCVE-2024-28909.1Unrestricted Upload of File with Dangerous Type vulnerability in Tumult Inc. Tumult Hype Animations.This issue affects Tumult Hype AnimationCVE-2024-289005.5Windows Remote Access Connection Manager Information Disclosure VulnerabilityCVE-2024-289015.5Windows Remote Access Connection Manager Information Disclosure VulnerabilityCVE-2024-289025.5Windows Remote Access Connection Manager Information Disclosure VulnerabilityCVE-2024-289036.7Secure Boot Security Feature Bypass VulnerabilityCVE-2024-289047.8Microsoft Brokering File System Elevation of Privilege VulnerabilityCVE-2024-289057.8Microsoft Brokering File System Elevation of Privilege VulnerabilityCVE-2024-289068.8Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-28895: Medium severity, CVSS 6.1 | Vulnix