Summary. DENIC eG runs the central registry for the .de top-level domain. Its website at denic.de was vulnerable to reflected cross-site scripting through a parameter that was not part of the application's normal URL scheme but was still reflected into the page unescaped, which made it possible to read the session cookie. Reported in June 2011 and handled quickly and professionally.
Background
DENIC eG is the central registry for the .de top-level domain and operates the infrastructure behind it. Its website at denic.de was vulnerable to reflected cross-site scripting through a parameter that wasn't part of the application's normal URL scheme but was still reflected unescaped into the page, which made it possible to read the session cookie.
Disclosure
I reported the issue to DENIC eG on June 24th, 2011. DENIC responded quickly and professionally: on request, they provided the PGP key of their security contact and fixed the issue with the priority it needed. My thanks to Boban Krsic, Chief Security Advisor at DENIC eG, for the fast response and the professional handling, exactly the kind of process RFC 9116's security.txt is meant to make the norm.