Bugtraq: JS embedding @ yahoo.com

[Alan McCaig <alanmccaig () yahoo co uk>]

Any user can embed JavaScript into there yahoo 
profiles. When the user selects to change his picture 
then selects point to a photo on the Web. They can 
then embed javascript on the end of the url. An 
example of this can be viewed here 
http://uk.profiles.yahoo.com/embeddedjs
This has been active for a while now and yahoo have 
still took no action in fixing it.