HackerOne: Private Program Disclosure in /:handle/reports/draft.json endpoint

PoC revealed an issue in the HTTP codes returned for the /reports/draft.json endpoint: private team: https://hackerone.com/invite-only team handle/reports/draft.json Returned "error":"You need to sign in or sign up before continuing." with Status Code:401 OK user: https://hackerone.com/user...

HackerOne: Private program activity timeline information disclosure

HI, There are some company which are hosting as external https://hackerone.com/directory?query=type%3Aexternal&sort=name%3Aascending&page=1 but some one was hosting private BB on HackerOne which are not visible unless they invite you. However, you can check if any company is hosting private BB on...

Paragon Initiative Enterprises: Cross-domain AJAX request

Hi Paragonie Team, While reviewing your website i discovered that there are Cross-domain AJAX requests being sent, though you are implementing Content-Security-Policy header but Internet Explorer uses experimental X-Content-Security-Policy header according to Wikipedia info...

HackerOne: Multiple issues with Markdown and URL parsing

LOOK . 1 html example: copy + past look rezult: mailto:[email protected]" 2 here the situation is more complicated , the fact that I have mail [email protected] [email protected] copy past look rezult: [email protected] [email protected] click one link and two link 2.1 I...

ownCloud: owncloud.help: Text Injection

Hello i want to report a text injection and a missconfiguration of the 404 page which can be used in phishing Text injection can be used in phishing 404 page should not include attacker text The bug exists at :...

HackerOne: Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_session

Hi guys , I have found a way to use the open redirect vulnerability that zendesk refused to fix and we discussed it in 101146 to bypass intristial redirect. in 101146 , @bencode said : I tend to agree with Zendesk, we don't really see any security issues with it. We use our interstitial to warn t...

HackerOne: Report title and issue information prepopulated

I think this may be N/A to the bounty program but I'm seeing a weird situation so just wanted to at least flag as I'm not sure what is causing it in the event it's something worth you looking into... Working through possible exploits on █████ last night, I entered some code to try and have their...

HackerOne: attack in not an authorized user

example exit account go to http://myfuneral.ru/hackerone.php your location https://hackerone.com/users/signin and Error 502 Ray ID: • 2016-01-19 19:31:49 UTC Bad gateway I think this was due to the fact that enrolled in the cookie with an invalid redirection ssesiyami after authorization of the...

Critical Yahoo Mail Flaw Patched, $10K Bounty Paid

A critical vulnerability in Yahoo Mail that could give attackers complete control of an account was patched two weeks ago. The flaw was privately disclosed Dec. 26 by Finnish researcher Jouko Pynnonen and patched Jan. 6. Pynnonen earned himself a $10,000 bounty, one of the highest paid out by Yah...

HackerOne: CSV Injection via the CSV export feature

Hi , I have managed to bypass your fix for 72785 by submitting a report with NewLine character 0x0a in the title before the CSV formula. Steps to reproduce: 1. As a researcher , Submit a report to a program with the title %0A-2+3+cmd|' /C calc'!D2 , here is an example request: POST...

Content Injection via TileJSON Name

Overview Versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 of mapbox.js are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios. If L.mapbox.map or L.mapbox.shareControl are used in a manner that gives users control of the TileJSON content, it is possible to inject...

HackerOne: User with Read-Only permissions can request/approve public disclosure

Hi, I found out that a user who belongs to a group with Read-Only permission can still request and approuve public disclosure when the report is closed by privileged admin although that these permissions are only allowed if the user group has Report scope. Consequently, the team member with limit...

HackerOne: Requesting unknown file type returns Ruby object w/ address

Hello sec folks, requesting a report you are not allowed to acccess along with an unhandled filetype extension discloses a Mime::NullType Ruby object representation with a corresponding memory address. Example: https://hackerone.com/reports/1337.foo Request: http GET /reports/1337.foo HTTP/1.1...

Gratipay: HTTP trace method is enabled

Hello, HTTP TRACE method is enabled on your server which should not be enabled. It can lead to cross site tracing ! Cross site tracing: https://www.owasp.org/index.php/CrossSiteTracing root@initlabs: curl -vX TRACE "https://gratipay.com" Rebuilt URL to: https://gratipay.com/ Hostname was NOT foun...

Latest WordPress Update Resolves XSS Vulnerability

Developers at WordPress are encouraging users of the content management system to download and apply the most recent update, pushed yesterday, to address a cross-site scripting XSS vulnerability. According to WordPress the bug exists in all versions before 4.4 and if exploited, could allow a hack...

HackerOne: Signals get affected once reports closed as self

According to your documentation "https://hackerone.com/blog/introducing-signal-and-impact" Examples ActivityReputation Report Self close as N/A : 0 . its means Signals are not affected . But our case signal affected by self-closed reports Signals doesn't take the 0 baseline into consideration for...

Tor to Launch Bug Bounty Program in 2016

The Tor Project announced last week that it will launch a bug bounty program later this year to encourage security researchers to responsibly report issues they find in the software. Tor Browser and Tor Performance Developer Mike Perry announced the news during the “State of the Onion” address la...

HackerOne: HackerOne is still prone to Internet Explorer UXSS

Hi, I have managed to leverage CVE 2015-0072, so that the attack will work with any framed resource protected by X-Frame-Options: DENY header. According to 103787, only https://hackerone.com/cdn-cgi/trace was unprotected and now its already fixed. In my PoC I used several X-Frame-Options protecte...

VK.com: API: Bug in method auth.signup , дающий возможность бесконечно звонить

Отсутствие flood-контроля в api методе регистрации, что давало возможность отправлять массово смс или звонить на произвольный номер. В API Найдена уязвимость дающая бесконечно звонить и слать смс , лимит запросов можно было обойти. найдена практически такая же уязвимость , как и в репорте...

HackerOne: Team Member(s) associated with a Group have Read-only permission (Post internal comments) can post comment to all the participants

Hello Hackerone, I find bug with it team Members associated with a Group have only permission Post internal comments can post comment to all the participants Bypass it just with Add comma ',' isinternal=,...