A security researcher demonstrated multiple vulnerabilities, two of which could let an attacker read and steal user data.