GHSA-8W3J-G983-8JH5 Sensitive Data Exposure in parse-server

Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking. ParseError.ACCOUNTALREADYLINKED208 was thrown BEFORE the AuthController checks the password and throws a ParseError.SESSIONMISSING206 for Insufficient auth. An attacker can guess ids and get...

Podcast: Bugcrowd Founder on Printer Bugs, IoT Bounty Hunting, and New VDP Project

Bugcrowd has had a busy summer. Recently, the bug-bounty company partnered with HP to launch the first-ever bug bounty program for printers, with rewards of up to $10,000 for discovered vulnerabilities. Bugcrowd also recently announced Disclose.io, an open-sourced project to standardize best...

premastrologer.com XSS vulnerability

On the 09.01.2018 security researcher reported a XSS vulnerability affecting the premastrologer.com website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 9 January, 201...

xvideos.com.dnstree.com XSS vulnerability

On the 30.12.2017 security researcher reported a XSS vulnerability affecting the xvideos.com.dnstree.com website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 30...

sony.com.dnstree.com XSS vulnerability

On the 29.12.2017 security researcher reported a XSS vulnerability affecting the sony.com.dnstree.com website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 29 December,...

justice.gov.dnstree.com XSS vulnerability

On the 29.12.2017 security researcher reported a XSS vulnerability affecting the justice.gov.dnstree.com website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 29...

tune.rssing.com XSS vulnerability

On the 28.12.2017 security researcher reported a XSS vulnerability affecting the tune.rssing.com website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 28 December, 2017...

society14490.rssing.com XSS vulnerability

On the 03.12.2017 security researcher reported a XSS vulnerability affecting the society14490.rssing.com website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 3 Decembe...

reggie.rssing.com XSS vulnerability

On the 03.12.2017 security researcher reported a XSS vulnerability affecting the reggie.rssing.com website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 3 December, 201...

intraweb.stockton.edu XSS vulnerability

On the 18.11.2017 security researcher reported a XSS vulnerability affecting the intraweb.stockton.edu website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 18 November...

polyester93.com XSS vulnerability

On the 18.11.2017 security researcher reported a XSS vulnerability affecting the polyester93.com website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 18 November, 2017...

jobsite.co.uk Open Redirect vulnerability

On the 26.06.2017 security researcher reported a Open Redirect vulnerability affecting the jobsite.co.uk website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 26 June,...

vidm.nl XSS vulnerability

On the 18.06.2017 security researcher reported a XSS vulnerability affecting the vidm.nl website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 18 June, 2017 18:35 GMT...

Adobe Starts Vulnerability Disclosure Program on HackerOne

Update: Adobe is the latest tech vendor to begin a vulnerability disclosure program, but it seems they’re limping in at the outset. The program launched this week on the HackerOne platform, but there are no cash incentives being offered and certain Adobe products are not in scope for researchers...

Yahoo Fixes Trio of Bugs in Mail, Messenger, Flickr

Yahoo recently patched three remotely exploitable vulnerabilities in its services that could have let attackers inject malicious script and led to session hijacking, phishing, among other nefarious tricks. The vulnerabilities in Yahoo Mail, Messenger and its Flickr photo-sharing site qualified fo...