4 ms·
The exploit uses a "data-uri script tag" in the video embed field. In other words, it runs some sort of script through the section of the site that's supposed t
by derpenxyne 14y ago
The exploit uses a "data-uri script tag" in the video embed field. In other words, it runs some sort of script through the section of the site that's supposed to only allow video embed codes from sites like YouTube and Vimeo. A pretty serious security hole.
- matthuggins 14y agoMind sharing where you found this info? Did you figure it out yourself?
- schill 14y agoSee point #10 from http://www.buzzfeed.com/ryanhatesthis/hacker-group-exploits-security-hole-in-tumblr http://www.buzzfeed.com/ryanhatesthis/hacker-group-exploits-...