Now on Twitter

the unofficial HackerOne disclosure timeline.

X

b'Shopify' disclosed a bug submitted by b'saltymermaid' 
b'Ability to publish a paid theme without purchasing it.'

27 Aug 2020

b'Khan Academy' disclosed a bug submitted by b'demonia' 
b'CSV Injection Via Student Password/Name Leads To Client Side RCE And Reading Client Files'

27 Aug 2020

b'Ruby on Rails' disclosed a bug submitted by b'jregele' 
b'The authenticity_token can be reversed and used to forge valid per_form_csrf_tokens for arbitrary routes'

27 Aug 2020

b'Node.js third-party modules' disclosed a bug submitted by b'phra' 
b'notevil - Sandbox Escape Lead to RCE on Node.js and XSS in the Browser'

27 Aug 2020

b'Node.js third-party modules' disclosed a bug submitted by b'chalker' 
b'[bl] Uninitialized memory exposure via negative .consume()'

27 Aug 2020

b'Open-Xchange' disclosed a bug submitted by b'catenacyber' 
b'Failed assert in `mail_index_transaction_lookup`'

27 Aug 2020

b'Open-Xchange' disclosed a bug submitted by b'catenacyber' 
b'Assert failed in `edit_mail_istream_read`'

27 Aug 2020

b'Open-Xchange' disclosed a bug submitted by b'catenacyber' 
b'Null dereference in `cmd_denotify_operation_execute`'

27 Aug 2020

b'Visma Public' disclosed a bug submitted by b'4mat' 
b'Stored XSS in eaccounting.stage.vismaonline.com'

27 Aug 2020

b'HackerOne' disclosed a bug submitted by b'0619' 
b'Graphql: Sorting the reports by jira_status field resulted to different value'

27 Aug 2020

b'GitLab' disclosed a bug submitted by b'rioncool22' 
b'Stored XSS in "Create Groups"'

26 Aug 2020

b'GitLab' disclosed a bug submitted by b'u3mur4' 
b'An attacker can run pipeline jobs as arbitrary user'

26 Aug 2020

b'GitLab' disclosed a bug submitted by b'skavans' 
b'Privilege escalation from any user (including external) to gitlab admin when admin impersonates you'

26 Aug 2020

b'GitLab' disclosed a bug submitted by b'rpadovani' 
b'Stealing data from customers.gitlab.com without user interaction'

26 Aug 2020

b'GitLab' disclosed a bug submitted by b'sky003' 
b'Initial mirror user can be assigned by other user even if the mirror was removed'

26 Aug 2020

b'New Relic' disclosed a bug submitted by b'jon_bottarini' 
b'Internal API endpoint discloses full account name of email address associated with unconfirmed user'

26 Aug 2020

b'New Relic' disclosed a bug submitted by b'jon_bottarini' 
b'Adding a new user discloses their full name in the "Users" section of NR Alerts notification channels page'

26 Aug 2020

b'New Relic' disclosed a bug submitted by b'jon_bottarini' 
b'[NR Synthetics] Restricted user can view synthetics monitors and user permissions through .json endpoint at /permissions/securablemetadata/{GROUP ID}'

26 Aug 2020

b'New Relic' disclosed a bug submitted by b'jon_bottarini' 
b'[New Relic Infrastructure] Restricted User can still integrate with AWS via forced browsing (plus, a few other bugs)'

26 Aug 2020

b'Visma Public' disclosed a bug submitted by b'risinghunter' 
b'Information disclosure to "Permission as auditor" user'

26 Aug 2020

1 ... 307 308 309 310 311 ... 776

BY DENIS WERNER - @NOBBD - IMPRESSUM