Top10 publishers:

bobrov	107
sp1d3rs	54
bigbear_	38
guido	37
bl4de	37
jobert	37
isox	36
4lemon	35
geeknik	35
edio	34

Now on Twitter

the unofficial HackerOne disclosure timeline.

X

Mobile Vikings disclosed a bug submitted by 4lemon 
Approve topup method by sender of this method

04 Mar 2015

PHP disclosed a bug submitted by andreapalazzo 
SoapClient's __call() type confusion through unserialize()

03 Mar 2015

Vimeo disclosed a bug submitted by fin1te 
Ability to Download Music Tracks Without Paying (Missing permission check on`/musicstore/download`)

01 Mar 2015

The Internet disclosed a bug submitted by dirtybit 
Bad Write in TTF font parsing (win32k.sys)

01 Mar 2015

Vimeo disclosed a bug submitted by dotspoted 
Serious Vulnerability Found

27 Feb 2015
wont-fix

itBit Exchange disclosed a bug submitted by zoczus 
Notification Emails: IP + Content-Spoofing

27 Feb 2015

itBit Exchange disclosed a bug submitted by 4lemon 
Unsecure data in "device" response - OTP

27 Feb 2015

HackerOne disclosed a bug submitted by siddiki 
Team member invitations to sandboxed teams are not invalidated consistently (v2)

27 Feb 2015

PHP disclosed a bug submitted by ryat 
Use after free vulnerability in unserialize() with DateTimeZone

27 Feb 2015

99designs disclosed a bug submitted by pranav_hivarekar 
CSRF to connect attacker's twitter account to logged in victims account

26 Feb 2015

Greenhouse.io disclosed a bug submitted by fransrosen 
Subdomain Takeover using blog.greenhouse.io pointing to Hubspot

26 Feb 2015

Vimeo disclosed a bug submitted by tfairane 
Vimeo.com Insecure Direct Object References Reset Password

26 Feb 2015

Vimeo disclosed a bug submitted by avlidienbrunn 
Adding profile picture to anyone on Vimeo

26 Feb 2015

HackerOne disclosed a bug submitted by danlec 
CSP Bypass: Click handler for links with data-method="post" can cause authenticity_token to be sent off domain

26 Feb 2015

Todoist disclosed a bug submitted by cliffordtrigo 
Taking over a Business Account Admin

26 Feb 2015

Todoist disclosed a bug submitted by cliffordtrigo 
Remotely removing credit cards from business accounts!

26 Feb 2015

Twitter disclosed a bug submitted by config 
User's DM won't deleted after logout from Twitter for iOS (com.atebits.xxx.application-state)

25 Feb 2015

Twitter disclosed a bug submitted by homakov 
Redirect URL in /intent/ functionality is not properly escaped

24 Feb 2015

Square disclosed a bug submitted by mikkz 
XSS on bookfresh

23 Feb 2015

Square disclosed a bug submitted by avicoder 
HTTP Header revealing server information.

23 Feb 2015
wont-fix

1 ... 280 281 282 283 284 ... 321

BY DENIS WERNER - @NOBBD - IMPRESSUM