A subdomain takeover of ping.ubnt.com via unclaimed Amazon CloudFront distribution combined with shared session cookies across *.ubnt.com subdomains enabled complete authentication bypass of Ubiquity's SSO system. The vulnerability was responsibly disclosed via HackerOne.
A researcher escalated a self-XSS vulnerability on Uber's Partners portal into a cross-user XSS attack by chaining three separate issues: leveraging missing CSRF protection in the OAuth login flow and logout endpoint, combined with CSP manipulation and iframe-based session hijacking to execute arbitrary JavaScript in a victim's context and exfiltrate sensitive data.
A technique to escalate self-XSS in Moodle into full XSS against arbitrary users by exploiting double session cookies with different paths combined with login CSRF or impersonation functionality, allowing arbitrary JavaScript execution in victim context for full account compromise.