The unofficial HackerOne disclosure Timeline

b'Nextcloud' disclosed a bug submitted by b'ryotak'
b'Authentication bypass in Global Site Selector allows an attacker to log in as any user'

18 Jan 2024 timeline

b'Nextcloud' disclosed a bug submitted by b'ryotak'
b'Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist'

18 Jan 2024 timeline

b'Nextcloud' disclosed a bug submitted by b'ryotak'
b'Non-admin users can reset app allowlist to the default'

18 Jan 2024 timeline

b'Nextcloud' disclosed a bug submitted by b'ryotak'
b'Open redirect in user_saml via RelayState parameter'

18 Jan 2024 timeline

b'Nextcloud' disclosed a bug submitted by b'hackit_bharat'
b'Self XSS when sending HTML as a comment in the Deck app'

18 Jan 2024 timeline

b'LY Corporation' disclosed a bug submitted by b'mheranco'
b'Reflected XSS on https://travel.line.me'

18 Jan 2024 timeline

b'Shopify' disclosed a bug submitted by b'boy_child_'
b'Non-store owners can transfer Shopify-managed domain to another domain provider'

17 Jan 2024 timeline

b'Shopify' disclosed a bug submitted by b'archangel'
b"[h1-2102] [Oberlo] Least privileged user can cancel account owner's subscription via POST on /payments/subscribe "

17 Jan 2024 timeline

b'Nextcloud' disclosed a bug submitted by b'taise'
b'Bruteforce protection in password verification can be bypassed'

17 Jan 2024 timeline

b'Nextcloud' disclosed a bug submitted by b'st0nzyy'
b' Bypass password confirmation via Context-dependent access control (CDCA)'

17 Jan 2024 timeline

b'Nextcloud' disclosed a bug submitted by b'st0nzyy'
b'Error when editing a calendar appointment returns stacktrace and query'

17 Jan 2024 timeline

b'inDrive' disclosed a bug submitted by b'cypher-28'
b'SSRF in https://couriers.indrive.com/api/file-storage'

16 Jan 2024 timeline

b'HackerOne' disclosed a bug submitted by b'ahacker1'
b'View Titles of Private Reports with pending email invitation'

16 Jan 2024 timeline

b'GitHub' disclosed a bug submitted by b'imrerad'
b'Invite tokens have Insufficient entropy in GHES Management Console '

12 Jan 2024 timeline

b'GitHub' disclosed a bug submitted by b'inspector-ambitious'
b"RC Between GitHub's Repo Transfer REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access Retention"

12 Jan 2024 timeline

b'Mozilla Core Services' disclosed a bug submitted by b'callmed0_4'
b'Internal Blind Server-Side Request Forgery (SSRF) allows scanning internal ports'

12 Jan 2024 timeline

b'TikTok' disclosed a bug submitted by b'ashrafabdelrazik'
b'Reflected XSS On [https://www-useast1a.tiktok.com/ug/incentive/share/hd]'

12 Jan 2024 timeline

b'Mozilla Critical Services' disclosed a bug submitted by b'francisconeves97'
b'Exposure of account recovery hint by querying by user email'

11 Jan 2024 timeline

b'LinkedIn' disclosed a bug submitted by b'find_me_here'
b'Users can access exams in course without having to subscribe to PREMIUM'

10 Jan 2024 timeline

b'Nextcloud' disclosed a bug submitted by b'maholli'
b'Blind SSRF in Mail App'

10 Jan 2024 timeline

1 ... 91 92 93 94 95 ... 776

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.