Mapbox: XSS in L.mapbox.shareControl in mapbox.js

Hi Mapbox I've found a xss vulnerability on mapbox sharing system. I've a project called with "'"alert1;""onmouseover="confirm2;"-- " than click it and copy the share URL and go to URL than click the the marked area than you will see the vulnerability...

Mapbox: Disclosure of map information

In July 2015, @hussain submitted a report where a GET request to an internal API endpoint /core/api/Map disclosed details of public maps in a Mapbox user's account. The disclosed information included the name, description, map identifier, geographic center, map layers, date created, and date last...

Mapbox: Stored Cross-Site Scripting in Map Share Page

Hi Team Mapbox Security This is Copy From message email ‫[email protected]‬ intro. I'm Hussain Adnan Researcher Security, Iam Have Found Vulnerability Bug in form project profile Map Type Vulnerability : Cross-Site Scripting Stored - Reflected Affected Domain : Affected Domain : mapbox.com -...

Mapbox: Persistent cross-site scripting (XSS) in map attribution

Hello, I have found a Persistent Cross Site Scripting vulnerability when using a custom style uploaded by myself. Mapbox Studio allows create and upload styles for your maps. So if we create a new style with javascript code as attribution value it will be executed when loading a map that uses our...

Mapbox: Stored xss in editor

On March 28th, 2015 @sahilsaif reported an issue with stored XSS in Mapbox Editor www.mapbox.com/editor. We deployed a fix for this issue on March 30th, 2015. On March 28th, 2015, I found a Stored XSS in Mapbox Editor. Which was hosted on https://mapbox.com/editor Mapbox Editor is now deprecated...

Mapbox: Logging a user into attacker's account using password reset link

On March 26th, 2015 @shahmeer-amir reported an issue with the password reset flow for www.mapbox.com that required social engineering to exploit. We patched the issue and awarded a bounty on April 7th, 2015. Please note that this was not related to denial of service or the institution of an accou...