Resultados

2 casos · pág. 1/1

hacktron.ai · há 1d high

Hacktron chains forums.openai.com postMessage XSS with exposed Mojo IPC in OpenAI ChatGPT Atlas to steal OAuth tokens

Researchers at Hacktron disclosed a vulnerability chain in OpenAI's ChatGPT Atlas Chromium-based AI browser that lets an attacker monitor all open tabs and capture OAuth authorization codes for any site, effectively breaking the same-origin policy. Atlas exposes Mojo IPC bindings to all .chatgpt.com and .openai.com origins, so a single XS…

technology

yokai.hakaisecurity.io · há 1d medium

Client-Side Path Traversal chains in bug bounty targets enable stored XSS, account takeover and account deletion

Researcher Pedro Cruz (gankd) documents two Client-Side Path Traversal (CSPT) chains found in production bug bounty programs. The first turns CSPT into Stored XSS and account takeover on a payments platform's Angular POS single-page application. The second, found with Felipe Torres, triggers unauthorized account deletion on one of the lar…

financial services e-commerce