HackerOne: IE 11 Self-XSS on Jira Integration Preview Base Link

I wasn't sure if you would accept this report due to it being Self-XSS, but I figured it might be useful information because it breaks one of the flows used to validate URLs. Steps ==================== 1. Launch IE 11 2. Log into a HackerOne account that has admin on a program. 3. Go to the...

HackerOne Offers Open Source Projects Free Access to Platform

HackerOne announced on Thursday the availability of a free version of its bug bounty platform called HackerOne Community Edition that will give open source projects tools for managing vulnerability submissions and creating bounty programs to improve software security. Eligible open source project...

HackerOne: javascript: and mailto: links are allowed in JIRA integration settings

Summary: For new feature settings, you accept website URLs like javascript:// or data:// in base urls. Even https://evil.com works, this needs to be stripped, this can be used to create another integrations without Steps To Reproduce 1. https://hackerone.com/Team/integrations/jira/edit 2. Try in...

HackerOne: Private program email forwarding response invitation not expire after first use.

Summary: Hi Hackerone Team, Before i reported that email forwarding of private can be enumerated and any user join to private program here 201369 , but this seems by design, but now it i found a related issue which can cause a security impact on private program because the email forwarding respon...

HackerOne: Subdomain takeover #2 at info.hacker.one

Summary: Hi team, looking the fix released from unbounce team at https://hackerone.com/reports/202767 i've been able to bypass it and takeover again the subdomain info.hacker.one with a new Vulnerable-Endpoint at UnbouncePages App Actual Dns Entry: F164154 Steps To Reproduce & New PoC for HackerO...

HackerOne: Able to create basic user account via Google login on HackerOne Drupal CMS

Summary: Hi, I've found that hackerone.com has drupal installed and when I navigated to this URL https://www.hackerone.com/user/password Found "Log in" and "password reset option". When I clicked on login it redirected me to google login Then I login using my gmail account and it redirected to...

HackerOne: Information leakage via CSV when content is valid JavaScript

Summary: The function "Download as CSV" might leak information to 3rd domains. The exploitation seems unlikely and purely theoretical but it might work in some cases. Description Include Impact: Take downloading payments as CSV, for example, which is recently launched. The response to...

HackerOne: Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP

Hi, I just discovered that there's a scenario where the Marketo Forms solution being used on www.hackerone.com can actually be abused, using a few fun techniques, to trigger an XSS in the Cross-Origin-iframe being used by Marketo. This results in eavesdropping of the data being sent in the...

PortSwigger Web Security: Email Spoofing

There is an Email Spoofing Vulnerability. Steps to reproduce: 1 Go to http://emkei.cz/ 2 Fill "From Email" field to [email protected] or any other portswigger email. 3 Fill the victim's address your address to "TO" field and fill in other details as you wish. You will receive email from...

HackerOne: Subdomain takeover at info.hacker.one

Summary: Hi team,i've been able to takeover subdomain at info.hacker.one, the CNAME entry in the subdomain is pointing to an external page service app.unbounce.com. Actual Dns Entry: F156764 Steps To Reproduce 1 I have claimed the domain and placed a page for PoC validation located under: Go to -...

Revive Adserver 4.0.0 XSS / Deserialization / Session Fixation Vulnerabilities

Revive Adserver versions 4.0.0 and below suffer from cross site scripting, session fixation, and deserialization of untrusted data vulnerabilities. Revive Adserver 4.0.0 XSS / Deserialization / Session Fixation Applications affected: Revive Adserver Versions affected: = 4.0.1 Website:...

Uber.com Backup Bug Nets Researcher $9K

A researcher netted a $9,000 payday last summer after digging up a XML external entity XXE vulnerability in a third-party backup software system used by Uber. The vulnerability, which could have given an attacker access to the user backup data of any company using the software, including Uber, wa...

Boozt Fashion AB: Email spoofing at booztlet.com

Hello : This There is an Email Spoofing Vulnerability. Steps to reproduce: 1 Go to http://emkei.cz/ 2 Fill "From Email" field to [email protected] or any other booztlet email. 3 Fill the victim's address your address to "TO" field and fill in other details as you wish. You will receive email fro...

Brave Browser Address Bar Spoofing

Summary: Brave Browser Suffers from Address Bar Spoofing Vulnerability. Address Bar spoofing is a critical vulnerability in which any attacker can spoof the address bar to a legit looking website but the content of the web-page remains different from the Address-Bar display of the site. In Simple...

HackerOne: Disclose any user's private email through API

Description: I have found a security vulnerability that allows an attacker to disclose any user's private email. An attacker can disclose any user's private email by creating a sandbox program then adding that user to a report as a participant. Now if the attacker issued a request to fetch the...

HackerOne: Report redaction doesn't apply to report title update activities

Summary: The Redact option doesn't redact all keywords identified in the report- which may leave sensitive information unredacted. Description Include Impact: The option only search through reporter's initial report & follow-up comments, leaving other comments untouched. Furthermore, it doesn't...

Ruby: Buffer underflow in sprintf

Hi, So I found this in mruby as part of the shopify-scripts program, and I notice that my patch also landed upstream in ruby as well. Shame on me for not checking ruby as well! Wondered if it counted for a bounty here as well? https://github.com/mruby/mruby/issues/3347 - issue that shopify guys...

Ruby on Rails: CSRF header is sent to external websites when using data-remote forms

Looks like there is a regression in the fix for CVE-2015-1840 H1 report. The origin isn't being checked before adding a CSRF header to data-remote forms. I noticed this when checking out the new rails-ujs repo. Example Rails template: submit Example http://attacker.com app require "sinatra" optio...

HackerOne: Websites opened from reports can change url of report page

This issue is similar to 124889, but it is only exploitable via MS Edge or Internet Explorer 11 Proof Of Concept: Clicking on a link set to "http://d214mfsab.org/same.html" including this one will change the still-open report page to http://example.com. This works on current versions of MS Edge a...

Yahoo Flaw Allowed Hackers to Read Anyone's Emails

Yahoo has patched a critical security vulnerability in its Mail service that could have allowed an attacker to spy on any Yahoo user's inbox. Jouko Pynnönen, a Finnish Security researcher from security firm Klikki Oy, reported a DOM based persistent XSS Cross-Site Scripting in Yahoo mail, which i...