Check Box 2016 Q2 Survey suffers from insecure direct object reference, open redirection, and directory traversal vulnerabilities.