HUGE security hole. (edit)


werdna's avatar
go to ANYONES userpage messages ex:
[link]

and you can see them all!

now log out and go to the messages page

heres is what you get


deviantART Hot Topics
1. Devious Mosaics Released with Contest! by $matteo with 143 comments. Jul 27, 2002
2. Q2 Earnings Mailed! by $spyed with 155 comments. Jul 26, 2002
3. Open Letter to the Community; AOL Registrations by $jark with 481 comments. Jul 23, 2002
4. deviantLINKS Released! *UPDATE* by $matteo with 245 comments. Jul 15, 2002
5. deviantART 88x31 Link Button Contest by $jark with 282 comments. Jul 10, 2002
6. Devvies Finalists Announced, Voting Begins by $tack with 147 comments. Jul 03, 2002
7. DA Prints: The Future of Online Art is Here! by $spyed with 227 comments. Jun 26, 2002
8. Warhol Has a Sexually Transmitted Disease Update! by $jark with 548 comments. Jun 21, 2002
9. Fella's Second Birthday Contest by $jark with 276 comments. Jun 20, 2002
10. Escher Suffers Slight Concussion by $jark with 337 comments. Jun 13, 2002
11. Who Runs This Crackhouse; Part II by $jark with 263 comments. Jun 09, 2002
12. Point yourdomain.com to your userpage! by $spyed with 161 comments. Jun 06, 2002
13. deviantART Tiers Launched; Surf Smarter! by $spyed with 191 comments. Jun 04, 2002
14. DA Prints on the Horizon by $spyed with 249 comments. Jun 03, 2002
15. Devious Calendar :: June 2002 by $attila with 125 comments. May 30, 2002
16. deviantMAG Issue 02 Released by +dygel with 153 comments. May 29, 2002
17. May Subscription Content; Fuzzydemon Comic Special by $jark with 116 comments. May 26, 2002
18. The Call Goes Out (Updated) by $tack with 293 comments. May 07, 2002
19. Cell Phone Art at deviantART; Win a WACOM! by $jark with 223 comments. May 01, 2002
20. deviantART Reaches a Quarter Million Deviations by $matteo with 398 comments. Apr 25, 2002
21. deviantART and Adobe get in bed?? by *kungfuftr with 346 comments. Apr 23, 2002
22. A Rip Manip by `the-jafo with 475 comments. Apr 21, 2002
23. Time Running Out for Devvies Nominations by $tack with 116 comments. Apr 17, 2002
24. A Mack Truck Rectum Disaster! by $jark with 391 comments. Apr 15, 2002
25. Angry Key Deviants 3 Released! by +dygel with 127 comments. Apr 13, 2002
26. deviantART Launches First Community Driven Awards by $tack with 342 comments. Apr 04, 2002
27. deviantART Newsletter 01 :: April 2002 Coming! by $matteo with 120 comments. Mar 13, 2002
28. deviantART 0wns j00! Rules Clarifications by $jark with 94 comments. Mar 13, 2002
29. Show us how deviantART.com 0wns j00!!! by $MikeyLove with 215 comments. Mar 12, 2002
30. GUI Olympics Week Three Results by $jark with 72 comments. Mar 11, 2002
31. deviantART Community Leaves a Message at SXSW by $tack with 181 comments. Mar 10, 2002
32. Now Back To Our Regular Scheduled Program by $jark with 232 comments. Mar 06, 2002
33. New Resources Section Added by $matteo with 155 comments. Mar 04, 2002
34. GUI Olympics Week Two Results by $jark with 72 comments. Mar 04, 2002
35. New Subscription Abilities *UPDATED* by $MikeyLove with 166 comments. Mar 03, 2002
36. Unmitigated Green; March Subscription Content by $jark with 122 comments. Mar 02, 2002
37. New Subscriber Wallpaper by Computerologist by $matteo with 156 comments. Feb 27, 2002
38. deviantBAR 2.0 Released! by $jark with 125 comments. Feb 25, 2002
39. TechTV 0wns Me! :) by $matteo with 183 comments. Feb 24, 2002
40. An In-Depth Look at deviantART by $jark with 108 comments. Feb 21, 2002
41. New Subscriber Skin Suite by Treetog by $matteo with 107 comments. Feb 19, 2002
42. Behind the Scenes; Who Runs This Crack-house? by $jark with 227 comments. Feb 17, 2002
43. DeviantMAG Issue 01! by $arc with 187 comments. Feb 10, 2002
44. deviantART Gets Good T-Shirts, No More CafePress by $matteo with 142 comments. Feb 06, 2002
45. OMG OMG OMG by $tack with 428 comments. Feb 04, 2002
46. dA v2 Delayed by $tack with 360 comments. Feb 02, 2002
47. deviantART v2 Opens to Subscribers by $matteo with 223 comments. Jan 29, 2002
48. Cybersquatting Extortion Scheme Targets WinStep by $jark with 174 comments. Jan 26, 2002
49. SXSW Interactive People's Choice Awards Open by $tack with 103 comments. Jan 23, 2002
50. deviantBAR 1.0 Released! by $jark with 238 comments. Jan 21, 2002
51. TechTV features deviantART! by ~rubberducky with 230 comments. Jan 17, 2002
52. deviantART Section Icon Contest by $jark with 125 comments. Jan 11, 2002
53. deviantART & Merlin 3D™ Exclusive! by $attila with 143 comments. Jan 06, 2002
54. January Featured Subscription Deviation Arrives! by $jark with 204 comments. Jan 05, 2002
55. The Devvies Are Coming! by $matteo with 179 comments. Jan 03, 2002
56. A New Browsing Paradigm and Other Information by $jark with 166 comments. Dec 30, 2001
57. December 2001 T-Shirt Contest Nominations by $jark with 47 comments. Dec 25, 2001
58. Advertise On deviantART! by $jark with 94 comments. Dec 20, 2001
59. 1 Server, 2 Server, 3 Server, 4! by $attila with 140 comments. Dec 20, 2001
60. Art, Individual Beliefs and Society by $jark with 239 comments. Dec 18, 2001
61. The Ultimate in Milestones: 100000 Deviations by $jark with 137 comments. Dec 18, 2001
62. deviantART Announces Version 2! by $arc with 346 comments. Dec 15, 2001
63. Official 100K Devious Deviations Contest by +brazensix with 154 comments. Dec 11, 2001
64. deviantART's Fella Stole Christmas Contest! by $jark with 123 comments. Dec 02, 2001
65. Devious T-Shirts Available Now! by $jark with 52 comments. Dec 01, 2001
66. deviantART Releases Flash Category! by $matteo with 136 comments. Dec 01, 2001
67. Monthly T-Shirt Contest: November Voting Begins by $jark with 64 comments. Nov 25, 2001
68. What Are Your Devious Favorites? by $jark with 172 comments. Nov 24, 2001
69. deviantART Holiday Gear! has Arrived! by $jark with 79 comments. Nov 16, 2001
70. deviantART Announces Basic Membership Plan! by $arc with 413 comments. Nov 15, 2001
71. A writing project for deviantART by `chosenone- with 89 comments. Nov 14, 2001
72. deviantART To Interview Styles XP Developers by $jark with 80 comments. Oct 30, 2001
73. deviantART Monthly T-Shirt Design Contest! by $jark with 121 comments. Oct 30, 2001
74. deviantART Adds Prose Category! by $jark with 117 comments. Oct 23, 2001
75. deviantART: The Drinking Game by +dygel with 265 comments. Oct 20, 2001
76. Gnutella Contest: wraps up Thursday @ Midnight! by $spyed with 32 comments. Oct 17, 2001
77. From Dusk Till Dawn: A deviantART Drama! by $jark with 138 comments. Oct 16, 2001
78. Do NOT Attempt To Adjust Your Devious Connection! by $jark with 242 comments. Oct 14, 2001
79. Yet Another Speed and Bandwidth Update by $jark with 109 comments. Oct 03, 2001
80. DA Exclusive: Design the Official Gnutella Logo! by $spyed with 74 comments. Oct 03, 2001
81. deviantART is NOT Powered by Hamsters! by $jark with 143 comments. Sep 24, 2001
82. RAM Issue Fixed, deviantART Finally Moving! by $jark with 114 comments. Sep 15, 2001
83. Supercharge deviantART Image and File Downloading! by $jark with 145 comments. Sep 14, 2001
84. Innocence Lost; Americans Attacked! by $jark with 190 comments. Sep 12, 2001
85. Site Speed Status Update by $jark with 105 comments. Sep 09, 2001
86. New deviantART Forums Released - Crowd Goes Wild! by $arc with 87 comments. Sep 02, 2001
87. deviantART is Creeping Its Way To Hell, But... by `dspayre with 258 comments. Aug 29, 2001
88. deviantART To Move From Yugo To Ferrari! by $jark with 151 comments. Aug 25, 2001

Unread Notes
1. dougbtn has bought you a deviantART subscription! ~devart Aug 02, 2002, 09:04:48
2. andymale has bought you a deviantART subscription! ~devart Jul 26, 2002, 08:39:00
3. Deviation Print Request ~allemande Jul 16, 2002, 18:12:00
4. noti0n has bought you a deviantART subscription! ~devart Jul 09, 2002, 01:37:06
5. flesh-n-color has bought you a deviantART subscrip ~devart Jul 08, 2002, 22:32:18
6. psychomanatees has bought you a deviantART subscri ~devart Jul 04, 2002, 14:21:58
7. noti0n has bought you a deviantART subscription!


this is a HUGE sericurty hole and you can read anyones messages!!!!!
Comments40
Join the community to add your comment. Already a deviant? Log In
chavez's avatar
yay, its allright. good
chris's avatar
psychomanatees's avatar
wtf? i went to jarks messages and it said there was a note from ~devart saying that psychomanatees bought him a subscription....the hell?
mkinne's avatar
Chris Bolt: should be fixed now

yay Chris.
mira's avatar
it only made no sense if you didn't let it make any sense.
werdna's avatar
huh? mira that made no sense
mira's avatar
if you didn't know about it, you wouldn't have been very willing, would you have? ;)
chavez's avatar
werdna's avatar
it better not be me
goldenchild3k's avatar
I had a willing friend, and on his permission I updated his devwatch and removed someone from it. Harmless?
chavez's avatar
i would never do this
chavez's avatar
sure, i just say it
werdna's avatar
then DONT MARK AS READ. thatll just make people mad
chavez's avatar
but i c comments too, and hot topics and devs!
thrawn's avatar
but should they?
werdna's avatar
thrawn- thats because subscribers can see that
thrawn's avatar
well you can see COMMENTS and such too, which is a bit of an issue, sint it?
five's avatar
Here's what I just noticed; those notes are the same on EVER userpage. I know that because I went to my page, jark's page, and chris's page, and all of their unread notes were the same...the ones your listed.
werdna's avatar
ok :) thanks five
five's avatar
Hmm. It's only an issue to logged in members if they are subscribers (i.e. they are the only ones who can see it). But this is obviously a major bug.

Long story short: my notes to jark and chris didn't say anything about being a subscriber or not. So they should handle both issues...especially since I linked them to this thread.
chavez's avatar
i can see everything, aye! thats a big sec hole
werdna's avatar
oh.. so its a subscriber thing? then why is it that when I log OUT I get all the notes?? :o
chavez's avatar
yeah send jark notenow!