12.07
Summary
Google Scholar was vulnerable to minor but potentially annoying CSRF vulnerabilities in two different pages. The regular search equivalents of both of these pages used CSRF tokens to mitigate these problems.
Vulnerability #1
There was no CSRF protection used when saving preferences in Google Scholar. So, browsing to the following URL used to set your language on Google Scholars to Arabic and set your search results to return papers written in Chinese: http://scholar.google.com/scholar_setprefs?hl=ar&lang=some&lr=lang_zh-CN&submit. As of right now, the URL no longer updates user preferences (although it does change the language for the current page, and any page accessed from links/forms off of that page).
Vulnerability #2
There was no CSRF check in place for setting up email alerts in Google Scholar. A simple POST to http://scholar.google.com/scholar_alerts?view_op=list_alerts&hl=en where the POST data was
1 2 3 | alert_query=[SOME QUERY]&
alert_max_results=10&
create_alert_btn=Create+alert
|
would have resulted in an alert being created for the currently logged in user (there was a parameter, email_for_op, that was passed in during a real request: removing it seemed to cause the system to default to the currently logged in user’s email address).
More Information
The vulnerabilities mentioned here have all been confirmed patched by
the Google Security Team. I owe them a ton of thanks for organizing this
program and giving me a chance to improve my skills. 
To see more posts I’ve written about vulnerabilities reported under Google’s Vulnerability Reward Program, please click here.