Now on Twitter

the unofficial HackerOne disclosure timeline.

X

b'Rockset' disclosed a bug submitted by b'afsec' 
b'Leaking Rockset API key on Github'

02 Mar 2021

b'Rockstar Games' disclosed a bug submitted by b'gevakun' 
b'Minor Account Privacy can Set to Everyone.'

02 Mar 2021

b'Stripo Inc' disclosed a bug submitted by b'3x3s' 
b'Memory Dump and Env Disclosure via Spring Boot Actuator'

02 Mar 2021

b'Dropbox' disclosed a bug submitted by b'jackb898' 
b'Coupon codes indexed by Google'

01 Mar 2021

b'Grammarly' disclosed a bug submitted by b'fransrosen' 
b'Config override using non-validated query parameter allows at least reflected XSS by injecting configuration into state'

01 Mar 2021

b'Mail.ru' disclosed a bug submitted by b'secator' 
b'[xss] setTheme ajax_attach_action'

01 Mar 2021

b'Mail.ru' disclosed a bug submitted by b'secator' 
b'[xss] url '

01 Mar 2021

b'Mail.ru' disclosed a bug submitted by b'secator' 
b'[xss] passrestore m/touch/tel'

01 Mar 2021

b'Mail.ru' disclosed a bug submitted by b'0ang3el' 
b'XXE webdav.mail.ru - PROPFIND/PROPPATCH'

01 Mar 2021

b'Mail.ru' disclosed a bug submitted by b'0ang3el' 
b'Blind SSRF calendar.mail.ru '

01 Mar 2021

b'Nextcloud' disclosed a bug submitted by b'alexanderhofstaetter' 
b'Acting under any different user via DB-stored credentials'

01 Mar 2021

b'Nextcloud' disclosed a bug submitted by b'yzy9951' 
b'Reflected XSS when renaming a file with a vulnerable name which results in an error'

01 Mar 2021

b'Nextcloud' disclosed a bug submitted by b'alacn1' 
b'External storage app saves password for all users in the database'

01 Mar 2021

b'Xiaomi' disclosed a bug submitted by b'l1ack3d' 
b'CORS Misconfiguration, could lead to disclosure of users information'

01 Mar 2021

b'Xiaomi' disclosed a bug submitted by b'cujanovic' 
b'DOM-based XSS in d.miwifi.com on IE 11'

01 Mar 2021

b'Mail.ru' disclosed a bug submitted by b'tofla' 
b'Reflected XSS https://tracker.my.com'

28 Feb 2021

b'8x8' disclosed a bug submitted by b'melbadry9' 
b'DNS Misconfiguration (Subdomain Takeover) .staging..8x8.com'

28 Feb 2021

b'Lark Technologies' disclosed a bug submitted by b'w2w' 
b"Improper generating of access link at go.larksuite.com leads to access to other organizations/users' private data"

27 Feb 2021

b'Dropbox' disclosed a bug submitted by b'h4x0r_dz' 
b'User has Sender permission can Get Team information '

26 Feb 2021

b'Mail.ru' disclosed a bug submitted by b'alexeysergeevich' 
b'capsula.mail.ru - reflected xss'

26 Feb 2021

1 ... 217 218 219 220 221 ... 738

BY DENIS WERNER - @NOBBD - IMPRESSUM