MyCrypto · Report #326697
HTML Injection on https://www.mycrypto.com/
Validstatus
3upvotes
9 Apr 2018disclosed
Summary
A vulnerability was reported by t-pwn that allowed arbitrary HTML injection via the notifier functionality. After a keystore file was uploaded, the filename would be shown without first sanitizing it. MyCrypto has since fixed our notification to no longer display the unsanitized filename.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.