Vendor response

BillMeLater: XSS Through a Style Attribute

17 Nov 2014 ·1 min read

A Firefox-only reflected XSS on wwwb.search.billmelater.com, achieved by closing out of a style attribute and injecting a fresh script element, which the vendor classified as out of scope.

Reflected XSS Attribute injection Context breakout

Stored XSS in Three WordPress Chat Plugins

2 Oct 2014 ·1 min read

WP Live Chat Support, MyLiveChat and Provide Support all accepted stored cross-site scripting during a 2014 customer install.

Stored XSS WordPress Coordinated disclosure

Chrome backslash URLs and XSS filter bypass

17 Jun 2014 ·2 min read

Chrome resolves and executes a script URL written as http: followed by any number of backslashes. Firefox does not, and that difference can slip past pattern-matching XSS filters, closed by Chromium as wontfix.

URL parsing Parser differential Filter bypass

Path Traversal on map.prezi.com ($1,000)

21 May 2014 ·1 min read

A path traversal issue on Prezi’s map.prezi.com subdomain, fixed within two days of reporting and rewarded with a $1,000 bounty.

Path traversal Information disclosure Coordinated disclosure

↑