Top10 publishers:

bobrov	107
sp1d3rs	54
jobert	41
bigbear_	38
bl4de	37
guido	37
isox	36
4lemon	35
geeknik	35
edio	34

Now on Twitter

the unofficial HackerOne disclosure timeline.

X

Vimeo disclosed a bug submitted by dotspoted 
Serious Vulnerability Found

27 Feb 2015
wont-fix

itBit Exchange disclosed a bug submitted by zoczus 
Notification Emails: IP + Content-Spoofing

27 Feb 2015

itBit Exchange disclosed a bug submitted by 4lemon 
Unsecure data in "device" response - OTP

27 Feb 2015

HackerOne disclosed a bug submitted by siddiki 
Team member invitations to sandboxed teams are not invalidated consistently (v2)

27 Feb 2015

PHP disclosed a bug submitted by ryat 
Use after free vulnerability in unserialize() with DateTimeZone

27 Feb 2015

99designs disclosed a bug submitted by pranav_hivarekar 
CSRF to connect attacker's twitter account to logged in victims account

26 Feb 2015

Greenhouse.io disclosed a bug submitted by fransrosen 
Subdomain Takeover using blog.greenhouse.io pointing to Hubspot

26 Feb 2015

Vimeo disclosed a bug submitted by tfairane 
Vimeo.com Insecure Direct Object References Reset Password

26 Feb 2015

Vimeo disclosed a bug submitted by avlidienbrunn 
Adding profile picture to anyone on Vimeo

26 Feb 2015

HackerOne disclosed a bug submitted by danlec 
CSP Bypass: Click handler for links with data-method="post" can cause authenticity_token to be sent off domain

26 Feb 2015

Todoist disclosed a bug submitted by cliffordtrigo 
Taking over a Business Account Admin

26 Feb 2015

Todoist disclosed a bug submitted by cliffordtrigo 
Remotely removing credit cards from business accounts!

26 Feb 2015

Twitter disclosed a bug submitted by config 
User's DM won't deleted after logout from Twitter for iOS (com.atebits.xxx.application-state)

25 Feb 2015

Twitter disclosed a bug submitted by homakov 
Redirect URL in /intent/ functionality is not properly escaped

24 Feb 2015

Square disclosed a bug submitted by mikkz 
XSS on bookfresh

23 Feb 2015

Square disclosed a bug submitted by avicoder 
HTTP Header revealing server information.

23 Feb 2015
wont-fix

Vimeo disclosed a bug submitted by batram 
XSS on any site that includes the moogaloop flash player | deprecated embed code

22 Feb 2015

Twitter disclosed a bug submitted by simon90 
URGENT - SUBDOMAIN TAKEOVER ON TWITTER ACQ.

21 Feb 2015

OkCupid disclosed a bug submitted by bitquark 
Rosetta flash vulnerability in clientstats AJAX script

20 Feb 2015

Twitter disclosed a bug submitted by avicoder 
Path disclosure in platform0.twitter.com

20 Feb 2015
wont-fix

1 ... 287 288 289 290 291 ... 327

BY DENIS WERNER - @NOBBD - IMPRESSUM