HackerOne: Hacker can request mediation for published reports

Hi team, @jobert Summary: After creating the publish report, we do not have a field to send the requested meditation from HackerOne Support Description: Steps To Reproduce 1. Create publish report for any program ████████ 2. Use query https://hackerone.com/reports/numberpublishreport/hackerhelp M...

HackerOne: User with privilege to maintain External Programs can update certain churned HackerOne programs

Summary: You wrote that some programs are behind, but you are trying to get them back sorry maybe bad translation Description: Apparently because of a system error, I have access to change information in the public program. This option is given only for external programs.But here is a public...

HackerOne: Discrepancy in hacker profile report count may reveal existence of a private program by publishing a report

Hi team , @pei, @jobert , @bencode Summary: Again We have publish report page https://hackerone.com/hacktivity/publish But we have bypass query 401476 this description The profile page counts the number of created your reports. But it does not consider the reports that are created in the sandbox...

Weblate: Tab nabbing via window.opener

Details: When you open a link in a new tab target="blank" , the page that opens in a new tab can access the initial tab and change it's location using the window.opener property. Attack scenario: here i have provided 2 videos, in video 1 i have my editorial link set. to show that tabnapping is...

Command Injection

Overview Versions of egg-scripts before 2.8.1 are vulnerable to command injection. This is only exploitable if a malicious argument is provided on the command line. Example: eggctl start --daemon --stderr='/tmp/eggctlstderr.log; touch /tmp/malicious' Recommendation Update to version 2.8.1 or late...

HackerOne: @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant.

Hola amigos, First off, I know RFCs are annoying. Second of all, namespace attacks are a btch. With that out of the way, here is an Inti-bug that was discovered as a result of reading RFC2142 very carefully. Brief summary of RFC2142 RFC2142 defines a standard set of email addresses that cover...

HackerOne: Disclosure of top 10 vulnerability types for programs that haven't enabled the Insights feature

Summary Although the report count is not showing, the Insights query endpoint returns a list of top 10 vulnerability types for any programs that haven't enabled the Insights feature. Reproduction 1. Go to a program that has Insights feature enabled, e.g: https://hackerone.com/security/insights 2...

Code Injection

Overview All versions of cryo are vulnerable to code injection due to an Insecure implementation of deserialization. Proof of concept var Cryo = require'cryo'; var frozen = '"root":"CRYOREF3","references":"contents":,"value":"CRYOFUNCTIONfunction console.log\"defconrussia\"; return...

Privilege Escalation due to Blind NoSQL Injection

Overview Versions of flintcms before version 1.1.10 are vulnerable to account takeover due to blind MongoDB injection in the password reset. Recommendation Update to version 1.1.10 or later. References - HackerOne Report - GitHub Advisory...

HackerOne: Internal usage of AdBlockPlus may expose PoC URLs to unknown third-parties

Hello HackerOne team, this is probably going to be a different kind of report than what you are used to: it looks to me this is more of an internal, operational security best-practice that you may choose to follow. This is something that's bugging me from January now, but it took me some time and...

Arbitrary File Write via Archive Extraction

Overview Versions of unzipper before 0.8.13 are vulnerable to arbitrary file write when used to extract a specifically crafted archive that contains path traversal filenames ../../file.txt for example. Recommendation Update to version 0.3.18 or later. References - GitHub Pull Request - Zip Slip...

HackerOne: TeamProfile exposes partially sensitive information through GraphQL

I noticed there is new field teamprofile added and using the graphql below the latest serious report and reports received in three months were exposed "query":"query Dashboardreportseveritybreakdowntable$first0:Int! \n query \n id,\n ...F0\n \n\nfragment F0 on Query \n...

Path Traversal

Overview Versions of express-cart before 1.1.7 are vulnerable to Path Traversal. Recommendation Update to version 1.1.7 or later. References - HackerOne Report - GitHub Advisory...

HackerOne: Private program policy page still accessible after user left the program

Hi Team, Summary: I have found a critical sensitive information disclosure, I'm not sure if this is a result of a new hackerone UI update, I observed that some of the UI has been change such as Hacktivity etc. BUG: Now all private program policy page together with the updates is visible to me...

Augur: Augur UI data can be completely replaced by an attacker which can lead to fund and reputation loss

Summary: A third party attacking site can fake UI data - markets, categories and other Description: A third party site can include a hidden iframe which can override "augur-node" configuration variable of a running augur application. This variable is persisted in localStorage. In the case of...

Chaturbate: CSS Injection on /embed/ via bgcolor parameter leaks user's CSRF token and allows for XSS

Hi there, There's a CSS injection here: https://chaturbate.com/embed/admin/?bgcolor=%7D%7Bbackground:red&tour=nvfS&disablesound=0&campaign=iNSGX body, divmain, div.content, div.block, div.section margin: 0px; padding: 0px; body min-width:800px; div.content width: 100%; body background:...

Slack: Bypass of the SSRF protection in Event Subscriptions parameter.

The vulnerability is present in the "Event Subscriptions" parameter where: "Your app can subscribe to be notified of events in Slack for example, when a user adds a reaction or creates a file at a URL you choose. ". URL: https://api.slack.com/apps/YOUAPPCODE/event-subscriptions? When we add a sit...

Chaturbate: CSV Injection with the CSV export feature

Hi there, hope you are well, The "Download as a CSV" feature of does not properly "escape" fields. So that particular field is vulnerable to CSV injection. Steps of POC Step 1 : Go to any chat room and donate any token to some and in note insert =4+4. Step 2 : Now go to on this link and download...

Chaturbate: Homograph attack on redirect URL (https://chaturbate.com/external_link/?url)

Hi There, Hope you are doing good, As i was just playing around with chaturbate.com and found that you guys does not have proper configuration for malicious script injection in website. In Homograph attack basically attacker may able to inject some malicious script with URL. Here i made homograph...

ThreatList: Bug Bounty Payouts Increase Six Percent for Critical Vulnerabilities

The average payout price for critical vulnerabilities are up six percent and now average $2,041 compared to the prior year. The numbers are from HackerOne’s 2018 Hacker-Powered Security Report, published Wednesday. The study looked at data derived from the HackerOne community between May 2017 and...