HackerOne: Email address of any user can be queried on Report Invitation GraphQL type when username is known

Summary: Email id of all hackerone users disclosure Description: There is an flaw , with that i can get all hackerone users email id Steps To Reproduce 1. Invoke the below graphql call POST /graphql HTTP/1.1 "query":"mutation Revokecredentialmutation$input0:AddReportParticipantInput!...

culturelab.gr GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1086626 Security Researcher SecuWatch Helped patch 15 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting culturelab.gr website and its users. Following...

sematec-metrologie.com GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1086526 Security Researcher SecuWatch Helped patch 15 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting sematec-metrologie.com website and its users. Followin...

beavrs.org GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1086137 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

fems.asso.fr GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1085684 Security Researcher SecuWatch Helped patch 15 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting fems.asso.fr website and its users. Following...

Ultimate Membership Pro < 8.6.1 - Multiple Critical Vulnerabilities

Multiple Critical Vulnerabilities found in Ultimate Membership Pro could leads to Authenticated using a low privilege account, such as subscriber Remote Code Execution on default Installation, as well as PII disclosure such as emails, IP addresses, hashed passwords, usernames, User-Agent and so o...

Ultimate Membership Pro < 8.6.1 - Multiple Critical Vulnerabilities

Multiple Critical Vulnerabilities found in Ultimate Membership Pro could leads to Authenticated using a low privilege account, such as subscriber Remote Code Execution on default Installation, as well as PII disclosure such as emails, IP addresses, hashed passwords, usernames, User-Agent and so o...

Topcoder: PII of Users Disclosure using "/members/invite/" endpoint

Hello! I found PII Disclosue at https://connect.topcoder.com/projects/ Steps to Reproduce. 1 Go to https://connect.topcoder.com/projects 2 Select an existing project, or create a new one. 3 Select the "Manage Invitations" option. on the left sidebar. 4 Enter the Username/Email of the user you wan...

Embracing Data Privacy Day

January 28 is Data Privacy Day, commemorating the Council of Europe Treaty known as Convention 108, the first legally binding international treaty on data protection signed on January 28, 1981. This "holiday" was originally celebrated in Europe where it is known as Data Protection day. But in 200...

16Shop Phishing Gang Goes After PayPal Users

A prolific phishing gang known as 16Shop has added PayPal customers to its target set. According to researchers at the ZeroFOX Alpha Team, the latest version of the group’s phishing kit is designed with a number of features that are aimed to steal as much personally identifiable information PII a...

novochem.net GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1066026 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

CVE-2019-20360

A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information PII including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the...

CVE-2019-20360

A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information PII including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the...

Authentication flaw

A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information PII including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the...

CVE-2019-20360

CVE-2019-20360 affects the WordPress GiveWP plugin (versions prior to 2.5.5). It describes an authentication bypass where unauthenticated users can access PII (names, addresses, IPs, emails) by manipulating an API key to match a wp_usermeta key and setting the token to the corresponding MD5 hash ...

CVE-2019-20360

A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information PII including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the...

d-dar.ru GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1036950 Security Researcher Sidd Helped patch 16 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting d-dar.ru website and its users. Following coordinated and...

escrim.org GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1033374 Security Researcher whitehatewizard Helped patch 0 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting escrim.org website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the...

result.fipv.net GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1033373 Security Researcher whitehatewizard Helped patch 0 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting result.fipv.net website and its users. Following coordinated and responsible vulnerability disclosure guidelines o...

bangaloreallergycentre.com GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1031698 Security Researcher MrBug Helped patch 0 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting bangaloreallergycentre.com website and its users. Following coordinated and responsible vulnerability disclosure guidelines ...