Top10 publishers:

bobrov	114
geeknik	70
linkks	69
sp1d3rs	61
jobert	50
guido	45
bl4de	41
ryat	40
bigbear_	38
zombiehelp54	37

Now on Twitter

the unofficial HackerOne disclosure timeline.

X

Mobile Vikings disclosed a bug submitted by 4lemon 
Stored xss in user name

04 Mar 2015
wont-fix

Mobile Vikings disclosed a bug submitted by 4lemon 
Stored xss in user name (2) affected another user.

04 Mar 2015

Mobile Vikings disclosed a bug submitted by 4lemon 
Username and sim id enum

04 Mar 2015
wont-fix

Mobile Vikings disclosed a bug submitted by 4lemon 
Approve topup method by sender of this method

04 Mar 2015

PHP disclosed a bug submitted by andreapalazzo 
SoapClient's __call() type confusion through unserialize()

03 Mar 2015

Vimeo disclosed a bug submitted by fin1te 
Ability to Download Music Tracks Without Paying (Missing permission check on`/musicstore/download`)

01 Mar 2015

The Internet disclosed a bug submitted by dirtybit 
Bad Write in TTF font parsing (win32k.sys)

01 Mar 2015

Vimeo disclosed a bug submitted by dotspoted 
Serious Vulnerability Found

27 Feb 2015
wont-fix

itBit Exchange disclosed a bug submitted by zoczus 
Notification Emails: IP + Content-Spoofing

27 Feb 2015

itBit Exchange disclosed a bug submitted by 4lemon 
Unsecure data in "device" response - OTP

27 Feb 2015

HackerOne disclosed a bug submitted by siddiki 
Team member invitations to sandboxed teams are not invalidated consistently (v2)

27 Feb 2015

PHP disclosed a bug submitted by ryat 
Use after free vulnerability in unserialize() with DateTimeZone

27 Feb 2015

99designs disclosed a bug submitted by pranav_hivarekar 
CSRF to connect attacker's twitter account to logged in victims account

26 Feb 2015

Greenhouse.io disclosed a bug submitted by fransrosen 
Subdomain Takeover using blog.greenhouse.io pointing to Hubspot

26 Feb 2015

Vimeo disclosed a bug submitted by tfairane 
Vimeo.com Insecure Direct Object References Reset Password

26 Feb 2015

Vimeo disclosed a bug submitted by avlidienbrunn 
Adding profile picture to anyone on Vimeo

26 Feb 2015

HackerOne disclosed a bug submitted by danlec 
CSP Bypass: Click handler for links with data-method="post" can cause authenticity_token to be sent off domain

26 Feb 2015

Todoist disclosed a bug submitted by cliffordtrigo 
Taking over a Business Account Admin

26 Feb 2015

Todoist disclosed a bug submitted by cliffordtrigo 
Remotely removing credit cards from business accounts!

26 Feb 2015

Twitter disclosed a bug submitted by config 
User's DM won't deleted after logout from Twitter for iOS (com.atebits.xxx.application-state)

25 Feb 2015

1 ... 344 345 346 347 348 ... 385

BY DENIS WERNER - @NOBBD - IMPRESSUM