ThisData: Host Header Poisoning in thisdata.com

ThisData made inappropriate use of the user-supplied host header, which could have resulted in a user being redirected to an arbitrary domain under some circumstances. On other pages, the header was used within metadata values like the canonical URL. 7H0R4PP4N was very thorough and helpful as we...

ThisData: STORED XSS FOUND

dirtycoder found an XSS vulnerability which could be executed if a user updated their name or email address to a malicious value. The scope of that XSS would be contained to their account. This was was reported at 9PM Thursday NZST, and fixed by 3PM Friday the next day. I, and ThisData, am super...

ThisData: Xss via Dropbox

ThisData formerly Revert provides the ability to backup Dropbox files. File names were rendered within the app in an unescaped manner, meaning if you could get Dropbox to accept a file with a name like ".png you could XSS Revert's backup rendering screen...