yahoo.com suffers from a XSS vulnerability which can be used to refresh to a fake mail account.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/45557/yahoo-fake.txt
Source: https://packetstormsecurity.com/files/45557/yahoo-fake.txt.html