VK.com: Уязвимость дает возможность смотреть кто лайкал приватным фото или видео

Отсутствие необходимых проверок при получении списка отметок "Мне нравится". similar report received more bounty - https://hackerone.com/reports/64754 - 300$ ███████████████████████████ ███████▀▀▀░░░░░░░▀▀▀███████ ████▀░░░░░░░░░░░░░░░░░▀████ ███│░░░░░░░░░░░░░░░░░░░│███ ██▌│░░░░░░░░░░░░░░░░░░░│▐██...

HackerOne: Minor Bug: Public un-compiled CSS with original sass, versioning, source map, comments, etc.

A stylesheet is available in a non-minified, non-compiled format. It includes sass, versioning, a source map, a style guide, comments, etc. see base64 encoded string at the very end of the document. https://hackerone.com/assets/application.css This alone is obviously not an exploit. However, it c...

HackerOne: Weak HSTS age in support hackerone site

Send this request: GET https://support.hackerone.com HTTP/1.1 Connection: keep-alive Accept: application/json, text/javascript, /; q=0.01 X-Requested-With: XMLHttpRequest Content-Length: 0 User-Agent: Jakarta Commons-HttpClient/3.1 Host: support.hackerone.com Response header: HTTP/1.1 200 OK...

HackerOne: Internal bounty and swag details disclosed as part of JSON response

Hello Hackerone team !!!! If Some company take option like this : Show minimum bounty on the program page? Do not display the minimum bounty on the program page. for example : https://hackerone.com/███████████ Private bounty details "basebounty":10 https://hackerone.com/████ Private swag details...

HackerOne: Number of invited researchers disclosed as part of JSON search response

I was informed via email that the bug I tweeted about https://twitter.com/jessescitech/status/623976563177070594 is actually a security issue, and the number of search results returned is the number of invited researchers for the team. I can't actually verify this, but the email said that a fix i...

HackerOne: Information leakage - Private reports cached by Google

Hello, I have found at least two private bug reports cached by Google. 10259 and 10257. Possibly more available Cached version is exposing title and part of the bug description POC:...

HackerOne: Accessing title of the report of which you are marked as duplicate

Hello, You can see the title of the report of which you are marked as Duplicate Steps to Reproduce: 1. Report a bug to a team 2. Now that team marks your bug as 'Duplicate ReportID.but does not shares the report with you 3. When that bug is marked as Resolved then you can see the title of that bu...

Ubiquiti Inc.: Buffer Overflow in PHP of the AirMax Products

Vulnerability The function static int ubnormalizefilenamechar filename implemented by the patch 430-smart-post-upload.patch in the file uploadbuffer.c on the SDK.UBNT.v5.5 have the following code: static int ubnormalizefilenamechar filename char fwdslash; char backslash; sizet size; / Some commen...

HackerOne: CSV Injection with the CVS export feature

The "Download as a CSV" feature of HackerOne does not properly "escape" fields. This allows an adversary to turn a field into active content so when a response team download the csv and opens it, the active content gets executed. Here is more information about this issue:...

HackerOne: Redirection Page throwing error instead of redirecting to site

Hello I was just testing and found that http://anysite.com.com/index.php?ref="svg/onload=window.onerror=alert;throw/XSS/;// does not shows the usual External link warning page, but shows some error page . Thanks...

[KIS-2015-01] Concrete5 <= 5.7.3.1 (sendmail) Remote Code Execution Vulnerability

------------------------------------------------------------------- Concrete5 = 5.7.3.1 sendmail Remote Code Execution Vulnerability ------------------------------------------------------------------- - Software Link: https://www.concrete5.org/ - Affected Versions: Version 5.7.3.1 and probably...

[KIS-2015-03] Concrete5 <= 5.7.4 (Access.php) SQL Injection Vulnerability

----------------------------------------------------------- Concrete5 = 5.7.4 Access.php SQL Injection Vulnerability ----------------------------------------------------------- - Software Link: https://www.concrete5.org/ - Affected Versions: Version 5.7.3.1, 5.7.4, and probably other versions. -...

Concrete5 5.7.4 SQL Injection

----------------------------------------------------------- Concrete5 0 173. foreach $filterEntities as $ent 174. $filters = $ent-getAccessEntityID; 175. 176. $peIDs .= 'and peID in ' . implode$filters, ',' . ''; 177. 178. if $accessType == 0 179. $accessType = ''; 180. else 181. $accessType = '...

Concrete5 5.7.3.1 sendmail Remote Code Execution

------------------------------------------------------------------- Concrete5 post'registrationtype' 22. case "enabled": 23. Config::save'concrete.user.registration.enabled', true; 24. Config::save'concrete.user.registration.validateemail', false; 25...

Wassenaar, Bug Bounties and Vulnerability Rewards Programs

Bug bounties have gone from novelty to necessity, not only for enterprises looking to take advantage of the skills of an organized pool of vulnerability hunters, but also for a slew of independent researchers who make a living contributing to various vendor and independent bounty and reward...

HackerOne: mailto: link injection on https://hackerone.com/directory

I just found that entering a non-existing porogram returns the following response: The Directory doesn't have a profile matching these criteria. If an organization has published security contact information or a vulnerability disclosure policy, please let us know. The bold part has a mailto: link...

HackerOne: Invitation is not properly cancelled while inviting to bug reports.

This issue is a little confusing. So, if you are not able to reproduce let me know i will send you a video to help reproduce the issue. Reproduction Steps : 1 Let's say you are User A who is inviting a user B to abug report, User A goes to + signadding participants and adds a email address there....

HackerOne: Potential denial of service in hackerone.com/<program>/reward_settings

While setting the bounty for the program, if I set the bounty to a large value over 1,000,000 digits and send the request the website hangs for about a minute and a half, then pops up an error page saying there is an error on Hackerone's Host end. Time taken to repsond : 76856 Millisecond = 76.85...

HackerOne: Logic error with notifications: user that has left team continues to receive notifications and can not 'clean' this area on account

Hello Hackerone team. I realized that I still get notifications of updates to bugs when it was part of a team but I'm not currently access. This causes me to keep getting emails about this report. Please see the attached images. If necessary can create a video with POC Note: the image 5 illustrat...

HackerOne: Email Notification should be get while changing Paypal Email

an email notification should be get while changing paypal email address when we use hackerone a/c in any team there many people in team member so when we change paypal email an email notification should be get...