Y! Messenger and Calendar.Yahoo.Com XSSby
A few weeks ago I was able to report an XSS on Yahoo using Calendar.Yahoo.com and Y! Messenger (18.104.22.168-us).
First I created my event/reminder as followed:
Then I decided to change my Yahoo alarm settings to receive them via Y! Messenger
and as I was waiting I see the following errors popup on Yahoo Messenger:
Here’s a preview and video of the PoC
2014-02-03 Status Changed to Triaged
As of 4/14/2014 this post has been viewed (3279) times.by