The most obvious one was a persistent (and wild) XSS vuln on yahoo mail accounts that seemingly couldn't be fixed in 2012, 2013, and some argue it's still present in 2015.