Imgur: Persistent XSS in image title

When adding a title to uploaded images, one can insert XSS into the title which is then executed for anyone viewing the image. PoC contains a harmless XSS: http://imgur.com/bSZwUBG&rAmpN4O How to recreate: 1. Open the Image Options page for an album. 2. Press "Add Title / Description" 3. Enter so...

Imgur: Csrf near report abuse meme

Hey team i would like to report a real csrf threat which allows attacker to make report abuse to any meme on behalf of the users how i found this bug :- lets visit to any meme example :- 1 http://imgur.com/t/memes/ieTEJEd 2 i clicked on post options 3 i got an option called report i clicked on it...

Imgur: Server Side Request Forgery In Video to GIF Functionality

imgur.com is vulnerable to Server Side Request Forgery because it fails to sanitize or verify the "url" GET parameter. This could be used by attackers to launch attacks against other 3rd party sites or proxy an attackers requests through the affected site to hide the attackers origin. In more...

Imgur: Crossdomain.xml settings on api.imgur.com too open

The crossdomain.xml file hosted at http://api.imgur.com/crossdomain.xml was too open. This allowed SWF files to make HTTP requests and see it's response. If this was not changed, then attacker.com can embed a SWF on attacker.com/example.html that makes an HTTP request to http://api.imgur.com/. Th...

Imgur: Content Sniffing not enabled

The HTTP header X-Content-Type-Options was not set to nosniff. This can cause some browsers to try to determine the content/encoding type of a response, which is an undesired behavior...

Imgur: "Sign me out everywhere" does not work for desktop sessions

An account option that allowed users to sign out everywhere was found to not be functioning properly. A user selecting this option was not signed out. A fix has been rolled out to update session security as a result of this report...

Imgur: Open Url redirection on login with facebook

steps to produce: 1, go to the site imgur.com and login with facebook and if you are new user then u must be asked for username on the link https://imgur.com/register/thirdparty/facebook?redirect=http://imgur.com/ nw just change the parameter redirect= value to https://google.com and hit enter an...

Mini-stream Ripper 2.7.7.100 - Local Buffer Overflow

!/usr/bin/env python + Author: TUNISIAN CYBER + Exploit Title: Mini-sream Ripper v2.7.7.100 Local Buffer Overflow + Date: 25-03-2015 + Type: Local Exploits + Tested on: WinXp/Windows 7 Pro + Vendor:...

Indian Government blocks 32 Sites, including GitHub, Pastebin, Imgur and Vimeo

China is known as the nation of 'global internet censorship', and the country proved it many times, in fact when recently it blocked the access to Gmail from the country. Now, it seems that its northern neighbouring country, India doesn't want to get left behind. On Wednesday, the Indian Computer...