Information disclosure

The cofee-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation...

Information disclosure

The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation...

Information disclosure

The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation...

Information disclosure

The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation...

CVE-2017-16203

The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation...

CVE-2017-16205

The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation...

CVE-2017-16204

The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation...

CVE-2017-16202

The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation...

CVE-2017-16206

The cofee-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation...

PageUp Malware Scare Sheds Light On Third Party Risks

UPDATE Human resource firm PageUp warned customers its backend infrastructure was infected with malware and as a result customers’ sensitive information such as names, contacts and passwords may have been breached. A week after the initial announcement of the malware, on June 12, PageUp said that...

Node.js third-party modules: XSS in express-useragent through HTTP User-Agent

Hello, I would like to report an XSS in express-useragent module due a lack of validating User-Agent header. Please note I already created an Github issue and asked for CVE CVE-2018-9863. I did not know about Node.js third-party modules on hackerone. Description express-useragent is simple...

Apple will let users run iOS apps on macOS

Apple is making it easier for mobile developers to port their iOS apps to the next-generation macOS Mojave desktop platform—a major step in bringing the two platforms closer together. However, at the same time, the company straightforward denied the idea of merging the iPhone and Mac operating...

DNA Testing Service MyHeritage Leaks User Data of 92 Million Customers

Account data tied to 92 million users of the genealogy and DNA testing service MyHeritage were found on a third-party “private” server in a breach that exposed usernames and passwords of customers. The breach is the largest since last year’s Equifax leak of 147.9 million pieces of private data...

Node.js third-party modules: Arbitrary File Write through archive extraction

I would like to report arbitrary file write vulnerability in adm-zip module It allows attackers to write arbitrary files when a malicious archive is extracted. More info here: https://snyk.io/research/zip-slip-vulnerability https://github.com/snyk/zip-slip-vulnerabilityaffected-libraries Module...

All New Privacy and Security Features Coming in macOS 10.14 Mojave

At Worldwide Developer Conference 2018 on Monday, Apple announced the next version of its macOS operating system, and it's called Mojave. Besides introducing new features and improvements of macOS 10.14 Mojave—like Dark Mode, Group FaceTime, Dynamic Desktop, and Finder—at WWDC, Apple also reveale...

Facebook Accused of Giving Over 60 Device-Makers Deep Access to User Data

After being embroiled into controversies over its data sharing practices, it turns out that Facebook had granted inappropriate access to its users' data to more than 60 device makers, including Amazon, Apple, Microsoft, Blackberry, and Samsung. According to a lengthy report published by The New...

Liberapay: Phishing by Navigating Browser Tabs

Hi team, I was create a PR on github https://github.com/liberapay/liberapay.com/pull/1127 Details Opened windows through normal hrefs with target="blank" can modify window.opener.location and replace the parent webpage with something else, even on a different origin. While this doesn't allow scri...

Node.js third-party modules: [markdown-pdf] Local file reading

I would like to report local file reading in markdown-pdf It allows to insert a malicious html code, which allows to read the local files. Module module name: markdown-pdf version: 8.1.1 npm page: https://www.npmjs.com/package/markdown-pdf Module Description Node module that converts Markdown fil...

Trello: Stored XSS in Treeview plugin

There was a potential XSS issue in a third party power-up. While issues with third party apps are generally out of scope for our bug bounty program, in this case we opted to award a small bounty...

GDPR Is Here: Assess Risk from Vendors and from Internal Teams

Organizations must manage risk from third parties such as contractors and suppliers, and from internal staffers and teams, as part of their compliance program for the EU’s General Data Protection Regulation GDPR. The need to manage vendor risk in particular is stressed repeatedly throughout the...