Now on Twitter

the unofficial HackerOne disclosure timeline.

X

b'CS Money' disclosed a bug submitted by b'nnez' 
b'Site-wide CSRF on Safari due to CORS misconfiguration (not localhost)'

27 Oct 2020

b'Basecamp' disclosed a bug submitted by b'jouko' 
b'HEY.com email stored XSS'

27 Oct 2020

b'Mail.ru' disclosed a bug submitted by b'panya' 
b'Reflected XSS on https://e.mail.ru/compose/ via Body parameter'

27 Oct 2020

b'Mail.ru' disclosed a bug submitted by b'esetal' 
b'[combo.mail.ru] SMS code bruteforce'

27 Oct 2020

b'Mail.ru' disclosed a bug submitted by b'ther3d0ne' 
b'Stored XSS through fileupload'

27 Oct 2020

b'Mail.ru' disclosed a bug submitted by b'risinghunter' 
b'OTP bypass on user account deletion'

27 Oct 2020

b'Evernote' disclosed a bug submitted by b'kaulse' 
b'Non-production Open Database In Combination With XXE Leads To SSRF'

27 Oct 2020

b'Mail.ru' disclosed a bug submitted by b'magzhan' 
b'Cross-site Scripting (XSS) - DOM on https://account.mail.ru/user/garage?back_url=https://mail.ru'

27 Oct 2020

b'Node.js third-party modules' disclosed a bug submitted by b'johnssimon007' 
b'[nested-property] Prototype Pollution'

27 Oct 2020

b'NordVPN' disclosed a bug submitted by b'n33dm0n3y' 
b'Password Reset Link not expiring after changing the email Leads To Account Takeover'

27 Oct 2020

b'Node.js third-party modules' disclosed a bug submitted by b'ryotak' 
b'[http-live-simulator] Application-level DoS'

27 Oct 2020

b'Node.js third-party modules' disclosed a bug submitted by b'mik317' 
b'[create-git] RCE via insecure command formatting'

26 Oct 2020

b'Yelp' disclosed a bug submitted by b'parzel' 
b'X-Forward-For Header allows to bypass access restrictions'

26 Oct 2020

b'8x8' disclosed a bug submitted by b'melbadry9' 
b'Open Redirect on [blog.wavecell.com]'

26 Oct 2020

b'Twitter' disclosed a bug submitted by b'keer0k' 
b'XSS via referrer parameter'

26 Oct 2020

b'Twitter' disclosed a bug submitted by b'gokay' 
b'Twitter Media Studio Source Information Disclosure With Analyst Role'

26 Oct 2020

b'Mail.ru' disclosed a bug submitted by b'artebels' 
b'Insufficient limitation of web page title leads to DoS against ICQ for Android'

24 Oct 2020

b'Kartpay' disclosed a bug submitted by b'abhhi' 
b'Admin/Info lekage'

24 Oct 2020

b'Curve' disclosed a bug submitted by b'praseudo7' 
b'Sensitive Info Leak - An Attacker Can Retrieve All the Users Mobile Numbers at https://website-api.production.curve.app/api/waitlist/us'

23 Oct 2020

b'Shopify' disclosed a bug submitted by b'cforu' 
b'authenticity token not verfied leads to change business name'

23 Oct 2020

1 ... 292 293 294 295 296 ... 776

BY DENIS WERNER - @NOBBD - IMPRESSUM