HackerOne: Subdomain takeover #4 at info.hacker.one

Summary: Hi team, looking the last fix released from unbounce team at https://hackerone.com/reports/217358 i've been able to bypass it and takeover the subdomain info.hacker.one with a new vulnerable ENDPOINT + PARAM COMBINATION at UnbouncePages App Actual Dns Entry: F174718 Reproduction Steps fo...

HackerOne: Example HackerOne security@ forward domain is not registered

Description In this how-to article, @security-h1-forward.com appears as a valid HackerOne domain for forwarding security issues. This domain is not registered. The actual flow does not include this domain, but I think it's confusing enough to consider the risk of someone mistakenly using the doma...

HackerOne: Subdomain takeover #3 at info.hacker.one

Summary: Hi team, looking the last fix released from unbounce team at https://hackerone.com/reports/209004 i've been able again to bypass it again and takeover the subdomain info.hacker.one with a new vulnerable PARAM at UnbouncePages App Actual Dns Entry: F172446 Steps To Reproduce & New PoC for...

HackerOne: A HackerOne employee's GitHub personal access token exposed in Travis CI build logs

Summary A HackerOne employee Reed Loden GitHub:reedloden exposed their personal access token twice in build logs of the rubysec/rubysec.github.io project: 1. 2015-12-10 2. 2016-03-01 Description The token has publicrepo scope, which means that it allows access to any public repos the owner accoun...

HackerOne: Report invitation links not restricted to any existing user

We recently made a change to how report invitations in order to make the Disclosure Assistance process better. Parts of this change regressed the fix we made in 123420 regarding how report invitations such as to become an external participant are handled. @japzdivino notified of this regression a...

HackerOne: IE 11 Self-XSS on Jira Integration Preview Base Link

I wasn't sure if you would accept this report due to it being Self-XSS, but I figured it might be useful information because it breaks one of the flows used to validate URLs. Steps ==================== 1. Launch IE 11 2. Log into a HackerOne account that has admin on a program. 3. Go to the...

HackerOne Offers Open Source Projects Free Access to Platform

HackerOne announced on Thursday the availability of a free version of its bug bounty platform called HackerOne Community Edition that will give open source projects tools for managing vulnerability submissions and creating bounty programs to improve software security. Eligible open source project...

HackerOne: javascript: and mailto: links are allowed in JIRA integration settings

Summary: For new feature settings, you accept website URLs like javascript:// or data:// in base urls. Even https://evil.com works, this needs to be stripped, this can be used to create another integrations without Steps To Reproduce 1. https://hackerone.com/Team/integrations/jira/edit 2. Try in...

HackerOne: Private program email forwarding response invitation not expire after first use.

Summary: Hi Hackerone Team, Before i reported that email forwarding of private can be enumerated and any user join to private program here 201369 , but this seems by design, but now it i found a related issue which can cause a security impact on private program because the email forwarding respon...

HackerOne: Subdomain takeover #2 at info.hacker.one

Summary: Hi team, looking the fix released from unbounce team at https://hackerone.com/reports/202767 i've been able to bypass it and takeover again the subdomain info.hacker.one with a new Vulnerable-Endpoint at UnbouncePages App Actual Dns Entry: F164154 Steps To Reproduce & New PoC for HackerO...

HackerOne: Able to create basic user account via Google login on HackerOne Drupal CMS

Summary: Hi, I've found that hackerone.com has drupal installed and when I navigated to this URL https://www.hackerone.com/user/password Found "Log in" and "password reset option". When I clicked on login it redirected me to google login Then I login using my gmail account and it redirected to...

HackerOne: Information leakage via CSV when content is valid JavaScript

Summary: The function "Download as CSV" might leak information to 3rd domains. The exploitation seems unlikely and purely theoretical but it might work in some cases. Description Include Impact: Take downloading payments as CSV, for example, which is recently launched. The response to...

HackerOne: Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP

Hi, I just discovered that there's a scenario where the Marketo Forms solution being used on www.hackerone.com can actually be abused, using a few fun techniques, to trigger an XSS in the Cross-Origin-iframe being used by Marketo. This results in eavesdropping of the data being sent in the...

PortSwigger Web Security: Email Spoofing

There is an Email Spoofing Vulnerability. Steps to reproduce: 1 Go to http://emkei.cz/ 2 Fill "From Email" field to [email protected] or any other portswigger email. 3 Fill the victim's address your address to "TO" field and fill in other details as you wish. You will receive email from...

HackerOne: Subdomain takeover at info.hacker.one

Summary: Hi team,i've been able to takeover subdomain at info.hacker.one, the CNAME entry in the subdomain is pointing to an external page service app.unbounce.com. Actual Dns Entry: F156764 Steps To Reproduce 1 I have claimed the domain and placed a page for PoC validation located under: Go to -...

Revive Adserver 4.0.0 XSS / Deserialization / Session Fixation Vulnerabilities

Revive Adserver versions 4.0.0 and below suffer from cross site scripting, session fixation, and deserialization of untrusted data vulnerabilities. Revive Adserver 4.0.0 XSS / Deserialization / Session Fixation Applications affected: Revive Adserver Versions affected: = 4.0.1 Website:...

Uber.com Backup Bug Nets Researcher $9K

A researcher netted a $9,000 payday last summer after digging up a XML external entity XXE vulnerability in a third-party backup software system used by Uber. The vulnerability, which could have given an attacker access to the user backup data of any company using the software, including Uber, wa...

Boozt Fashion AB: Email spoofing at booztlet.com

Hello : This There is an Email Spoofing Vulnerability. Steps to reproduce: 1 Go to http://emkei.cz/ 2 Fill "From Email" field to [email protected] or any other booztlet email. 3 Fill the victim's address your address to "TO" field and fill in other details as you wish. You will receive email fro...

Brave Browser Address Bar Spoofing

Summary: Brave Browser Suffers from Address Bar Spoofing Vulnerability. Address Bar spoofing is a critical vulnerability in which any attacker can spoof the address bar to a legit looking website but the content of the web-page remains different from the Address-Bar display of the site. In Simple...

HackerOne: Disclose any user's private email through API

Description: I have found a security vulnerability that allows an attacker to disclose any user's private email. An attacker can disclose any user's private email by creating a sandbox program then adding that user to a report as a participant. Now if the attacker issued a request to fetch the...