Storage xss + design defects of another important function of Snowball Network

1. Storage-type xss 1) The manufacturer fixed the xss for sharing images, and another storage-type xss was available in the new feature;

2) click Publish to upload images. 3) upload an image and capture the package. The complete img Tag also exists. 4) Add the onerror event to the img tag, modify the src attribute and submit it. The window is displayed. 2. A design defect can cause Junk bomb attacks to register users and affect server performance. 1) the password retrieval function does not have verification operations, and a large number of requests can be submitted using tools; 2) the request is submitted successfully, all emails are successfully received;