Now on Twitter

the unofficial HackerOne disclosure timeline.

X

b'VK.com' disclosed a bug submitted by b'azimoff' 
b'XSS .'

01 Dec 2021

b'Glassdoor' disclosed a bug submitted by b'bombon' 
b'[https://www.glassdoor.com] - Web Cache Deception Leads to gdtoken Disclosure '

30 Nov 2021

b'Acronis' disclosed a bug submitted by b'spookhorror' 
b'IDOR vulnerability (Price manipulation)'

30 Nov 2021

b'U.S. Dept Of Defense' disclosed a bug submitted by b'palaziv' 
b'Unauthenticated Access to Admin Panel Functions at https:///'

29 Nov 2021

b'U.S. Dept Of Defense' disclosed a bug submitted by b'palaziv' 
b'Unauthenticated Access to Admin Panel Functions at https:///'

29 Nov 2021

b'U.S. Dept Of Defense' disclosed a bug submitted by b'dmonsterrr' 
b'Expired SSL Certificate allows credentials steal'

29 Nov 2021

b'MCUboot' disclosed a bug submitted by b'r0m50' 
b'private keys exposed on the GitHub repository'

27 Nov 2021

b'XVIDEOS' disclosed a bug submitted by b'sbakhour' 
b'CSRF on delete friend requests - Not protected with CSRF Token'

26 Nov 2021

b'Shopify' disclosed a bug submitted by b'fr4via' 
b'Insufficient session expiration in the **com.shopify.ping** android app'

26 Nov 2021

b'Shopify' disclosed a bug submitted by b'stapia' 
b'A non-privileged user may create an admin account in Stocky'

25 Nov 2021

b'Shopify' disclosed a bug submitted by b'youstin' 
b'Sidekiq dashboard exposed at notary.shopifycloud.com'

25 Nov 2021

b'Traffic Factory' disclosed a bug submitted by b'vavkamil' 
b'WordPress Plugin Update Confusion at trafficfactory.com'

25 Nov 2021

b'Mail.ru' disclosed a bug submitted by b'ghost_shell' 
b'Cross-site Scripting (XSS) - Stored'

25 Nov 2021

b'DigitalOcean' disclosed a bug submitted by b'wshadow' 
b'Blind XSS via Digital Ocean Partner account creation form.'

23 Nov 2021

b'XVIDEOS' disclosed a bug submitted by b'rajput__16' 
b'No-Rate limit of current password on delete account endpoint(https://www.xvideos.com/account/close)'

23 Nov 2021

b'Shopify' disclosed a bug submitted by b'hydraxanon82' 
b'Staff who only have apps and channels permission can do a takeover account at the wholesale store (Bypass get invitation link)'

21 Nov 2021

b'A.S. Watson Group ' disclosed a bug submitted by b'sachin_kumar_' 
b'Full account takeover of any user through GET /checkout/psp/auth_response?'

21 Nov 2021

b'8x8' disclosed a bug submitted by b'plokta' 
b'[jitsi-meet] Authentication Bypass when using JWT w/ public keys'

20 Nov 2021

b'Lark Technologies' disclosed a bug submitted by b'imran_nisar' 
b'Non privileged user is able to approve his own app himself leading to mass privilege escalations.'

20 Nov 2021

b'Internet Bug Bounty' disclosed a bug submitted by b'itsecurityco' 
b'Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.50'

19 Nov 2021

1 ... 137 138 139 140 141 ... 718

BY DENIS WERNER - @NOBBD - IMPRESSUM