The piggyback parameter on ads.yahoo.com is prone to an open redirect vulnerability. Yahoo! addressed this by simply not fixing it and removing it from the bug bounty scope.
50c6a4f2d1b103f3063eff08517e16411735828edf4dfd0f56e57844ec8da341
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Advisory: Yahoo Bug Bounty Program Vulnerability #2 Open Redirect
Advisory ID: SSCHADV2013-YahooBB-002
Author: Stefan Schurtz
Affected Software: Successfully tested on ads.yahoo.com
Vendor URL: http://yahoo.com
Vendor Status: informed
==========================
Vulnerability Description
==========================
The 'piggyback'-Parameter on "http://ads.yahoo.com" is prone to an Open
Redirect
==========================
PoC-Exploit
==========================
http://ads.yahoo.com/pixel?id=2454131&t=2&piggyback=http%3a//www.google.de&_msig=10r7s21mt&rmxbkn=26&_cbv=187571889
==========================
Solution
==========================
- -
==========================
Disclosure Timeline
==========================
13-Dec-2013 - vendor informed by contact form (Yahoo Bug Bounty Program)
31-Dec-2013 - next message to the Yahoo Security Contact
04-Jan-2014 - feedback from vendor
04-Jan-2014 - vendor informed again about the three vulnerabilities
06-Jan-2014 - Feedback from vendor - Open redirects are no longer in
scope of the Bug Bounty program
==========================
Credits
==========================
Vulnerability found and advisory written by Stefan Schurtz.
==========================
References
==========================
http://yahoo.com
http://www.darksecurity.de/advisories/BugBounty2013/yahoo/SSCHADV2013-YahooBB-002.tx
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAlLRyDsACgkQg3svV2LcbMBPlwCfYNo3J5YH+dkNKJ4fv/sOwdFA
nLMAnA8quOpgxEvymEgRJS029/Rzr2OR
=tDuT
-----END PGP SIGNATURE-----