darksecurity.de | Entries tagged as open redirection

SSCHADV2014-005 - ocsnext.ebay.com - Open Redirect

Yahoo Bug Bounty Program Vulnerability #2 Open Redirect

SSCHADV2013-003 - Omniture web analytics - Open Redirection vulnerability

Posted by Stefan Schurtz on Saturday, May 24. 2014

^Advisory:	ocsnext.ebay.com – Open Redirect
Advisory ID:	SSCHADV2014-005
Author:	Stefan Schurtz
Affected Software:	Successfully tested on ocsnext.ebay.com
Vendor URL:	http://www.ebay.com/
Vendor Status:	fixed

======================
Vulnerability Description
======================

The website "ocsnext.ebay.com" is prone to open redirect with a special provided url

Continue reading "SSCHADV2014-005 - ocsnext.ebay.com - Open Redirect"

Posted by on Saturday, January 11. 2014

In Dec ’13 I reported a Open Redirect (and two other vulnerabilities, first in Nov ’13) to the Yahoo Bug Bounty Program. Sadly, I’ve got no response or feedback for any of this issues, so I wrote a new message to them (this time via email).

Last week they told me that Open redirects are no longer in scope of the bug bounty programm :-/

So here is my advisory for this issue:

Continue reading "Yahoo Bug Bounty Program Vulnerability #2 Open Redirect"

October '24

Posted by Stefan Schurtz on Thursday, May 2. 2013

Advisory:	Omniture web analytics – Open Redirection vulnerability
Advisory ID:	SSCHADV2013-003
Author:	Stefan Schurtz
Affected Software:	Successfully tested on paypal.112.2o7.net
Vendor URL:	http://www.omniture.com/
Vendor Status:	fixed

======================
Vulnerability Description
======================

The ‘vmh’-Parameter in Omniture web analytics is prone to a Open Redirection vulnerability

Continue reading "SSCHADV2013-003 - Omniture web analytics - Open Redirection vulnerability"