314 matches found
Flickr: Stored XSS in photos_user_map.gne
The Flickr map page was inadequately escaping the name of groups when browsing the map of a group's photos...
Flickr: Open redirect bypass
The Flickr browser upgrade page was inadequately validating that URL to continue to was a flickr.com-based URL...
Media Entity Flickr - Critical - Unsupported - SA-CONTRIB-2022-017
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466procedure---own-project---unsupported...
Flickr: Critical broken cookie signing on dagobah.flickr.com
In this report it was discovered that we were signing one of our cookies with a weak, static secret key. To fix this, we replaced the aforementioned weak, static key with a more robust and secure system for signing that cookie...
Flickr: critical server misconfiguration lead to access to any user sensitive data which include user email and password
Hi flickr team, I found a critical issue lead to access to any user sensitive data which include user hashed password and possibly can lead to takeover any user account on flickr's main site, literally i can get all user information from database with no restrictions , Let me explain how this...
Flickr: Flickr Account Takeover using AWS Cognito API
Flickr uses Amazon Cognito to implement its login functionality. Furthermore, Flickr does not allow users to change their registered e-mail address via the user interface. This restriction can be bypassed via direct communication with the Amazon Cognito User Pool API. Consider we have the followi...
Flickr: Open redirect GET-Based on https://www.flickr.com/browser/upgrade/?continue=
Improper validation of paths and domains allowed redirects to external domains...
Flickr: Incorrect Deep-link validation leading to unresponsive application and device
A specifically crafted URL provided to a victim caused their Flickr for Android app to become unresponsive...
[SECURITY] Fedora 34 Update: gnome-online-miners-3.34.0-8.fc34
GNOME Online Miners provides a set of crawlers that go through your online content and index them locally in Tracker. It has miners for Facebook, Flic kr, Google, OneDrive and Nextcloud...
[SECURITY] Fedora 34 Update: gnome-online-accounts-3.39.92-1.fc34
GNOME Online Accounts provides interfaces so that applications and libraries in GNOME can access the user's online accounts. It has providers for Google, Nextcloud, Facebook, Flickr, Foursquare, Microsoft Account, Microsoft Exchange, IMAP/SMTP and Kerberos...
Fedora: Security Advisory for gnome-online-miners (FEDORA-2021-303f6623fa)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for gnome-online-accounts (FEDORA-2021-303f6623fa)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Flickr: Stored open redirect in about page
The report helped us identify an HTML parsing bug that resulted in XSS...
CVE-2015-9327
The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS...
Cross site scripting
The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS...
CVE-2015-9327
The CVE-2015-9327 entry maps to a XSS vulnerability in the Flickr Justified Gallery WordPress plugin prior to version 3.4.0. Multiple connected sources (NVD, Red Hat advisory, CVE lists, and WPVulndb) validate that the flaw is a cross-site scripting issue in this plugin, affecting WordPress envir...
CVE-2015-9327
The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS...
CVE-2015-9327: Improper Neutralization of Input During Web Page Generation
The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS...
Flickr: CSRF in Account Deletion feature (https://www.flickr.com/account/delete)
CSRF was missing in Account Deletion form due to switching login providers. @asad0x01 found the vulnerability and reported it concisely, even with a video POC. The issue was fixed with 60 days, but we were slow to resolve the ticket and disclose. Sometimes you just get lucky. When Flickr was owne...