Yandex.Lenta revealed passwords for LJ users
An interesting glitch was caught today in Yandex.Lenta. It turns out that this blog aggregator incorrectly processed feeds, which is why you could see other people's passwords to Livejournal.
The crux of the problem is that some users, when they subscribe to a feed in Yandex.Lenta, enter their password directly into the URL (in order to see in the Lenta sub-home entries from LJ). If you later want to subscribe to the same feed and enter its normal URL, then Yandex.Lenta could display URLs with someone else's password, as can be seen in the screenshot (below).
The hole was closed today at about 13:00 Moscow time.
The crux of the problem is that some users, when they subscribe to a feed in Yandex.Lenta, enter their password directly into the URL (in order to see in the Lenta sub-home entries from LJ). If you later want to subscribe to the same feed and enter its normal URL, then Yandex.Lenta could display URLs with someone else's password, as can be seen in the screenshot (below).
The hole was closed today at about 13:00 Moscow time.
')
Source: https://habr.com/ru/post/2879/
All Articles