Respondly: OAuth Bug

I read the bug of @melvin and I also try to bypass this https://app.respond.ly/oauth/twitter/?requestTokenAndRedirect=https://hackerone.com so I made a bypassing tehcnique but didnt work https://app.respond.ly/oauth/twitter/?requestTokenAndRedirect=//hackerone.com But I think I found a bug This i...

Respondly: Full Path Disclosure

"code":500,"error":"Failed to render CSS stylesheet.","file":"/assets/packages/app/shared/css/","message":"ENOENT, open '/srv/www/respondly/releases/20140421220734/marketingbundle/programs/server/assets/packages/app/shared/css/" Request ------------ GET /css/shared/%22ns=%22alert9 HTTP/1.1...

Respondly: No Bruteforce Protection

Hi, Your Basic Authentication at http://o1.m.respond.ly:8080/ has no bruteforce protection using hydra or some other tool it can be bruteforced...

Respondly: Deleting team members

...

Respondly: Allowed method disclosure

The URL "https://respond.ly/" has the following allowed methods, which include DAV methods: ACL, BASELINECONTROL, CHECKIN, CHECKOUT, CONNECT, COPY, DEBUG, GET, HEAD, INDEX, INVALID, INVOKE, LABEL, LINK, LOCK, MERGE, MKACTIVITY, MKCOL, MKDIR, MKWORKSPACE, MOVE, NOTIFY, OPTIONS, PATCH, PIN, POLL,...

Respondly: Find, private notes Cross-site scripting.

Hi. When I go to the find page and insert a private note, with as content : img src='x' onerror='alert4' it will execute directly. As preview : 1. http://prntscr.com/3axvz5 2. http://prntscr.com/3axw3k Best regards, Olivier Beg...

Respondly: OAuth open redirect

An attacker can use an open redirect vulnerability in the Twitter OAuth process to redirect someone to his/her webpage, while also obtaining the OAuth token and verifier of the victim. The vulnerability is right here:...

Respondly: Persistent Cross-site scripting vulnerability settings.

Hello, I created an account with as group name ", after that I went to settings and found a Cross-site scripting vulnerability located at that page. The url for me : https://app.respond.ly/6sjp/settings/account I have a proof of concept in the attachment. best regards Olivier Beg...