1241 matches found
HackerOne: LinkedIN URL should be HTTPS
Not really a security bug, but I think will be a good idea to add HTTPS on LinkedIN Share Button. Example page In the right side of page: https://hackerone.com/reports/547 LinkedIN redirect to HTTPS after click, but cookie is sent on the network before that. Thanks!...
HackerOne: Autocomplete enabled in Paypal preferences
Data entered in these fields will be cached by the browser. An attacker who can access the victim's browser could steal this information...
HackerOne: Enumeration of users
As I can see, you prevent enumeration of users actually e-mails of registered users in Sign In https://hackerone.com/users/signin and Forgot password https://hackerone.com/users/password/new functionalities. However, the users can be enumerated in Sign Up https://hackerone.com/users/signup - just...
HackerOne: A password reset page does not properly validate the authenticity token at the server side.
Go to https://hackerone.com/users/password/new and request a new password. 2. go to email, and click on the link. 3. put the new password, submit and intercept the request; remove the authenticity token from the request and now forward it to the server. 4. you will see request still got...
HackerOne: Improper session management
When a request with an invalid authenticitytoken is received, the user is logged out tested for updating user's profile, which is available here: https://hackerone.com/diekatze/profile/edit and the user receives a new session cookie, which is not authenticated at this point. However, the...
HackerOne: Switching the user to the attacker's account
Two requests are needed to make it happen. Request1 log out the user: Request2 log in the user to the attacker's account: Please let me know if more detailed description is needed. Regards, Dawid Czagan...
HackerOne: Email spoofing
There are few email spoofing tool is available free.one them is http://emkei.cz/ when I tried to send a email from ███████ to my email ,it was successful but when i tried to send the another from ██████ , i did not receive any email.Hence, there might be some configuration missing in your mail...
HackerOne: Logical issues with account settings
earlier email was not allowed to change ,but now there is no verification on changing email. when user try to change the password , they were asked to verify the request by entering old password. For the same reason a verification should be there on changing email.The worst part is hackone send...
HackerOne: DNS Cache Poisoning
I noticed if I made a request to your website, intercepted the request, and added the header... X-Forwarded-Host: evil.com it would redirect me to evil.com. Well, after that, I tried going to hackerone.com and I was instantly redirected to evil.com. This is a result of DNS cache poisoning...
HackerOne: Flawed account creation process allows registration of usernames corresponding to existing file names
As requested by Alex: "You mentioned in the report to contact you on this account instead. Is this the email address you prefer to use for payment? If so, would you mind resubmitting the issue from this account so we can issue a payout to the proper account?" ---------- The account creation proce...
HackerOne: GIF flooding
Current limits --------------------- Image size: 1 MB Image dimensions: 2048x2048px File types: jpg/png/gif Another image hack --------------------- A GIF composed of 40k 1x1 images made Paperclip freeze until timeout. As attachments I sent the file composed of 40k images, and a screenshot of the...
HackerOne: Session not expired on logout
hackerone.com website is not expiring the user's session immediately after logout. Steps to verify: 1. Log into the website - hackerone.com. 2. Capture any request. For ex, profile edit page using burp proxy. 3. Logout from the website. 4. Replay the request captured in step 3 and notice it...
HackerOne: Privilege escalation..., or not?!
I just created the admin profile, go check it out: https://hackerone.com/nimda Or see attached image! This is very much related! svg/onload=alert1// Free iPad Here! This is Unrela...
HackerOne: CSP not consistently applied
Also thought I'd formally submitted the issue we discussed yesterday, that sometimes the CSP response headers served are missing for browsers that don't support them, but then the page without these headers can be cached by Cloudflare. This makes it easier to mount a XSS attack...
HackerOne: RTL override symbol not stripped from file names
Any U+202E RIGHT-TO-LEFT OVERRIDE and similar symbols in file names of uploaded files are not stripped from the file name, causing potentially malicious executables to look like harmless images, for example. This might trick HackerOne panel members into accidentally opening evil h4x0r filez. I’ve...
HackerOne: Session Management
Hackerone fails to expire the session cookie from the server side even when the user logs off upon clicking "Sign-Out" from the application. The cookie is cleared from the client side browser, but is not cleared from the server side. If reused, it provides access to the user's account. Upon loggi...
HackerOne: Broken Authentication and session management OWASP A2
Description: Session management issue in https://www.hackerone.com Cookies are used to maintain session of the particular user and they should expire once the user logs out of his hackerone account.In secure web application,Cookies immediately expire once the user logs out of his account. But thi...
HackerOne: Real impersonation
When you view merijn.html his profile shows the profile page of the merijn user although the former is a completely different user. This way users can potentially impersonate other users...
HackerOne: Flawed account creation process allows registration of usernames corresponding to existing file names
The account creation process allows to set up account names corresponding to names of server ressources, e.g. I just successfully created an account robots.txt which results in a profile path of https://hackerone.com/robots.txt and results in an bugged account as accessing account settings etc is...