LY Corporation: Deleting someone else's profile image with a GraphQL query in programming education service (https://entry.line.me)

LINE entry is a service that provides programming education for children https://entry.line.me. LINE entry provides users with the ability to add profile images. It was possible to delete other people's profile images or thumbnails using a GraphQL query...

CVE-2020-15126

In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object...

CVE-2020-15126

In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object...

CVE-2020-15126: Incorrect Authorization

In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object...

HackerOne: Customer private program can disclose email any users through invited via username

Summary: Hey team,This bug could have been used by my calculations a long time ago Steps To Reproduce: 1Go to https://hackerone.com/hackeroneh1pbbp3/launch 2Take invite via username 3Input username , send invite 3.1When an invite is created, we get a token 4Now Go use GraphQL query...

HackerOne: Private program disclosure via `vpn_suspended` GraphQL query

Summary: vpnsuspended of Team object got exposed Description: An attacker can get vpnsuspended value of any program including external program which also have private program eg. █████ and external program which does not have private program What an attacker can do with this ? If an external...

HackerOne: Invited team member can disclosure slack channels

Summary: Hello, this report is similar to 505493 also still waiting for response, but accent is totally on another thing. I think it is important and should be fixed, and so i create new report. Invited team member without any permission can disclosure private channel names of slack integration. ...