Read the researcher's report on HackerOne
No analysis of this report yet. What HackerOne publishes about it is below, with the link to the report.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| Cross-site Scripting (XSS) - Stored in RDoc wiki pages | A user account | Another user's | A wiki viewer's trust in the site's rendered page was abused to present deceptive links or credential prompts. |
| Twitter Periscope Clickjacking Vulnerability | No account | The attacker's own | A framed interface could be overlaid or disguised to induce a user action on their own account. |