Orkut CSS , XSS bugs

Orkut's several links can be used to inject java script !!!

like

http://www.orkut.com/Invite.aspx?continue=javascript:alert(document.cookie)

http://www.orkut.com/Friends.aspx?show=group1;alert(document.cookie)


Source

email disclosure in orkut

a spammer joining on orkut can get the email ids of orkut users in a variety of ways

1. Join orkut
2. Add freinds which he may seen in any communities !!!
3. now in freinds link on his profile he can see all email ids :(

Source This bug is fixed

1. Go to some random profiles which may u see in any communities !!!
2. Click ignore user
3. now u can have a list of ignored users in your gmail account with marked as blocked !!!
4. in google talk also this list will comes in blocked list

This bug is fixed

Orkut Cookie Stealers

Have u received any script from any one including freinds ?

which may says run this script to do

1. Send scraps to all
2. Send color scraps to friends
3. Send message at a shot to all your friends
4. creating topic in all communities .. etc

if u blindly use that script u may land up in a big trouble
ya.
when u run the script u may get some funy message or nothing

but they can steal your cookie details by sending cookies to thier scrap books !!

well this may be a closed bug but can activated by some other exploiter