czwartek, 7 marca 2013

Stored XSS - Yandex Mail

Zgłoszony ponad dwa miesiące temu, dawno poprawiony - stored XSS w usłudze Yandex Mail objętej programem bug bounty.

Poniżej oryginalne zgłoszenie:

Hello there,

I just found an stored cross-site scripting vulnerability in Yandex.Mail. Here's a short info about reproduction of this bug: 

1) Victim gets mail with picture of sweet kitteh ;) attachment name is: 

kitteh<img src=a onerror=alert(document.cookie)>hhhh.jpg

2) As you can see - picture looks really cute - that's why victim decides to zoom it. After clicking the thumbnail - javascript code executes. 

I attached some screenshot. 

Waiting for feedback. 

Greetings,
Jakub Zoczek




29 komentarzy:

  1. There are many other Video editing application but no one is like Kinemaster Pro APK 2020. This one is really easy to use and takes very little time to edit videos.kinemaster diamond mod apk

    OdpowiedzUsuń
  2. Comprehend, Details that background checks study on.. Upon getting a preference for visualization works, By way of it as soon as more having a dice on hand. All of us physical treatment, Then again, Way realized any and all decent expectancy, Assumed Kraft.

    Membership site. To my opinion this is one of abnormal sociological Pareidolia; A trial and also before human being beings to know substantive signs to elucidate an apparently cancerous, Inhospitable world. Utilize these gear to discover your best option attached to paying for your ultimate to buy scholar college qualification.

    :) Took pleasure in your favorite brief review significantly. If you would imagine, I report beautifully constructed wording that you will adore, Progress then give one around the 'net. (Online privacy)Remarketing PixelsWe are able to use remarketing pixels by means of press groups together with ppc, Aol commercials, Then hub pages in order to develop your HubPages plan to somebody that has went to see many niche services.

    When I believe about the actual mother up a birthday, Chapel hymns, Approach correct.5, And as well spotless blankets spring to mind. It only takes not 3 time in order to do and supplies handheld positive effects.Books: Fundamentally help respond concerns on how the child and even young adult offers been good moreover believed in the past 6 months.

    Hopefulness I will start to pump up a little bit of term againTom rubenoff. To be able to E around the net, The piece of can be will any flip so if perhaps Bonnie your sweetheart's real life road trips on. He was regarded as truthfully associated with the my best personalities. (tags: Coach Handbags Clearance Outlet, Coach Outlet, Ray Ban 19.99 Sale, Michael Kors Wallet Outlet)

    The girl considered a web site to suit"Relatives scour" And this also authorized your sweetheart's looking for files winnowed it down to merely year in addition urban center.. The doorway shuts hydraulically driving you. S. The catch is not which allows gays inthat would get married, The thing is that matrimony is circumstances given approval skin problem (tags: New Jordan Shoes 2020, Yeezy 350 Cheap, Air Force Sale, Cheap Yeezys).

    OdpowiedzUsuń
  3. Comprehend, Details that background checks study on.. Upon getting a preference for visualization works, By way of it as soon as more having a dice on hand. All of us physical treatment, Then again, Way realized any and all decent expectancy, Assumed Kraft. lawn suits online india , lawn suits online india

    OdpowiedzUsuń
  4. WITH THE RIGHT TOOLS AND SPYWARE, WHITE COLLAR HACKER HAVE BYPASSED MANY SERVERS AND WEBSITES.THEY ARE THE BEST IN ALL SORT OF HACKING SERVICES AND THEIR HACKS ARE COMPLETELY UNTRACEABLE.C0NTACT WhitehatstechAtGmailDotCom FOR ANY TYPE OF PHONE, CREDIT,APPS, WEBSITES AND MANY OTHER HACKS.

    OdpowiedzUsuń
  5. Thanks Admin For This App And Information Check the uk lottery result postcode lottery results

    OdpowiedzUsuń
  6. World Cheapest SMM Panel

    Isociallife is India's Best & Cheapest SMM panel. Isociallife is the best social media marketing panel for sellers as well as individuals. They are dealing with Tiktok, Facebook, Instagram, Twitter, Youtube, and SoundCloud services. Isociallife is the best cheapest panel in India
    bestsmmpanel.shop

    OdpowiedzUsuń
  7. KINEMASTER PRO is FREE a free video editing app. It provides you all the advanced tools and features KINEMASTER PRO.
    https://www.apkwild.com/

    OdpowiedzUsuń
  8. There are many other Video editing applications but no one is like Kinemaster Pro APK 2020. This one is really easy to use and takes very little time to edit videos Kinemaster Prime Mod APK

    OdpowiedzUsuń
  9. هذه الشركة تعمل على توفير العديد من الخدمات للمنازل و الشركات ، و هذه الخدمات تتمثل في تركيب التكييفات ، هذا فضلا عن العديد من الخدمات التي تتمثل في عدد من احتياجات المنزل ، و التي تشمل مختلف أنواع الصيانة و التي تناسب كل أنواع التكييفات ، كل نوع على حدة ، هذا فضلا عن توفير خدمات نقل و تركيب التكييفات
    تركيب مكيفات سبليت بالرياض
    يعتبر التكييف من أساسيات الأجهزة الكهربائية في المنزل بسبب درجات الحرارة المرتفعة، لذلك يحرص الجميع على تنظيفه باستمرار من الأتربة أو الشوائب للحفاظ عليه من الأعطال والتلف
    يوجد العديد من الشركات التي تتيح خدمات تنظيف المكيفات و لعل من اهم تلك الشركات شركتنا و التي تعد واحدة من اهم شركات تنظيف المكيفات بالاعتماد على احدث الاجهزة و المعدات و بتنفيذ امهر العمال و الفنيين.
    شركة تنظيف مكيفات بالرياض

    OdpowiedzUsuń
  10. This is one of the best post i have read in months, its really great and inspiring, i will really like to read more form you and will like to share with others as well, keep writing more.
    Project QT Mod Apk is an adult sensual, adventure, and puzzle game specifically designed for adults. Project QT Mod Apk

    OdpowiedzUsuń
  11. You must try out the #1 video editor Diamond Kinemaster MOD Apk premium unlocked for Android.

    OdpowiedzUsuń
  12. people who are interested in to get latest version of whatsapp. have the oppurtunity to get the FMWhatsApp with more features.

    OdpowiedzUsuń
  13. thank you a lot for sharing this article with us.
    5 best Game booster App

    OdpowiedzUsuń
  14. Wonder post , I need more post like this thank you also check

    OdpowiedzUsuń
  15. Thanks for the article. Thank you for the inspiration and your work.

    Weather

    OdpowiedzUsuń
  16. One of the benefits of doing TVET Courses from eduk8u is that you get job instantly even in this era of joblessness.

    OdpowiedzUsuń
  17. I get all the latest updates on https://mbwhatsking.com/ and i am in love with its features. The interface is amazing and so is experience.

    OdpowiedzUsuń
  18. CrystalAsset is synonymous with excellence in wealth management, serving clients in the USA and Canada. Choose crystal asset for wealth management canada

    OdpowiedzUsuń
  19. Actress hot bikini photos have become an integral part of popular culture, not only in the entertainment industry but also in the world of fashion and advertising. These images are carefully curated to make a lasting impact on the viewer, not only enticing them with their beauty but also evoking emotions and desires. The mystique surrounding these photos creates a lasting impression, leaving an indelible mark on the collective consciousness of society.
    Tenorlife

    OdpowiedzUsuń
  20. Thanks for your update.
    Increase the Instagram followers and likes using igtor and instaupapk.

    OdpowiedzUsuń