Now on Twitter

the unofficial HackerOne disclosure timeline.

X

b'U.S. Dept Of Defense' disclosed a bug submitted by b'ghostxsec' 
b'[CVE-2020-3452] Unauthenticated file read in Cisco ASA'

14 Feb 2022

b'UPchieve' disclosed a bug submitted by b'zeyu2001' 
b'Widespread CSRF on authenticated POST endpoints'

13 Feb 2022

b'Shopify' disclosed a bug submitted by b'hogarth45' 
b'[h1-2102] Break permissions waterfall'

12 Feb 2022

b'Twitter' disclosed a bug submitted by b'iambouali' 
b"Blind XSS on Twitter's internal Jira panel at allows exfiltration of hackers reports and other sensitive data"

12 Feb 2022

b'Twitter' disclosed a bug submitted by b'zhirinovskiy' 
b'Discoverability by phone number/email restriction bypass'

11 Feb 2022

b'FetLife' disclosed a bug submitted by b'trieulieuf9' 
b'Able to detect if a user is FetLife supporter although this user hides their support badge in fetlife.com/conversations/{id} JSON response'

11 Feb 2022

b'Nextcloud' disclosed a bug submitted by b'technorat' 
b'Information Exposure Through Directory Listing vulnerability'

11 Feb 2022

b'Shopify' disclosed a bug submitted by b'francisbeaudoin' 
b'[h1-2102] Information disclosure - ShopifyPlus add user displays existing Shopify ID fullname'

10 Feb 2022

b'Shopify' disclosed a bug submitted by b'danishalkatiri' 
b'Bypass For #997350 your-store.myshopify.com preview link is leak on third party website Via Online Store'

10 Feb 2022

b'Shopify' disclosed a bug submitted by b'danishalkatiri' 
b'Password reset token leak via "Host header" on third party website'

10 Feb 2022

b'Shopify' disclosed a bug submitted by b'scaramouche31' 
b'Orders full read for a staff with only `Customers` permissions.'

10 Feb 2022

b'Semrush' disclosed a bug submitted by b'a_d_a_m' 
b'Critically Sensitive Spring Boot Endpoints Exposed'

10 Feb 2022

b'GitLab' disclosed a bug submitted by b'iwis' 
b'Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab Instances'

10 Feb 2022

b'GitLab' disclosed a bug submitted by b'jafarakhondali' 
b'Installing Gitlab runner with Docker-In-Docker allows root access'

10 Feb 2022

b'Node.js' disclosed a bug submitted by b'bengl' 
b'Node.js Certificate Verification Bypass via String Injection'

10 Feb 2022

b'Shopify' disclosed a bug submitted by b'ngalog' 
b'Is the Google Bucket Meant To Be Publicly Listable? https://cdn.shopify.com/shop-assets/'

09 Feb 2022

b'Shopify' disclosed a bug submitted by b'ngalog' 
b'staffOrderNotificationSubscriptionDelete Could Be Used By Staff Member With Settings Permission'

09 Feb 2022

b'Shopify' disclosed a bug submitted by b'ngalog' 
b'staffOrderNotificationSubscriptionCreate Is Not Blocked Entirely From Staff Member With Settings Permission'

09 Feb 2022

b'Zomato' disclosed a bug submitted by b'0xdexter' 
b'Race condition in User comments Likes'

09 Feb 2022

b'TikTok' disclosed a bug submitted by b'imran_nisar' 
b'Reflected xss on ads.tiktok.com using `from` parameter.'

09 Feb 2022

1 ... 181 182 183 184 185 ... 774

BY DENIS WERNER - @NOBBD - IMPRESSUM