Multiple Vulnerabilities in BitDefender website

A Security Researcher from crackhackforum.com, Rynaldo, has discovered multiple Vulnerabilities in one of the Biggest Antivirus company called "BitDefender".

The researcher claimed that he sent several emails to BitDenfender's team, butthey haven't responded nor fixed the vulnerabilities neither.

"The website is having several reflected XXS vulnerabilities and the CSRF
vulnerability. Also I have found a way to cause DOS attack on the local
server to take BitDefender temporarely down." Rynaldo said.

CSRF attack : https://my.bitdefender.com/en_us/my/#page=account.index hacker is able to perform CSRF attack to change the details on the user's profile.CSRF tokens aren't implemented and password isn't required to change information on the profile.

Reflected XSS

XSS attack :
"my.bitdefender.com/en_us/", this page will set the language specifications on the URL (en_us), but haven't secured it very well. That means by removing the language specification with our XSS payload then our XSS script will be executed. Language specifications are being forced on the URL on every page and that means we can inject our XSS in every page on "my.bitdefender.com".