Top10 publishers:

bobrov	114
linkks	75
geeknik	72
sp1d3rs	63
jobert	57
netfuzzer	47
guido	45
bl4de	42
ryat	40
bigbear_	38

Now on Twitter

the unofficial HackerOne disclosure timeline.

X

Instacart disclosed a bug submitted by sameoldstory 
Fetch private list metadata and any user's personal name

12 Sep 2016

Instacart disclosed a bug submitted by corb3nik 
Hyperlink Injection in Friend Invitation Emails

12 Sep 2016

Instacart disclosed a bug submitted by cablej 
Missing rel=noreferrer tag allows link in list to change url of currently open tab

12 Sep 2016

Instacart disclosed a bug submitted by mefkan 
Image Upload Path Disclosure

12 Sep 2016

Legal Robot disclosed a bug submitted by cablej 
User Information sent to client through websockets

12 Sep 2016

Legal Robot disclosed a bug submitted by cablej 
User Information leak allows user to bypass email verification.

12 Sep 2016

Pornhub disclosed a bug submitted by zephrfish 
[crossdomain.xml] Dangerous Flash Cross-Domain Policy

12 Sep 2016

Instacart disclosed a bug submitted by cablej 
Race Condition in Redeeming Coupons

12 Sep 2016

Instacart disclosed a bug submitted by clarck-owen 
Host Header Injection/Redirection in: https://www.instacart.com/

11 Sep 2016

Harvest disclosed a bug submitted by eboda 
Stored XSS on invoice, executing on any subdomain

10 Sep 2016

Harvest disclosed a bug submitted by eboda 
S3 bucket takeover due to proxy.harvestfiles.com

10 Sep 2016

Boozt Fashion AB disclosed a bug submitted by r4hul-ch 
No csrf protection on logout

10 Sep 2016

Boozt Fashion AB disclosed a bug submitted by m726a786 
User Enumeration.

10 Sep 2016

Harvest disclosed a bug submitted by 0xamir 
Users enumeration is possible through cycling through recurring[client_id] argument value.

10 Sep 2016

Mail.Ru disclosed a bug submitted by ahsantahir 
[cfire.mail.ru] CSRF Bypassed - Changing anyone's 'User Info'

09 Sep 2016

Veris disclosed a bug submitted by xenon 
[XSS] sandbox.veris.in

09 Sep 2016

Legal Robot disclosed a bug submitted by paramdham 
CSRF

09 Sep 2016

Instacart disclosed a bug submitted by s44mux 
Stored XSS

09 Sep 2016

Uber disclosed a bug submitted by apara 
Bulk UUID enumeration via invite codes

08 Sep 2016

Mapbox disclosed a bug submitted by n0rb3r7 
target="_blank" Vulnerability Resulting in Critical Phishing Vector

07 Sep 2016

1 ... 324 325 326 327 328 ... 448

BY DENIS WERNER - @NOBBD - IMPRESSUM