Web Security Blog
written by Thomas Orlita-
Blind XSS in an internal Google Service via the Server header
-
5 different vulnerabilities in Google's Threadit
-
Public bucket allowed access to images on upcoming Google Cloud blog posts
-
Listing all registered email addresses on Google’s Crisis Map thanks to IDOR and incremental IDs
-
Clickjacking DOM XSS on Google.org
-
XSSing Google employees: blind XSS on googleplex.com
-
Inserting arbitrary files into anyone's Google Earth Studio projects archive
-
Unsecured access to personal data of a million Leo Express users
-
XSSing Google Code-in thanks to improperly escaped JSON data
-
Bypassing Firebase authorization to create custom app.goo.gl subdomains
-
How to use Google's CSP Evaluator to bypass CSP
-
Reflected XSS in Google Code Jam
-
Liking GitHub repositories on behalf of other users - Stored XSS in WebComponents.org
-
Angular XSS vulnerability on McDonalds.com