Now on Twitter

the unofficial HackerOne disclosure timeline.

X

b'Yelp' disclosed a bug submitted by b'hk755a' 
b"I.D.O.R TO EDIT ALL USER'S CREDIT CARD INFORMATION+(Partial credit card info disclosure)"

19 Aug 2020

b'Shopify' disclosed a bug submitted by b'ayyoub' 
b'Password reset link not expired at Stocky App'

18 Aug 2020

b'Starbucks' disclosed a bug submitted by b'rexvuz' 
b'Korea - Reflected XSS on https://www.istarbucks.co.kr/app/getGiftStock.do via "skuNo" and "skuImgUrl" parameters'

18 Aug 2020

b'Shopify' disclosed a bug submitted by b'tolo7010' 
b'Some store settings/data are accessible to "No Access" permission users on GraphQL LiveView operation'

18 Aug 2020

b'Shopify' disclosed a bug submitted by b'jmp_35p' 
b'Get analytics token using only apps permission'

18 Aug 2020

b'Shopify' disclosed a bug submitted by b'sreeju_kc' 
b'OrderListInitial leaks order details'

18 Aug 2020

b'Shopify' disclosed a bug submitted by b'jaka_tingkir' 
b'access permission is not revoked even if the email has been deleted or changed on the partner account -partners.shopify-'

18 Aug 2020

b'Shopify' disclosed a bug submitted by b'rioncool22' 
b'Blind Stored XSS Via Staff Name'

18 Aug 2020

b'WordPress' disclosed a bug submitted by b'simonscannell' 
b'Stored XSS in Post Preview as Contributor'

18 Aug 2020

b'WordPress' disclosed a bug submitted by b'simonscannell' 
b'pre-auth Stored XSS in comments via javascript: url when administrator edits user supplied comment'

18 Aug 2020

b'Mendix' disclosed a bug submitted by b'enixium' 
b'Reflected XSS in "*.mendix.com/openid/*"'

18 Aug 2020

b'Dropcontact' disclosed a bug submitted by b'try___for_impossible' 
b'IDOR at [https://dropcontact.firstpromote] which allows an UNAUTHORIZED user to ACCESS and EDIT Paypal GMAIL by Changing the ID.'

18 Aug 2020

b'Gener8' disclosed a bug submitted by b'5hu8h4m_n4g4' 
b'Session not invalidated after password reset'

18 Aug 2020

b'Solana BBP' disclosed a bug submitted by b'anjpan' 
b'Sensitive data leaks [username, password, keys]'

18 Aug 2020

b'Solana BBP' disclosed a bug submitted by b'mersalinio' 
b"i don't the important and it's impact . the affected asset: https://github.com/solana-labs/solana/blob/master/.buildkite/env/secrets.ejson"

18 Aug 2020

b'Solana BBP' disclosed a bug submitted by b'mersalinio' 
b" i don't the important and it's impact . the affected asset : https://github.com/solana-labs/solana/blob/master/.buildkite/env/secrets.ejson"

18 Aug 2020

b'GitLab' disclosed a bug submitted by b'plazmaz' 
b'SSRF In plantuml (on plantuml.pre.gitlab.com)'

17 Aug 2020

b'Nextcloud' disclosed a bug submitted by b'icewater' 
b'Linux client is vulnerable to directory traversal when downloading files'

17 Aug 2020

b'Nextcloud' disclosed a bug submitted by b'inhibitor181' 
b'RTLO character allowed in shared files'

17 Aug 2020

b'Omise' disclosed a bug submitted by b'justlife_4x4' 
b'Authenticity token doesnt expire after single use leading to CSRF'

17 Aug 2020

1 ... 308 309 310 311 312 ... 773

BY DENIS WERNER - @NOBBD - IMPRESSUM