HackerOne: Information leakage - Private reports cached by Google

Hello, I have found at least two private bug reports cached by Google. 10259 and 10257. Possibly more available Cached version is exposing title and part of the bug description POC:...

HackerOne: Accessing title of the report of which you are marked as duplicate

Hello, You can see the title of the report of which you are marked as Duplicate Steps to Reproduce: 1. Report a bug to a team 2. Now that team marks your bug as 'Duplicate ReportID.but does not shares the report with you 3. When that bug is marked as Resolved then you can see the title of that bu...

Ubiquiti Inc.: Buffer Overflow in PHP of the AirMax Products

Vulnerability The function static int ubnormalizefilenamechar filename implemented by the patch 430-smart-post-upload.patch in the file uploadbuffer.c on the SDK.UBNT.v5.5 have the following code: static int ubnormalizefilenamechar filename char fwdslash; char backslash; sizet size; / Some commen...

HackerOne: CSV Injection with the CVS export feature

The "Download as a CSV" feature of HackerOne does not properly "escape" fields. This allows an adversary to turn a field into active content so when a response team download the csv and opens it, the active content gets executed. Here is more information about this issue:...

HackerOne: Redirection Page throwing error instead of redirecting to site

Hello I was just testing and found that http://anysite.com.com/index.php?ref="svg/onload=window.onerror=alert;throw/XSS/;// does not shows the usual External link warning page, but shows some error page . Thanks...

[KIS-2015-03] Concrete5 <= 5.7.4 (Access.php) SQL Injection Vulnerability

----------------------------------------------------------- Concrete5 = 5.7.4 Access.php SQL Injection Vulnerability ----------------------------------------------------------- - Software Link: https://www.concrete5.org/ - Affected Versions: Version 5.7.3.1, 5.7.4, and probably other versions. -...

[KIS-2015-01] Concrete5 <= 5.7.3.1 (sendmail) Remote Code Execution Vulnerability

------------------------------------------------------------------- Concrete5 = 5.7.3.1 sendmail Remote Code Execution Vulnerability ------------------------------------------------------------------- - Software Link: https://www.concrete5.org/ - Affected Versions: Version 5.7.3.1 and probably...

Concrete5 5.7.3.1 sendmail Remote Code Execution

------------------------------------------------------------------- Concrete5 post'registrationtype' 22. case "enabled": 23. Config::save'concrete.user.registration.enabled', true; 24. Config::save'concrete.user.registration.validateemail', false; 25...

Concrete5 5.7.4 SQL Injection

----------------------------------------------------------- Concrete5 0 173. foreach $filterEntities as $ent 174. $filters = $ent-getAccessEntityID; 175. 176. $peIDs .= 'and peID in ' . implode$filters, ',' . ''; 177. 178. if $accessType == 0 179. $accessType = ''; 180. else 181. $accessType = '...

Wassenaar, Bug Bounties and Vulnerability Rewards Programs

Bug bounties have gone from novelty to necessity, not only for enterprises looking to take advantage of the skills of an organized pool of vulnerability hunters, but also for a slew of independent researchers who make a living contributing to various vendor and independent bounty and reward...

HackerOne: mailto: link injection on https://hackerone.com/directory

I just found that entering a non-existing porogram returns the following response: The Directory doesn't have a profile matching these criteria. If an organization has published security contact information or a vulnerability disclosure policy, please let us know. The bold part has a mailto: link...

HackerOne: Invitation is not properly cancelled while inviting to bug reports.

This issue is a little confusing. So, if you are not able to reproduce let me know i will send you a video to help reproduce the issue. Reproduction Steps : 1 Let's say you are User A who is inviting a user B to abug report, User A goes to + signadding participants and adds a email address there....

HackerOne: Potential denial of service in hackerone.com/<program>/reward_settings

While setting the bounty for the program, if I set the bounty to a large value over 1,000,000 digits and send the request the website hangs for about a minute and a half, then pops up an error page saying there is an error on Hackerone's Host end. Time taken to repsond : 76856 Millisecond = 76.85...

HackerOne: Logic error with notifications: user that has left team continues to receive notifications and can not 'clean' this area on account

Hello Hackerone team. I realized that I still get notifications of updates to bugs when it was part of a team but I'm not currently access. This causes me to keep getting emails about this report. Please see the attached images. If necessary can create a video with POC Note: the image 5 illustrat...

HackerOne: Email Notification should be get while changing Paypal Email

an email notification should be get while changing paypal email address when we use hackerone a/c in any team there many people in team member so when we change paypal email an email notification should be get...

HackerOne: Content Spoofing - External Link Warning Page

Here is example link: Click Here Raw Data: Click Here Issue: In External link warning page, this link shown as plain text and no forced URL encoded, leading an attacker to frame sentences and trick users. In given example, attacker can trick user to click 'Proceed' button saying it will redirect...

HackerOne: Reopen Disable Accounts/ Hidden Access After Disable

For POC: Original Email or banned email: [email protected] Updating Email: [email protected] Hello team this bug is something interesting and critical.. I have checked once the accounts are disable not easy to open, but i have found a vulnerability which allow a user to reopen disable accounts. Disable...

HackerOne: Fake URL + Additional vectors for homograph attack

Hello! I would like to report about a new issue based on "@" character in URL. It shows user real URL but when he clicks "Proceed", he is redirected to another website. For example, it seems as normal HackerOne URL:...

HackerOne: Homograph attack

Hi, I would like to report an incomplete fix of 58612 is. In short, backslash is not taken in consideration. PoC \http://ebay.com http://ebay.com...

HackerOne: Homograph Attack

Hello HackerOne, Fix of Report 29491 and 58612 is incomplete. I found another way to to replicate homograph attack using Hex Code: www.%00ebаy.com www.%01ebаy.com www.%02ebаy.com www.%03ebаy.com www.%04ebаy.com www.%05ebаy.com www.%06ebаy.com www.%07ebаy.com www.%08ebаy.com www.%0Bebаy.com...