HackerOne: Hackers can reveal the names of private programs that have an external link

Summary: Hi team, Our team has found a way to distinguish between private programs with external links. Due to the ability to select Severity Rating Options, the program can set two options : Rating or CVSS Score and CVSS Score Only. One of them removes the possibility of setting the...

CVE-2020-28150

I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect...

HackerOne: Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photos

@nagli found a misconfiguration in an interstitial page that could lead to a link to be indexed by a 3rd party. This could have exposed links to proof of concepts that HackerOne users had posted on hackerone.com. This affected a specific set of customers, which HackerOne worked together with to...

Mattermost Server Code Issue Vulnerability

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 3.8.2, prior to 3.7.5, and prior to 3.6.7. An attacker can exploit the vulnerability to display an external link on an error pa...

CVE-2017-18914

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist...

CVE-2017-18914

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist...

HackerOne: Disclosure of the name of a program that has a private part with an external link

Summary: Hi team , @jobert , @bencode . Not so long ago, you made an output to the program panel of information about whether the program has the function- retest. Also, this is reflected in the report by the attribute activeretestsubscription. It seems that it is reflected in publish reports tha...

HackerOne: Unauthorized user can obtain `report_sources` attribute through Team GraphQL object

Summary: Hi team. And Happy New Year! Description: If I am not mistaken, then through this parameter we can define private programs with an external link. If this parameter is not empty, then the program is private. - "HackerOne Platform" Steps To Reproduce https://hackerone.com/graphql POST:...

Valve: Steam chat - trade offer presentation vulnerability

It was possible to construct a Steam URL that began with "/tradeoffer/new" and included valid partner and token information, but which was in fact an external link. The crafted URL would be treated by the Steam Chat UI as a trade offer and given special visual treatment...

lesserg4mini.cs.umass.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1006509 Security Researcher devl00p Helped patch 3000 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting lesserg4mini.cs.umass.ed...

External Links Filter - Moderately critical - Open Redirect Vulnerability - SA-CONTRIB-2019-063

The External Link Filter module provides an input filter that replaces external links by a local link that redirects to the target URL. The module did not have protection for the Redirect URL to go where content authors intended...

CVE-2019-7061

creationtimestamp| type| source ---|---|--- 2019-05-23 18:48:22+00:00| seen| https://t.me/cvemitreorg/236...

SQL injection vulnerability in the background us***.php page of TreeHole's external link system

Treehole external link system is a free and open source PHP external link network disk system. Treehole external link system background us.php page SQL injection vulnerability , the vulnerability stems from the failure to effectively filter the variable search, attackers can use the vulnerability...

HackerOne: Disclosing a private program in an external link if program is paused

Summary: Hi team Description: If the program is paused that we will not be able to send reports to this program and if we try to directly contact the link https://hackerone.com/externalprogrammpaused/reports/new we will be returned to the main page https://hackerone.com/externalprogrammpaused Ste...

xn--l-qhua1eb1221cowtc71chia.gamerch.com XSS vulnerability

Open Bug Bounty ID: OBB-652350 Description| Value ---|--- Affected Website:| xn--l-qhua1eb1221cowtc71chia.gamerch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

sangokugassen.gamerch.com XSS vulnerability

Open Bug Bounty ID: OBB-651274 Description| Value ---|--- Affected Website:| sangokugassen.gamerch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

sao-if.gamerch.com XSS vulnerability

Open Bug Bounty ID: OBB-650851 Description| Value ---|--- Affected Website:| sao-if.gamerch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

granblue.gamerch.com XSS vulnerability

Open Bug Bounty ID: OBB-650833 Description| Value ---|--- Affected Website:| granblue.gamerch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

finaltreasure.gamerch.com XSS vulnerability

Open Bug Bounty ID: OBB-650821 Description| Value ---|--- Affected Website:| finaltreasure.gamerch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

yurukamie.gamerch.com XSS vulnerability

Open Bug Bounty ID: OBB-650584 Description| Value ---|--- Affected Website:| yurukamie.gamerch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...