full-disclosure

Open Source and information security mailing list archives

Message-Id: <EF9C2953-F438-4FDB-89D3-44B912794A89@gmail.com>
Date: Mon, 15 Jun 2015 22:40:26 +0200
From: cosmin0maier@...il.com
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] eBay Security Assessment

Web Application Security Report
m.ebay.com Multiple Vulnerabilities

[1]: Cross-site Scripting - Stored XSS 

The iOS, Android application and m.ebay.com website has a section called

“Followed Search” These followed search, by default, are pre-defined links to sections of eBay. It is possible for a user to edit the list of followed search and to add their own 

[2]: HTML Injection 

Full report available:
https://drive.google.com/file/d/0ByfzEW9It8o6WGN2NGJwa3h5cmc/view?usp=sharing

Sent from my iPhone

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives