Vulnerabilities in the websites of Harvard, Cambridge, EPFL, ETH Zurich, CMU

While applying for my masters, I decided to report vulnerabilities in the websites of universities where I was planning to apply and sent the vulnerability reports to their respective security offices. I hoped this would set me apart from the rest of the applicants. 

Reflected XSS in websites of Harvard, Cambridge, EPFL, ETH Zurich

Reflected XSS arises when an application receives data in a HTTP request and includes that data within the immediate response in an unsafe way. I used Google dorking to find websites vulnerable to reflected XSS. By searching for websites in which the application echoed the supplied input in the response to the URL and didn't perform any other processing of the supplied input, I managed to find reflected XSS in a number of websites.
I  reported reflected XSS in the websites of Harvard, Cambridge, EPFL, ETH Zurich. Harvard and Cambridge even provided certificates for reporting these vulnerabilities.