Lucene search
+L
HackeroneMost viewed

15525 matches found

Hacker One
Hacker One
added 2020/07/11 4:16 a.m.113 views

Radancy: [mijn.werkenbijdefensie.nl] Denial of service occurs due to lack of email length confirmation

Creating an account on https://mijn.werkenbijdefensie.nl/profielaanmaken/ could be done with a very long emailaddress. A max email address length validation check has been implemented as per RFC the maximum length allowed for an email address is 255 characters. However, we don't validate email...

1.6AI score
SaveExploits0
Hacker One
Hacker One
added 2020/03/19 5:28 a.m.113 views

Razer: SQL injection in Razer Gold List Admin at /lists/index.php via the `list[]` parameter.

The tester discovered a monitoring server in a Razer Gold environment was running legacy software with a SQL injection vulnerability. Razer thanks the tester for his diligence and helping keep Razer's customer data secure. A Razer Gold asset suffered from an SQL injection due to an outdated...

0.9AI score
SaveExploits0
Hacker One
Hacker One
added 2020/02/26 9:10 a.m.113 views

X (Formerly Twitter): Periscope iOS app CSRF in follow action due to deeplink

Summary This issue is mainly in the Periscope iOS app against CSRF follow action using deeplink. as the report 583987 the CSRF work on iOS app POC 1 QR code to follow periscope profile pscp://user/periscopeco/follow ███████ POC2 by kunal94 /follow"CSRF DEMO video █████████ Impact CSRF Follow...

6.9AI score
SaveExploits0
Hacker One
Hacker One
added 2018/02/17 1:29 a.m.113 views

GSA Bounty: Subdomain Takeover due to unclaimed domain pointing to AWS

Note: I know this is on an out of scope domain, however felt it should still be raised as it was the only subdomain of data.gov to be vulnerable. Issue Details The consultant identified that subdomain https://18f.domains.api.data.gov/ is pointing to dn9rrjaiux2m0.cloudfront.net via a DNS CNAME...

SaveExploits0
Hacker One
Hacker One
added 2017/12/17 3:11 a.m.113 views

GitLab: Command injection by overwriting authorized_keys file through GitLab import

The Projects::GitlabProjectsImportService contains a vulnerability that allows an attacker to write files to arbitrary directories on the server. This leads to an arbitrary command execution vulnerability by overwriting the authorizedkeys file. To reproduce, sign in to a GitLab instance that has...

7.5CVSS0.3AI score0.05514EPSS
SaveExploits0
Hacker One
Hacker One
added 2017/07/12 11:21 a.m.113 views

X (Formerly Twitter): XXE on sms-be-vip.twitter.com in SXMP Processor

Hi team, What type of issue are you reporting? Does it align to a CWE or OWASP issue? I've identified an XXE vulnerability in the cloudhopper sxmp servlet on sms-be-vip.twitter.com which discloses local files to an external attacker and allows web requests to be sent. This aligns to...

6.7AI score
SaveExploits0
Hacker One
Hacker One
added 2017/06/30 7:23 p.m.113 views

Paragon Initiative Enterprises: [Critical] billion dollars issue

Hey, My name is El-Sisi also i have famous name is بلحه Balaha and i have found documents that confirm you the github inc belong to you. if you need this documents give me reward and i will give u that documents. why i'm doing this because my mother tell me if you see some things like that you mu...

0.7AI score
SaveExploits0
Hacker One
Hacker One
added 2017/05/22 5:52 a.m.113 views

WordPress: Clickjacking wordcamp.org

Hello Security, Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking contro...

0.3AI score
SaveExploits0
Hacker One
Hacker One
added 2017/02/24 8:22 a.m.113 views

ownCloud: Outdated Jenkins server hosted at OwnCloud.org

Summary: The target OwnCloud's server is running an outdated version of Jenkins server which is vulnerable to various attacks. Server Location: https://ci.owncloud.org Vulnerable Software: Jenkins ver. 2.27 Proof of Exploitability CVE-2016-3727 POC URL:...

6.5CVSS2.1AI score0.06228EPSS
SaveExploits1
Hacker One
Hacker One
added 2017/01/18 5:43 p.m.113 views

Yelp: Yelp.com is vulnerable to SWEET32 attack

Researchers have found new attack against 3DES-CBC cipher in TLS,that they can decrypt customer data using a method called SWEET32 Birthday Attack. This Vulnerability has got CVE-2016-2183 and has cvss score 5.0 This vulnerability can be found manually by simply using nmap script nmap -Pn -p...

5CVSS7.7AI score0.95707EPSS
SaveExploits7
Hacker One
Hacker One
added 2016/04/04 11:54 a.m.113 views

Internet Bug Bounty: BN_mod_exp may produce incorrect results on x86_64 (CVE-2015-3193)

For certain inputs OpenSSL's BNmodexp function which is used for RSA and Diffie Hellman can produce wrong results. The issue has been fixed by OpenSSL and rated moderate severity: https://openssl.org/news/secadv/20151203.txt A code example is here:...

5CVSS7.1AI score0.25137EPSS
SaveExploits1
Hacker One
Hacker One
added 2016/03/06 10:10 a.m.113 views

Internet Bug Bounty: putty pscp client-side post-auth stack buffer overwrite when processing remote file size

Not sure if this will qualify but it may impact a pretty broad audience given the fact that putty code is part of many other apps filezilla, ... and it is the defacto standalone ssh client for windows administrators besides openssh cygwin putty = 0.66; affects putty versions dating back 9 years...

7.5CVSS9.3AI score0.34216EPSS
SaveExploits4
Hacker One
Hacker One
added 2015/11/04 11:10 a.m.113 views

Slack: File upload XSS (Java applet) on http://slackatwork.com/

The web application supports file uploads and I was able to upload a Java Applet .class/.jar file. If a web browser loads a Java applet from a trusted site, the browser provides no security warning. If an attacker can upload a CLASS/JAR file with an applet, the file is executed even if the web...

6.2AI score
SaveExploits0
Hacker One
Hacker One
added 2014/02/23 4:08 p.m.113 views

Phabricator: Bypass auth.email-domains

Email addresses are stored as VARCHAR128. However, Phabricator does not verify the length of an email address upon registration. This allows attackers to bypass the allowed email-domains defined in auth.email-domains. Exploiting this is rather straightforward: get an email address of 128 characte...

3.7AI score
SaveExploits0
Hacker One
Hacker One
added 2024/11/15 11:16 a.m.112 views

IBM: Exposed Logs and Bearer Tokens on Test Endpoint

Exposed Logs and Bearer Tokens on Test Endpoint were reported to IBM, analyzed, and have been remediated...

7.2AI score
SaveExploits0
Hacker One
Hacker One
added 2023/07/05 3:54 p.m.112 views

Node.js: process.binding() can bypass the permission model through path traversal

The use of the deprecated API process.binding allowed for bypassing the permission model in Node.js 20.x through path traversal...

7.5CVSS8.4AI score0.01743EPSS
SaveExploits1
Hacker One
Hacker One
added 2023/05/25 1:38 p.m.112 views

Node.js: HTTP Request Smuggling via Empty headers separated by CR

HTTP Request Smuggling HRS was possible in Node.js v20.2.0 due to the llhttp parser in the http module not strictly using the CRLF sequence to delimit HTTP requests. The CR character without LF was sufficient to delimit HTTP header fields in the llhttp parser, which is not compliant with RFC7230...

7.5CVSS7.7AI score0.03906EPSS
SaveExploits1
Hacker One
Hacker One
added 2023/05/02 1:31 p.m.112 views

inDrive: XSS on terra-6.indriverapp.com

A Cross-Site Scripting XSS vulnerability was discovered on the terra-6.indriverapp.com domain that allowed javascript code execution in users' browsers...

6.4AI score
SaveExploits0
Hacker One
Hacker One
added 2022/10/27 3:24 p.m.112 views

Internet Bug Bounty: CVE-2022-42916: HSTS bypass via IDN

Original Report:https://hackerone.com/reports/1730660 Impact HSTS bypass...

5CVSS8.5AI score0.01809EPSS
SaveExploits0
Hacker One
Hacker One
added 2021/12/05 4:06 p.m.112 views

GitLab: Installing Gitlab runner with Docker-In-Docker allows root access

Summary Installing a Gitlab runner using official documents: https://docs.gitlab.com/ee/ci/docker/usingdockerbuild.htmluse-docker-socket-binding allows any user with access to Gitlab CI to have root access on Gitlab Runner server. Steps to reproduce Install Gitlab-runner binary using official...

0.1AI score
SaveExploits0
Hacker One
Hacker One
added 2021/11/05 10:43 p.m.112 views

TikTok: IDOR the ability to view support tickets of any user on seller platform

Due to an Insecure Direct Object Reference IDOR vulnerability, an attacker could have potentially viewed support tickets on seller platform. We thank @lewaperbb for reporting this to our team...

2.7AI score
SaveExploits0
Hacker One
Hacker One
added 2021/09/15 12:06 a.m.112 views

GitHub Security Lab: [Java] CWE-079: Query to detect XSS with JavaServer Faces (JSF)

This bug was reported directly to GitHub Security Lab...

1.4AI score
SaveExploits0
Hacker One
Hacker One
added 2021/05/04 8:21 p.m.112 views

GitHub Security Lab: ihsinme: CPP Add query for CWE-691 Insufficient Control Flow Management After Refactoring The Code

This bug was reported directly to GitHub Security Lab...

2.3AI score
SaveExploits0
Hacker One
Hacker One
added 2021/03/25 10:43 p.m.112 views

GitHub Security Lab: Java : Add query for detecting Log Injection vulenrabilities

This bug was reported directly to GitHub Security Lab...

1.4AI score
SaveExploits0
Hacker One
Hacker One
added 2021/01/06 5:26 p.m.112 views

Logitech: Sensitive information disclosure to shared access user via streamlabs platform api

Summary: Hi there, Hope you are doing well and stay safe. Streamlab allows us to invite other users to manage our dashboard and cloudbot functions via following setting which named "Shared Access". https://streamlabs.com/dashboard/settings/shared-access If we invite other users with Moderator rol...

6.5AI score
SaveExploits0
Hacker One
Hacker One
added 2020/11/20 2:02 a.m.112 views

Automattic: Sql injection on docs.atavist.com

hello dear team I have found SQL injection on docs.atavist.com url:http://docs.atavist.com/readerapi/stories.php?limit=10&offset=20&organizationid=88822&search=0&sort= parameters: injectable search=0 Parameter: search GET Type: AND/OR time-based blind Title: MySQL = 5.0.12 AND time-based blind...

0.3AI score
SaveExploits0
Hacker One
Hacker One
added 2020/10/29 3:37 p.m.112 views

Shopify: [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users image

Hello Shopify, when testing Shopify Ping share image function, I discovered an Amazon S3 bucket which has public access which allows an attacker to view all the image of other merchant & users. Steps To Reproduce: 1. Install Shopify Ping on your phone then enable Shopify Chat for your store. 2. G...

0.5AI score
SaveExploits0
Hacker One
Hacker One
added 2020/07/23 2:16 a.m.112 views

U.S. Dept Of Defense: Path traversal on https://███ allows arbitrary file read (CVE-2020-3452)

Summary: According to Cisco: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targete...

5CVSS0.7AI score0.99992EPSS
SaveExploits25
Hacker One
Hacker One
added 2020/07/16 10:46 p.m.112 views

Nord Security: Getting SmartDNS for free from - join.nordvpn.com

The reporter identified an issue within our backend system which performs validation of the active services. There was a misconfiguration related to caching and time period calculation. This lead to SmartDNS service being active for a longer period of time than it should have been, compared with...

6.8AI score
SaveExploits0
Hacker One
Hacker One
added 2019/08/05 3:49 p.m.112 views

Grammarly: Previously created sessions continue being valid after MFA activation

Hi team, I found one issue related to your 2FA system on https://account.grammarly.com/security POC 1 access the same account on https://account.grammarly.com in two devices 2 on device 'A' go to https://account.grammarly.com/security complete all steps to activate the 2FA system Now the 2FA is...

1.3AI score
SaveExploits0
Hacker One
Hacker One
added 2018/02/06 4:12 p.m.112 views

Node.js third-party modules: [public] Path Traversal allows to read content of arbitrary files

Hi Guys, There is Path Traversal in public module. It allows to read content of arbitrary files on the remote server. Module public Run static file hosting server with specified public dir & port. Support a "direcotry index" like Apache httpd. https://www.npmjs.com/package/public version: 0.1.2...

5CVSS7.6AI score0.02038EPSS
SaveExploits1
Hacker One
Hacker One
added 2017/11/10 6:29 p.m.112 views

Semrush: Following links are vulnerable to clickjacking

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Summary: The below list...

7AI score
SaveExploits0
Hacker One
Hacker One
added 2023/06/27 7:05 a.m.111 views

curl: CVE-2023-32001: fopen race condition

A race condition vulnerability existed in the fopen function of the curl library. This vulnerability allowed an attacker to exploit the race condition between the stat and fopen functions, potentially leading to unauthorized file overwrites or the theft of sensitive data such as cookies. The...

5.3AI score
SaveExploits0
Hacker One
Hacker One
added 2022/08/31 10:55 a.m.111 views

Internet Bug Bounty: CVE-2022-35252: control code in cookie denial of service

https://hackerone.com/reports/1613943 Impact control code in cookie denial of service...

2.6CVSS6AI score0.01947EPSS
SaveExploits1
Hacker One
Hacker One
added 2022/08/06 4:59 a.m.111 views

Reddit: IDOR allows an attacker to modify the links of any user

Hi team! I found an IDOR which allows to modify the links of any user. Users can put their custom links or social media links on their profile, ex: F1855366 To reproduce this: - Replicate the following request by replacing it with your own authentication headers: You must also put in the body of...

1.3AI score
SaveExploits0
Hacker One
Hacker One
added 2021/11/17 4:39 p.m.111 views

Acronis: IDOR vulnerability (Price manipulation)

Target: acronis.cz Step to Reproduce 1.Go to acronis.cz 2.buy any product in this case i am going to buy this https://www.acronis.cz/produkt/acronis-cyber-protect-home-office/ for test 3.fill up details 4.go to burpsuite turn on intercept 5.click on buy now 6.check request in intercept change pri...

0.8AI score
SaveExploits0
Hacker One
Hacker One
added 2021/11/05 11:02 a.m.111 views

XVIDEOS: No-Rate limit of current password on delete account endpoint(https://www.xvideos.com/account/close)

Hi Team!!! This Attack happen when victim login in other device and forget to logout ,Then attacker can delete it's account by brute force the current password because current password has no-rate limit. After guessing current password attacker can easily delete the victim account. Steps To...

6.9AI score
SaveExploits0
Hacker One
Hacker One
added 2021/05/20 11:23 p.m.111 views

GitHub Security Lab: [Java] CWE-094: Jython code injection

This bug was reported directly to GitHub Security Lab...

1.2AI score
SaveExploits0
Hacker One
Hacker One
added 2021/04/14 7:20 p.m.111 views

GitHub Security Lab: [Java] CWE-1004: Query to check sensitive cookies without the HttpOnly flag set

This bug was reported directly to GitHub Security Lab...

0.1AI score
SaveExploits0
Hacker One
Hacker One
added 2021/02/13 3:55 p.m.111 views

Nextcloud: bypassing dashboard without account + Information disclosure trough websockets

Sumarry : I found a information disclosure for bypassing parameter url attacker can redirect to dashboard without login user/pass page and websocket can be exposed in response/dashboard. URL Effected https://support.nextcloud.com/passwordreset Steps To Reproduce: Opened directory at...

6.6AI score
SaveExploits0
Hacker One
Hacker One
added 2020/10/15 4:42 a.m.111 views

Engel & Völkers Technology GmbH: Debug information at the /sapi endpoint

Summary: Sending a GET request to www.engelvoelkers.com/sapi and the server responds with a 500 Internal Server Error which yields a stack trace. Steps To Reproduce: - Enter www.engelvoelkers.com/sapi into your web browser and you can see the stacktrace. https://bugpoc.com/pocbp-VPZDeo2Z I will...

SaveExploits0
Hacker One
Hacker One
added 2020/07/12 9:52 p.m.111 views

WordPress: Clickjacking on donation page

Description: Vulnerable URL: https://wordpressfoundation.org/donate/ Clickjacking on the vulnerable URL allows an attacker to redirect a victim to do a donation at an attacker's page. Steps To Reproduce: 1 To test whether the page is vulnerable to clickjacking or not use this code i Frame THIS PA...

0.4AI score
SaveExploits0
Hacker One
Hacker One
added 2020/06/04 3:56 p.m.112 views

Open-Xchange: null dereference in `sieve_address_do_validate` (or redundant null check)

Function sieveaddressdovalidate in file sieve-address.c does dereference errorr if address == NULL errorr = "null address"; return FALSE; and then later checks for it being NULL : if errorr != NULL errorr = strcctx.error; So either, there is a first null check missing Or the later ones are...

1.8AI score
SaveExploits0
Hacker One
Hacker One
added 2020/05/17 7:47 a.m.111 views

Topcoder: SSRF at https://cognitive.topcoder.com leads to AWS instance metadata due to vulnerable email subscription feature

Summary: Topcoder makes use of Amazons AWS in their web application environment. I noticed a feature that allows a user to subscribe and receive emails from Topcoder. This feature is vulnerable to server side request forgery since it allows a user to supply an arbitrary URL which the application...

0.5AI score
SaveExploits0
Hacker One
Hacker One
added 2020/03/03 9:03 p.m.111 views

Visma Public: [IDOR]Ability to edit Description of api_key's of other users.

The reasearcher was able to change the description associated with API-keys for other users on the /api/orgID/apiKey endpoint by modifying the id of the API-key in the request...

2.9AI score
SaveExploits0
Hacker One
Hacker One
added 2019/12/24 12:03 a.m.111 views

Mapbox: Stored XSS | api.mapbox.com | IE 11 | Styles name

On December 24, 2019, user @renekroka reported a stored XSS injection vulnerability on api.mapbox.com that affected users in Internet Explorer 11. An attacker could store XSS injections on Mapbox servers, and then exploit them in IE11 due to JSON responses not including the X-Content-Type-Options...

1.5AI score
SaveExploits0
Hacker One
Hacker One
added 2019/12/04 8:44 p.m.111 views

Nord Security: No Rate Limit On Forgot Password Page Of NordVPN

Introduction A little bit about Rate Limit: A rate limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given timeframe, HTTP-Servers can respond with status code 429...

7.1AI score
SaveExploits0
Hacker One
Hacker One
added 2019/09/21 4:13 a.m.111 views

Razer: Race Condition in Oauth 2.0 flow can lead to malicious applications create multiple valid sessions

The tester discovered a flaw in the Razer ID authentication system that could allow multiple access tokens. This was a minor issue but could theoretically have led to extended access due to unexpired tokens. Razer thanks the tester for their diligence. Here is a write-up for similar bug:...

1.2AI score
SaveExploits0
Hacker One
Hacker One
added 2018/09/27 10:16 a.m.111 views

h1-5411-CTF: h1-5411-CTF report: LFI / Deserialization / XXE vulnerability,

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: h1-5411-ctf write-up The CTF...

0.6AI score
SaveExploits0
Hacker One
Hacker One
added 2018/05/23 7:11 a.m.111 views

Node.js third-party modules: Samlify is vulnerable to signature wrapping

I would like to report a signature wrapping weakness in samlify It allows an attacker to modify a SAML token received from the IdP before validating it with the service provider Module module name: samlify version: 2.3.7 npm page: https://www.npmjs.com/package/samlify Module Description Highly...

6.8AI score
SaveExploits0
Total number of security vulnerabilities5000