地图 / app.mixmax.com Information Discloure on cal.mixmax.com and Not Signing out after Removing information grant access from Google

app.mixmax.com Information Discloure on cal.mixmax.com and Not Signing out after Removing information grant access from Google

其他弱点 / Unlabeled / #262262

厂商: Mixmax
严重程度: 低危
赏金: —
弱点: Unlabeled
研究员: @ykw1337
披露日期: 2017-09-24
资产: —
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（1439 字符中的一小部分）

I found that there was Email Disclosed in the source code of the public calendar link.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Mixmax 所有。

时间线

2017-08-22报告提交
2017-09-24公开披露

阅读 HackerOne 原文 ↗作者 @ykw1337 · 版权归作者与 Mixmax 所有

同类报告

June 2022 Incident ReportHackerOne · 2022-07-01 HTML-injection in PDF-export leads to LFIVisma Public · — · $500 DOM XSS on duckduckgo.com searchDuckDuckGo · 2020-06-14 An attacker can archive and unarchive any structured scope object on HackerOneHackerOne · 2022-04-18 Java (Maven): Actually fix the use of insecure protocol to download/upload artifactsGitHub Security Lab · — · $4,000 Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's originSuperhuman (formerly Grammarly) · 2019-08-01