Artikel mit Tag security
abra artikel check point adobe advisory omniture open redirection sicherheit apple.com buffer overflow bug bounty cheat sheet cross site request forgery cross site scripting denial of service directory traversal dos heise html5 icinga infoserve lfi metasploit nagios nessus saarland sql injection store.apple.com xss HTTPS Intrusion Prevention owasp backdoor openbsd openssh markplaats.nl bypass Cisco ACL OpenBSD OpenSSH RIPv2 Sicherheit SNMP full path disclosure coding http IPv6 polipo proxy saar sven challenges reverse engineering steganographie
Mar 8: Yahoo Bug Bounty Program Vulnerability #4 #5 #6 Cross-site Scripting vulnerabilities
In Jan ’14 I reported three Cross-site Scripting vulnerabilities to the Yahoo Bug Bounty Program. And I know, it is really really hard, but … again … no feedback or bounty :)
Screenshots:
|
XSS on ‘celebrity.yahoo.com‘
|
XSS on ‘movies.yahoo.com‘
|
XSS on ‘music.yahoo.com’
|
 |
 |
 |
Here is the advisory:
Mar 8: Yahoo Bug Bounty Program Vulnerability #1 XSS on ads.yahoo.com
In Nov ’13 I reported a Cross-site Scripting vulnerability to the Yahoo Bug Bounty Program. As for my other reports, I’ve got no response or feedback, so I wrote a message to them via email this time and so on … blah blah :)
To cut a long story short, for all my reports the communication with Yahoo was really bad and of course: No bounty!
It seems this XSS is fixed, so here is my advisory:
