Read the researcher's report on HackerOne
No analysis of this report yet. What HackerOne publishes about it is below, with the link to the report. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| Reflected XSS in OAUTH2 login flow | No account | No object involved | Attacker-controlled input reached executable content in the victim’s login page. |
| Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data Exfiltration | No account | Another user's | An attacker-controlled page or link used script execution and CSRF to change another user's password. |
| Reflected XSS on www.hackerone.com and resources.hackerone.com | No account | No object involved | A crafted resource URL caused attacker-controlled script to execute in the site origin. |
| Reflected XSS in TikTok endpoints | No account | No object involved | A reflected parameter reached browser content without safe handling. |
| XSS while logging using Google | A user account | No object involved | A crafted login link may cause script execution in the sign-in flow viewed by another user. |
| Reflected XSS | Not clear from the report | No object involved | Unclear; no decisive boundary crossing is described. |
| Reflected XSS on www.hackerone.com via Wistia embed code | No account | No object involved | Attacker-controlled query parameters crossed into the embed library’s object construction and DOM insertion. |
| Reflected XSS on Pangle Endpoint | No account | No object involved | Untrusted redirect input crossed into executable content in a browser response. |
| Reflected Cross site Scripting (XSS) on www.starbucks.com | No account | No object involved | A crafted sign-in return parameter reportedly caused script execution in the site's origin after victim authentication. |
| RXSS at image.hackerone.live via the `url` parameter | No account | No object involved | Potentially, the server's outbound-request boundary; no successful crossing is documented. |
| Reflected xss in https://sh.reddit.com | No account | No object involved | Untrusted content allegedly executed in the site's page context. |
| XSS in www.shopify.com/markets?utm_source= | No account | No object involved | A crafted link caused attacker-controlled input to execute in a visitor’s browser context. |