URLs in img tag aren’t passed through safe_image.php which lead to exposure of Facebook users IPs.
Description This could allow an attacker to embed an external website in an “img” tag. Normally Facebook doesn’t allow the
Category: Uncategorized
View orders and financial reports lists for any page shop
Description This bug could allow an attacker with no role in a page to extract the list of financial and
Continue readingView orders and financial reports lists for any page shop
Expose the email address of Workplace users
This bug could allow a malicious user to expose the email address of any workplace user only by knowing his
XSS on forums.oculusvr.com leads to Oculus and Facebook account takeovers
This bug could allow an attacker to steal a first party Oculus access token which would allow him to access
Continue readingXSS on forums.oculusvr.com leads to Oculus and Facebook account takeovers
Bad regex used in Facebook Javascript SDK leads to account takeovers in websites that included it
This bug could allow an attacker to target websites that included Facebook Javascript SDK. The attacker would trick a certain
Facebook DOM Based XSS using postMessage
The first bug could have allowed a malicious user to send cross-origin messages via postMessage method from facebook.com domain. The
Disclose content of internal Facebook javascript modules ( Revisited )
This bug could have allowed a malicious user to disclose the content of internal Facebook Javascript modules which have constants/configurations/endpoints
Continue readingDisclose content of internal Facebook javascript modules ( Revisited )
Admin disclosure of Facebook verified pages/ Disclose Facebook employee assigned to help a verified page.
Description This bug could allow an attacker to disclose the username of a page admin by only supplying the id
Privilege escalation in Partners Portal to Admin access
Description This bug could allow a malicious user with low permissions in a “Partners Portal” account, to upgrade his access
Continue readingPrivilege escalation in Partners Portal to Admin access
Internal directories enumeration in www
Description This bug could allow an attacker to enumerate internal “www” or “flib” directories by finding sub-directories and “potentially” files