Airbnb: [m.airbnb.com] CRLF Injection

By using a URL-escaped character sequence, bobrov was able to inject HTTP headers into the responses of some redirects on the m.airbnb.com domain. This allowed them to perform actions such as setting cookies for the airbnb.com domain. This primarily affected Internet Explorer, and was not...