In the last 2 years, I have seen 100's of such on paypal/ebay.
Just to name a few, http://www.xssed.com/search?key=paypal.com
PayPal.com XSS Vulnerability
61–70 of 79 posts
Re: PayPal.com XSS Vulnerability
#62Is there any legitimate reason to discriminate because of age?
The Federal Labor Standards Act has provisions about anyone under the age of 18 working for companies whose revenue is greater than $500,000. It sucks to be a kid for a lot of reasons. This kid just blamed Paypal for one of our country's many idiotic federal laws. This choice should be considered a career limiting decision by any hiring manager.
How do those apply in Germany? Do all subsidiaries in all countries have to follow FLSA? I assume Paypal's German subsidiary is only responsible for following German employment law.
Re: PayPal.com XSS Vulnerability
#63Earlier quoted context omitted.
The Federal Labor Standards Act has provisions about anyone under the age of 18 working for companies whose revenue is greater than $500,000. It sucks to be a kid for a lot of reasons. This kid just blamed Paypal for one of our country's many idiotic federal laws. This choice should be considered a career limiting decision by any hiring manager.
This choice should be considered a career limiting decision by any hiring manager. Are you saying that you're holding a 17 year old student in Germany responsible for not understanding US labor laws?
It makes me angry, but the law here in the US is that "ignorance is not a defense." Oh... you didn't know our several million laws when you broke one? Too bad, they say. Lawyers counter that if the law was simpler, they wouldn't have jobs.
Re: PayPal.com XSS Vulnerability
#64Can somebody explain how that script triggers?
Re: PayPal.com XSS Vulnerability
#65Is there any legitimate reason to discriminate because of age?
The Federal Labor Standards Act has provisions about anyone under the age of 18 working for companies whose revenue is greater than $500,000. It sucks to be a kid for a lot of reasons. This kid just blamed Paypal for one of our country's many idiotic federal laws. This choice should be considered a career limiting decision by any hiring manager.
You should try not coming up with bad reasons to not hire qualified candidates.
Re: PayPal.com XSS Vulnerability
#66Earlier quoted context omitted.
They didn't have to pay him. Still very poorly handled. Should've gone something like: 1. "Hey, that's awesome that you found that, thanks!" 2. "For very good reasons (a), (b) and (c) we can't actually pay you, that really sucks :(" 3. "But hey we like your style, so how about we fly you over for an internship when you've finished school / investigate if Germany has different rules / look at scholorship options and a…
I totally agree, and they have the ability to give him the money. All they would have to do is ask for a parent to represent him.
IANAL.. but I can't see how asking a parent to represent him would relieve PayPal of complying with labor standards for minors... he's still the one doing the work.. and advising him to have a parent represent him is just written proof that they knew.
Re: PayPal.com XSS Vulnerability
#671. seriously, you couldn't just say you're 18? nobody cares in fact. 2. well, fuck paypal! 3. not a good way to show PoC. Is there antiCSRF on search form? Can I see the whole flow?
When arbitrary limits like "18+ years old to get paid to report bugs" come up, I look first to the legal system for blame. Consider that these bug bounties are going to be filed with the IRS and all that: these bug bounties are regulated, and with labor involved, it'll be more highly regulated for minors. I'm guessing there's some extra legal hassle to pay minors for their bug reports that paypal doesn't currently consider worth dealing with.
Re: PayPal.com XSS Vulnerability
#68Earlier quoted context omitted.
The Federal Labor Standards Act has provisions about anyone under the age of 18 working for companies whose revenue is greater than $500,000. It sucks to be a kid for a lot of reasons. This kid just blamed Paypal for one of our country's many idiotic federal laws. This choice should be considered a career limiting decision by any hiring manager.
This choice should be considered a career limiting decision by any hiring manager. Are you saying that you're holding a 17 year old student in Germany responsible for not understanding US labor laws?
[deleted]
Re: PayPal.com XSS Vulnerability
#69PayPal should have put the reward into a trust for them for a year if there were legal issues.
Kudos for them being honest with both the bug and their age regardless.
The future is probably filled with teenagers discovering things, good and bad.
Teenagers are still prosecuted as adults but legally treated as less for other responsibilities.
Re: PayPal.com XSS Vulnerability
#70Earlier quoted context omitted.
This choice should be considered a career limiting decision by any hiring manager. Are you saying that you're holding a 17 year old student in Germany responsible for not understanding US labor laws?
It makes me angry, but the law here in the US is that "ignorance is not a defense." Oh... you didn't know our several million laws when you broke one? Too bad, they say. Lawyers counter that if the law was simpler, they wouldn't have jobs.
Yes, but US labor laws don't apply to someone living in Germany anyway.