KingOfBugBountyTips

KingOfBugBountyTips El Arsenal Definitivo de Reconocimiento para Bug Bounty "En las sombras cazamos, en el código confiamos" Telegram | Twitter | YouTube | LinkedIn DoD VDP Scope Programa de Divulgación de Vulnerabilidades del DoD | KingRecon DOD Alcance Completo del DoD - 19 Dominios bash BBRF...

Vulnerability-Disclosures

Divulgaciones de Vulnerabilidades de Mandiant Este repositorio detalla las vulnerabilidades divulgadas por Mandiant. Estas vulnerabilidades fueron descubiertas mediante investigación interna, evaluaciones de Red Team, o en uso activo en el entorno salvaje. Las pruebas de concepto PoCs pueden o no...

policymaker

policymaker Genera una política real de divulgación de vulnerabilidades — VDP, puerto seguro, security.txt y DNS Security TXT — en minutos. Sin necesidad de abogado. Parte deel proyecto disclose.io — la infraestructura abierta y neutral de proveedores para la divulgación de vulnerabilidades...

nvidia-gpu-security-poc

Controlador de GPU NVIDIA — dos hallazgos que NVIDIA cerró como comportamiento esperado Código de prueba de concepto y evidencia en bruto para dos hallazgos en el controlador de GPU Linux de NVIDIA, ambos reportados a través del VDP de NVIDIA y ambos cerrados por NVIDIA como comportamiento...

CVE-2000-0114

CVE-2000-0114 Este es un CVE que encontré en VDP en la plataforma HackerOne Pasos para el POC :- 1 - instala " pip install CVE-2000-0114 " 2 - ejecuta " CVE-2000-0114 -u https://example.com " 3 - o puedes ejecutar el script...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-386412)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-386412 advisory. In the Linux kernel, the following vulnerability has been resolved: vhostvdpa: assign irq bypass producer token correctly We used to call irqbypassunregisterproducer...

Hemi VDP: Broken X (Twitter) link on hemi.xyz/about

Vulnerability description not provided...

Hemi VDP: Linkedin Broken Link Hijacking on https://hemi.xyz/about

The LinkedIn account link for a team member on the https://hemi.xyz/about page pointed to a non-existent LinkedIn account...

HackerOne: Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation

Vulnerability description not provided...

nullsec VDP: Test by HDR

Test by HDR...

mycompany VDP: This test report has been disclosed by 20_root.

This test report has been disclosed by 20root. ████...

UK PSTI? You’ll need a Vulnerability Disclosure Program!

If you are distributing or selling smart devices in to the UK market, your products will need to be compliant with the UK Product Security and Telecommunications Act. One of the three mandatory areas is that you have a vulnerability disclosure program VDP In the supporting materials for the Act,...

Qualys Is Proud to Sign CISA’s Secure by Design Pledge

Cybersecurity leaders in the U.S. are very familiar with the Cybersecurity and Infrastructure Security Agency CISA and their important work to keep the internet, our country, and its citizens safe from cyber threats. As part of their efforts, CISA has identified secure by design software as a key...

Fastly VDP: Cache purge requests are not authenticated

Vulnerability description not provided...

When disclosure goes wrong. People

My experience of vulnerability disclosure is that it is rarely as easy or simple as it could be. I had hoped that bug bounty programmes and vulnerability disclosure programmes VDPs would help matters. Broadly that doesn’t seem to be the case, often for unexpected reasons. It’s not all bad though...

SecurityScorecard: RXSS

Finding an OWASP Top 10 vulnerability is quite common unfortunately. We are glad that our HackerOne VDP has identified this issue and that it is resolved...

CISA Announces Vulnerability Disclosure Policy (VDP) Platform

CISA has announced the establishment of its Vulnerability Disclosure Policy VDP Platform for the federal civilian enterprise, which will allow the Federal Civilian Executive Branch to coordinate with the civilian security research community in a streamlined fashion. The VDP Platform provides a...

U.S. Dept Of Defense: Reflected XSS In https://███████

Hi security team, According to my report 1092618, The VDP team agreed that ████ and it's subdomains is in the scope of the DoD program So I continue testing that domain Vulnerable Website URL: https://███████████████%3CSvg%20OnLoad=alert1%3E Description of Security Issue: Reflected XSS in path...

Doppler VDP: Bypass Email Verification.

steps to reproduce:- 1- sign up into doppler here https://dashboard.doppler.com/register. 2- then it will go to this page https://dashboard.doppler.com/confirm and ask you to confirm your email. 3- go to source code and search for tagsconfirmemail . 4- you will find the email Verification token...

Doppler VDP: Stored XSS in [https://dashboard.doppler.com/workplace/*/logs] pages

Summary: I have found a stored XSS vulnerability in the following config setting page. https://dashboard.doppler.com/workplace//projects/example-project/configs/dev/logs When you invite other users to the workspace, the xss could be used to exploit other users also. Steps To Reproduce: 1 . Visit...