Read the researcher's report on HackerOne
No analysis of this report yet. What HackerOne publishes about it is below, with the link to the report. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| [Grab Android/iOS] Insecure deeplink leads to sensitive information disclosure | No account | The attacker's own | A crafted deeplink caused the app's privileged webview to disclose its user's data to attacker-controlled content. |
| XSS vulnerable parameter in a location hash | No account | No object involved | A crafted link could cause script execution in a victim’s site context. |
| [accounts.reddit.com] Redirect parameter allows for XSS | No account | No object involved | A crafted redirect destination caused script execution in the account site’s browser context. |
| yelp.com XSS ATO (via login keylogger, link Google account) | No account | Another user's | A crafted link causes script to run in a victim’s Yelp session and link an attacker-controlled identity to the victim’s account. |
| XSS at jamfpro.shopifycloud.com | No account | No object involved | A crafted link caused attacker-controlled script to execute in the application origin. |
| Stored XSS in developer.uber.com | A user account | No object involved | A contributor’s stored suggestion executes in an administrator’s dashboard context. |
| [www.zomato.com] Blind XSS on one of the Admin Dashboard | A user account | The attacker's own | Customer-submitted order content executed in an administrator's browser. |
| Account Takeover in Periscope TV | No account | Another user's | OAuth authorization data for a victim was sent to an attacker-controlled destination. |
| XSS and cache poisoning via upload.twitter.com on ton.twitter.com | A user account | Another tenant's | A signed upload made an attacker-controlled file viewable by another user in the target origin. |
| XSS at https://exchangemarketplace.com/blogsearch | No account | No object involved | Untrusted search input was interpreted as script in the site's page. |
| xss on https://www.rockstargames.com/GTAOnline/jp/screens/ | No account | No object involved | Untrusted path content was treated as executable script in a visitor's browser. |
| XSS in gist integration | A user account | The attacker's own | A crafted gist name crosses into executable markup in the integration's viewer. |