The unofficial HackerOne disclosure Timeline

b'Shopify' disclosed a bug submitted by b'codermak'
b'Github base action takeover which is used in `github.com/Shopify/unity-buy-sdk`'

12 Jul 2022 timeline

b'Shopify' disclosed a bug submitted by b'intidc'
b'[h1-2102] HTML injection in packing slips can lead to physical theft'

11 Jul 2022 timeline

b'Shopify' disclosed a bug submitted by b'intidc'
b'[h1-2102] Stored XSS in product description via `productUpdate` GraphQL query leads to XSS at handshake-web-internal.shopifycloud.com/products/[ID]'

11 Jul 2022 timeline

b'Shopify' disclosed a bug submitted by b'ramsexy'
b'[h1-2102] Improper Access Control at https://shopify.plus/[id]/users/api in operation UpdateOrganizationUserTfaEnforcement'

11 Jul 2022 timeline

b'Shopify' disclosed a bug submitted by b'fr4via'
b'Improper deep link validation '

11 Jul 2022 timeline

b'Shopify' disclosed a bug submitted by b'kun_19'
b'Collaborators and Staff members without all necessary permissions are able to create, edit and install custom apps'

11 Jul 2022 timeline

b'Shopify' disclosed a bug submitted by b'saltymermaid'
b'Theme editor `oseid` parameter is leaked to third-party services through the `Referer` header which leads to somekind of storefront password bypass.'

11 Jul 2022 timeline

b'GitLab' disclosed a bug submitted by b'sateeshn'
b'Able to view hackerone reports attachments'

11 Jul 2022 timeline

b'Stripe' disclosed a bug submitted by b'beerboy_ankit'
b'Mass Account Takeover at https://app.taxjar.com/ - No user Interaction'

11 Jul 2022 timeline

b'Glovo' disclosed a bug submitted by b'cmuppin'
b'Getting a free delivery by singing up from "admin_@glovoapp.com"'

11 Jul 2022 timeline

b'Glovo' disclosed a bug submitted by b'battle_angel'
b'Server Side Template Injection on Name parameter during Sign Up process'

11 Jul 2022 timeline

b'Vanilla' disclosed a bug submitted by b'malek'
b'Homograph attack bypass cause redirection'

10 Jul 2022 timeline

b'Radancy' disclosed a bug submitted by b'dk4trin'
b'Blind SSRF at packagist.maximum.nl'

10 Jul 2022 timeline

b'Internet Bug Bounty' disclosed a bug submitted by b'tdp3kel9g'
b'DoS via lua_read_body() [zhbug_httpd_94]'

09 Jul 2022 timeline

b'Internet Bug Bounty' disclosed a bug submitted by b'ricterz'
b'Apache HTTP Server: mod_proxy_ajp: Possible request smuggling'

09 Jul 2022 timeline

b'Internet Bug Bounty' disclosed a bug submitted by b'tdp3kel9g'
b'Read beyond bounds via ap_rwrite() [zhbug_httpd_47.2]'

09 Jul 2022 timeline

b'Internet Bug Bounty' disclosed a bug submitted by b'tdp3kel9g'
b'Read beyond bounds in mod_isapi.c [zhbug_httpd_41]'

09 Jul 2022 timeline

b'Internet Bug Bounty' disclosed a bug submitted by b'tdp3kel9g'
b'Controllable read beyond bounds in lua_websocket_readbytes() [zhbug_httpd_126]'

09 Jul 2022 timeline

b'Internet Bug Bounty' disclosed a bug submitted by b'tdp3kel9g'
b'Read beyond bounds in ap_strcmp_match() [zhbug_httpd_47.7]'

09 Jul 2022 timeline

b'Hyperledger' disclosed a bug submitted by b'dusty_wormwood'
b'Unauthorized packages modification or secrets exfiltration via GitHub actions'

08 Jul 2022 timeline

1 ... 157 158 159 160 161 ... 774

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.