Web Vulnerability regarding F company

1. XSS
1. Severity : High
2. URI was set to 1<div style=width:expression(prompt(957586))>
   URL encoded GET input genre was set to " onmouseover=prompt(968437) bad="
   
   
   
2. Application Error Msg
1. Severity : Medium
2. URL encoded GET input key was set to '"'");|]*{%0d%0a<%00>
   Error message found:

   java.lang.NumberFormatException: For input string:

   
   
   
3. Error Msg on Page
1. Severity : Medium
2. Pattern found:

   java.lang.NumberFormatException: For input string:

   
   
   
4. Insecure crossdomain.xm
1. Severity : Medium
2. The browser security model normally prevents web content from one domain from accessing data from another domain. This is commonly known as the "same origin policy". URL policy files grant cross-domain permissions for reading data. They permit operations that are not permitted by default. The URL policy file is located, by default, in the root directory of the target server, with the name crossdomain.xml (for example, at www.example.com/crossdomain.xml).
   
   When a domain is specified in crossdomain.xml file, the site declares that it is willing to allow the operators of any servers in that domain to obtain any document on the server where the policy file resides. The crossdomain.xml file deployed on this website opens the server to all domains (use of a single asterisk "*" as a pure wildcard is supported) like so:

   <cross-domain-policy>
   <allow-access-from domain="*" />
   </cross-domain-policy>
   

   This practice is suitable for public servers, but should not be used for sites located behind a firewall because it could permit access to protected areas. It should not be used for sites that require authentication in the form of passwords or cookies. Sites that use the common practice of authentication based on cookies to access private or user-specific data should be especially careful when using cross-domain policy files.
   This vulnerability affects Server.