Microsoft SharePoint's Follow feature contained a reflected XSS vulnerability (CVE-2017-8514) where the SiteName GET parameter was unsafely reflected into a JavaScript function call without proper encoding, allowing attackers to break out of the single-quoted context and inject arbitrary JavaScript via payloads like '-confirm("XSS")-'.
Reflected XSS vulnerability found in Microsoft's research search functionality (q parameter) that bypassed client-side validation by directly injecting payloads via URL, enabling account takeover through cookie theft.
A reflected XSS vulnerability in a URL parameter was chained with multiple design flaws (tokens stored in localStorage, lack of token revocation across devices, authorization via headers instead of cookies) to achieve persistent account takeover by stealing and replaying Cognito refresh tokens. The attacker could silently exfiltrate authentication tokens while clearing localStorage to make the victim believe they were logged out.