Disclosure

Found a cross-site scripting flaw in MediaWiki core, the software behind Wikipedia (CVE-2015-6729).

Found a secret-handling flaw in Square's Keywhiz secret management system and reported it through Square's bug bounty program; Square engineers opened the fix (PR #50) from the report.

Found cross-site scripting flaws in the LDAP Tool Box Self Service Password application.

Found a sandbox breakout in Google Translate and reported it to Google.

Found unpatched cross-site scripting and a potential remote code execution path in the Cloud9 online IDE.

Found SQL injection and input validation flaws in the Scalr cloud management platform.

Found cross-site scripting flaws on CNN.com and reported them.

Found denial-of-service and cross-site scripting flaws in the Google Glass developer program and disclosed them to the Glass team, with an upstream patch to Google's mirror-quickstart-java sample.

Found vulnerabilities in Security Onion's CapMe interface; the Security Onion team patched them and published an advisory.

Found a vulnerability in Apache Solr running on Jetty (SOLR-4861) and coordinated the fix with the Apache Solr project.

Reported a cross-site scripting issue in jQuery core (ticket #12254), a library used on millions of sites.

Found a denial-of-service flaw in the Apache Batik SVG toolkit (BATIK-1023) and reported it to the Apache Batik project.

Found vulnerabilities in Basecamp and 37signals infrastructure and disclosed them to 37signals.