Paragon Initiative Enterprises · Report #113339

Cross-domain AJAX request

Informativestatus

1upvotes

17 Jun 2016disclosed

How it was found

Hi Paragonie Team,

While reviewing your website i discovered that there are Cross-domain AJAX requests being sent, though you are implementing Content-Security-Policy header but Internet Explorer uses experimental X-Content-Security-Policy header according to Wikipedia info (https://en.wikipedia.org/wiki/Content_Security_Policy#Status)

Reference from Hacker one reports:- https://hackerone.com/reports/97191 https://hackerone.com/reports/97948

Please also find screenshot attached

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original