source: https://www.securityfocus.com/bid/22269/info Yahoo! Messenger is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the context of a victim's Internet Explorer temporary folder. This may help the attacker steal information and launch other attacks. Versions prior to 2.1.0.29 are vulnerable to this issue. 1. Firstname: example example example example ? ( as long as victim cant see the lastname) 2. Lastname: 3. Request to add victim ID to your contact list. 4. Once victim accepts your request, send him a message and change your online status (Available -> Invisible)