Top 10 winner

Advanced Flash Vulnerabilities

OpnSec · OpnSec · 25 August 2017

Series on Flash flaws in YouTube's player: an information leak, arbitrary Flash execution on youtube.com through the app loader, cross-site flashing by redefining loaderInfo.url so the main movie loads an attacker-supplied module, and three Flash-based cross-site scripting bugs in the iframe API's Flash fallback.

Record

Researcher

OpnSec

Published by

OpnSec

Date

25 August 2017

In the archive

• Ranked #6 in the 2016–17 Top 10 Web Hacking Techniques

Related sources

• Part 1
• Part 2
• Part 3
• Part 4

Tags

• flash
• xss
• sop-bypass
• info-leak
• bug-bounty
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of OpnSec, first published at the original source. Preserved copies are kept so the citation survives its host.