Lucene search
+L
HackeroneMost viewed

15404 matches found

Hacker One
Hacker One
added 2016/09/06 8:29 p.m.49 views

Yelp: Verification of E-Mail address possible on https://biz.yelp.com/login and https://biz.yelp.com/forgot

On pages https://biz.yelp.com/login and https://biz.yelp.com/forgot a malicious user can verify if a particular E-mail address is registered on biz.yelp.com. Steps to reproduce for https://biz.yelp.com/login: 1. Open https://biz.yelp.com/login 2. Enter non existing E-Mail Address 3. Enter any...

0.1AI score
SaveExploits0
Hacker One
Hacker One
added 2016/08/25 9:31 a.m.49 views

Instacart: WordPress Authentication Denial of Service

Hi, I found out that you are using WordPress version 4.5.3. Researchers found out 5 days ago, that this version has a vulnerability, a Path traversal in WordPress Core Ajax handlers. Intro WordPress is web software that can be used to create a website, blog, or app. A path traversal vulnerability...

0.5AI score
SaveExploits0
Hacker One
Hacker One
added 2016/07/11 2:47 p.m.49 views

OLX: SQLi in Payment Request

Hi there, I have found out that one request in your API is vulnerable to SQL injection. PoC: Invalid Request: GET /api/v1.0/payments/items?ids=891048367'"&platform=desktop HTTP/1.1 Host: www.olx.com.ar User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:46.0 Gecko/20100101 Firefox/46.0 Accept:...

7.3AI score
SaveExploits0
Hacker One
Hacker One
added 2016/06/01 1:53 p.m.49 views

Internet Bug Bounty: CVE-2016-2177 Undefined pointer arithmetic in SSL code

1.0.2 version here: https://github.com/openssl/openssl/commit/a004e72b95835136d3f1ea90517f706c24c03da7 1.0.1 version here: https://github.com/openssl/openssl/commit/6f35f6deb5ca7daebe289f86477e061ce3ee5f46 These will get listed in the next security advisory and rolled up in the next release...

7.5CVSS8.8AI score0.44505EPSS
SaveExploits1
Hacker One
Hacker One
added 2016/05/13 1:10 a.m.49 views

Internet Bug Bounty: Adobe Flash Player ContentFactory class Memory Corruption Vulnerability

I. Summary Adobe Flash Player is prone to a vulnerability which leads to memory corruption because of improper validation of ContentFactory.retrieveAdPolicySelector. ------------------------------------------------------------------ II. Description Adobe Flash is a multimedia and software platfor...

7.6CVSS8.6AI score0.09561EPSS
SaveExploits0
Hacker One
Hacker One
added 2016/05/09 7:16 a.m.49 views

Dropbox: Dropbox apps Server side request forgery

Hi, SSRF is a vulnerability that appears when an attacker has the ability to create requests from the vulnerable server. Usually, Server Side Request Forgery SSRF attacks target internal systems behind the firewall that are normally inaccessible from the outside world but using SSRF it’s possible...

0.7AI score
SaveExploits0
Hacker One
Hacker One
added 2016/05/03 11:41 a.m.49 views

Internet Bug Bounty: EVP_EncodeUpdate overflow (CVE-2016-2105)

https://github.com/openssl/openssl/commit/ee1e3cac2e83abc77bcc8ff98729ca1e10fcc920...

5CVSS8.9AI score0.3965EPSS
SaveExploits1
Hacker One
Hacker One
added 2016/04/25 5:2 p.m.49 views

Zendesk: XSS In /zuora/ functionality

Hello there, I wanted to report a XSS vulnerability in the /zuora/ functionality on the zendesk application. Affected URL: -...

6.1AI score
SaveExploits0
Hacker One
Hacker One
added 2016/04/10 9:17 p.m.49 views

Uber: reopen #128853 (Information disclosure at lite.uber.com)

Issue in 128853 occurs again. 1. go to https://login.uber.com/oauth/v2/authorize?responsetype=code&redirecturi=https%3A%2F%2Flite.uber.com%2Fauth%2Fcallback&scope=profile%20history%20places%20historylite%20requestreceipt%20request%20paymentbaiduwallet&clientid=y-JJyZRABnEwbJQq4VdQPORo4EKqv0j 2...

7AI score
SaveExploits0
Hacker One
Hacker One
added 2016/03/23 7:14 p.m.49 views

Uber: Dom Based Xss

Hi. found dom xss on this subdomain eng.uber.com. you are using a vulnerable plugin prettyPhoto.. This XSS will work in Firefox,Chrome - Google and IE last version ! And this is very dangerous! POC Firefox vector http://eng.uber.com/prettyPhotoi/x,/x POC Google and IE...

0.2AI score
SaveExploits0
Hacker One
Hacker One
added 2016/03/01 7:8 p.m.49 views

Internet Bug Bounty: BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption (CVE-2016-0797)

https://openssl.org/news/secadv/20160301.txt...

5CVSS8.9AI score0.27022EPSS
SaveExploits1
Hacker One
Hacker One
added 2015/12/25 2:34 p.m.49 views

Informatica: [rev-app.informatica.com] - XXE via SAML

Request: POST /sso HTTP/1.1 Host: rev-app.informatica.com Connection: keep-alive Content-Length: 8669 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Origin: https://infapassport.okta.com Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5....

1AI score
SaveExploits0
Hacker One
Hacker One
added 2015/11/24 1:23 a.m.49 views

Radancy: RC4 cipher suites detected

A group of researchers Nadhem AlFardan, Dan Bernstein, Kenny Paterson, Bertram Poettering and Jacob Schuldt have found new attacks against TLS that allows an attacker to recover a limited amount of plaintext from a TLS connection when RC4 encryption is used. The attacks arise from statistical fla...

0.6AI score
SaveExploits0
Hacker One
Hacker One
added 2015/10/19 2:31 p.m.49 views

Radancy: Version Disclosure (NginX)

Hi, I found a version disclosure Nginx in the your web server's HTTP response. Extracted Version: 1.8.0 This information might help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Nginx. Impact An attacker...

0.4AI score
SaveExploits0
Hacker One
Hacker One
added 2015/06/12 10:25 a.m.49 views

VK.com: Issue in the implementation of captcha and race condition

Reuse of captcha. The researcher was able to find a misconfiguration in the captcha mechanism which allowed him to reuse any captcha and bypass the uniquness of the same . Furthermore the race condition bypassed the no. of retries...

6.8AI score
SaveExploits0
Hacker One
Hacker One
added 2015/02/12 12:35 a.m.49 views

Mail.ru: Same Origin Policy bypass

Hi, After small investigation I've probably found something that can be exploited to bypass Same Origin Policy on mail.ru services specially your main domain and e.mail.ru. First of all - let's take a look about your crossdomain.xml both for mail.ru and e.mail.ru: After time spent on searching...

7.1AI score
SaveExploits0
Hacker One
Hacker One
added 2015/02/09 6:36 p.m.49 views

Internet Bug Bounty: Race condition in workers may cause an exploitable double free by abusing bytearray.compress()

The issue occurs while sharing a bytearray between two workers. If one worker calls bytearray.compress while the other uses that bytearray, Flash does not correctly handle the race and may double free the array. Identified as CVE-2015-0312, and reported to Adobe via Chrome VRP:...

9.3CVSS6.3AI score0.07078EPSS
SaveExploits0
Hacker One
Hacker One
added 2015/01/22 11:40 a.m.49 views

X (Formerly Twitter): Insecure Data Storage in Vine Android App

Hi Twitter, - Vulnerability Class:OWASP M2 : Insecure Data Storage Every application needs to store something secret, like a website username,password, cookies etc. , internal storage is the place to do it, android sandbox prevents other applications from accessing this data but,In vine android a...

6.7AI score
SaveExploits0
Hacker One
Hacker One
added 2015/01/21 12:44 p.m.49 views

Vimeo: XSS on any site that includes the moogaloop flash player | deprecated embed code

The moogaloop flash player includes in most cases http://f.vimeocdn.com/p/flash/moogaloop/6.0.30/controllers/videoControllerProgressive.swf. In that flash file we can find functionality that looks into the SharedObject "com.conviva.livePass" for recently loaded swf-URLs under the key "lastSwfUrls...

5.9AI score
SaveExploits0
Hacker One
Hacker One
added 2015/01/05 7:37 p.m.49 views

Vimeo: Vimeo.com Insecure Direct Object References Reset Password

Hello, my name is Toufik Airane. This is Responsible Disclosure and Silent Disclosure. Thanks you to opened bug bounty program! Please find a proof of concept for IDOR attack on famous vimeo.com. With this IDOR, attacker can reset any password, of any account and take controle of it. Please, find...

1AI score
SaveExploits0
Hacker One
Hacker One
added 2014/12/02 12:27 a.m.49 views

QIWI: Stored xss in agent.qiwi.com

Researcher found vulnerability in website agent.qiwi.com. Renaming terminal may lead to stored XSS...

1.2AI score
SaveExploits0
Hacker One
Hacker One
added 2014/11/18 1:25 p.m.49 views

QIWI: Metadata in hosted files is disclosing Usernames, Printers, paths, admin guides. emails

Hi - vulnerable hosts; agent.qiwi.com static.qiwi.com visa.qiwi.com w.qiwi.com www.qiwi.com • the type of vulnerability; Information disclosure • where exactly; There are multiple locations for documents with valuable metadata attached. These are both Qiwi documents and documents uploaded by...

0.1AI score
SaveExploits0
Hacker One
Hacker One
added 2014/11/06 5:35 a.m.49 views

Block.io: SMPT Protection not used, I can hijack your email server.

Description Companies like Coinbase, Yahoo,Google,Facebook and even hackerone implemented a strict email security policy combining SPF, DKIM, and DMARC but I don't see taht from block.io , You should apply strict SMPT policy to stop spoofed email sending from your domain. POC is attached. Exploit...

7.2AI score
SaveExploits0
Hacker One
Hacker One
added 2014/10/25 11:46 p.m.49 views

X (Formerly Twitter): URGENT - Subdomain Takeover on media.vine.co due to unclaimed domain pointing to AWS

Hi, This is an urgent issue and I hope you will act on it likewise. Your subdomain media.vine.co is pointing to AWS S3, but no bucket was connected to it. Actually, the reason to it is due to the CNAME of the meda.vine.co-DNS-entry: media.vine.co - media.vine.co is an alias for...

6.1AI score
SaveExploits0
Hacker One
Hacker One
added 2014/10/12 6:11 p.m.49 views

joola.io: Weak Random Number Generator for Auth Tokens

https://github.com/joola/joola/blob/a534c3dca1a0deaec99c192978e61a35dd3a9069/lib/common/index.jsL90-L98 Math.random is not sufficient for cryptographic purposes such as authentication tokens. An example replacement that uses window.crypto.getRandomValues is available here:...

0.4AI score
SaveExploits0
Hacker One
Hacker One
added 2014/07/15 3:54 a.m.49 views

Automattic: Missing HSTS header in https://app.simplenote.com

Hi, Vulnerable Website: https://app.simplenote.com I tested the website using firefox add-on called: Strict Transport Security Detector https://addons.mozilla.org/en-US/firefox/addon/strict-transport-security-d/ HSTS addresses the following threats: User bookmarks or manually types...

6.8AI score
SaveExploits0
Hacker One
Hacker One
added 2014/04/26 3:30 p.m.49 views

OkCupid: XSS Vulnerability Found!

Good Day okcupid Security Team! i just want to report that i found a bug on your website. what i've found out is a xss vulnerability with the use of third party app facebook. at first i upload an image in facebook and name it as " then go to okcupid.com then i click upload image and i click the...

6.7AI score
SaveExploits0
Hacker One
Hacker One
added 2014/03/10 2:8 a.m.49 views

Yahoo!: Clickjacking at surveylink.yahoo.com

Thank you for your submission to Yahoo’s Bug Bounty program. While we recognize the effort that you put into the research and writing of a report for us to evaluate, but unfortunately this bug has already been reported to us. We appreciate your adherence to responsible disclosure guidelines and...

6.6AI score
SaveExploits0
Hacker One
Hacker One
added 2013/12/10 12:0 a.m.49 views

Internet Bug Bounty: Flash type confusion vulnerability leads to code execution

This bug was reported directly to Adobe. http://helpx.adobe.com/security/products/flash-player/apsb13-28.html...

9.3CVSS6.3AI score0.72495EPSS
SaveExploits6
Hacker One
Hacker One
added 2026/05/14 12:13 p.m.48 views

curl: cookie: case-insensitive path comparison in replace_existing() allows cookie eviction across distinct paths

Hi all, replaceexisting in lib/cookie.c compares cookie paths case-insensitively at two sites. On case-sensitive servers, /Admin and /admin are distinct resources and are supposed to produce distinct jar entries. Because libcurl conflates them, a Set-Cookie at one path silently evicts the cookie ...

5.8AI score
SaveExploits0
Hacker One
Hacker One
added 2026/04/08 1:18 p.m.48 views

curl: libcurl: Integer truncation in curl_easy_ssls_import() causes TLS sessions to never expire

Summary: curleasysslsimport deserializes a TLS session blob and stores it in the in-memory session cache. In Curlsslsessionunpack lib/vtls/vtlsspack.c:311, the validuntil field is read as uint64t and cast directly to curlofft int64t with no bounds check — so a crafted blob encoding validuntil =...

5.9AI score
SaveExploits0
Hacker One
Hacker One
added 2024/10/12 5:41 a.m.48 views

U.S. Dept Of Defense: [ CVE-2018-1000129 ] RXSS At `https://███████` via the URI

The CVE-2018-1000129 vulnerability allowed remote cross-site scripting RXSS at the specified URL. The vulnerability was due to improper sanitization of user input, which enabled the execution of arbitrary scripts in the victim's browser...

6.1CVSS6.3AI score0.25103EPSS
SaveExploits1
Hacker One
Hacker One
added 2024/06/14 10:58 a.m.48 views

U.S. Dept Of Defense: Subdomain takeover ██████

The subdomain █████ was found to be pointing to open-elb-prod-277276106.us-east-1.elb-amazonaws.com., and the domain elb-amazonaws.com was available for registration. This vulnerability could have been exploited to host unwanted content, receive email, and potentially execute cross-site scripting...

6.7AI score
SaveExploits0
Hacker One
Hacker One
added 2023/10/29 7:37 a.m.48 views

Nextcloud: Bruteforce protection in password verification can be bypassed

A vulnerability was found where the IP address used for brute force protection in Nextcloud server could be bypassed by adding a valid X-Forwarded-For header. This allowed an attacker to bypass the brute force protection and brute force login credentials...

9.8CVSS6.9AI score0.01041EPSS
SaveExploits0
Hacker One
Hacker One
added 2023/10/26 8:20 p.m.48 views

Snowplow: Unauthorised ██████████ Auth via Token Leakage & HTTP Header Injection

Summary We've identified that your Email Filtering mechanism is misconfigured in the way it visits suspicious links. This behavior is dangerous, as data exfiltration is possible when a 3rd party service sends an incoming email containing sensitive data. A great example would be a reset password...

7.1AI score
SaveExploits0
Hacker One
Hacker One
added 2023/09/11 7:20 a.m.48 views

U.S. Dept Of Defense: authentication bypass

An authentication bypass vulnerability was discovered in the login page of a web portal, allowing unauthorized access without providing valid credentials...

7.4AI score
SaveExploits0
Hacker One
Hacker One
added 2023/08/09 6:37 p.m.48 views

Internet Bug Bounty: (CVE-2023-32003) fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks

The fs.mkdtemp and fs.mkdtempSync functions in Node.js were found to be missing getValidatedPath checks, allowing for a path traversal attack. This vulnerability could be exploited to create arbitrary directories...

5.3CVSS7.1AI score0.01048EPSS
SaveExploits0
Hacker One
Hacker One
added 2023/06/13 3:56 p.m.48 views

GitHub Security Lab: [Python] Unsafe Unpacking and TarSlip bug slaying

Vulnerability description not provided...

7.1AI score
SaveExploits0
Hacker One
Hacker One
added 2023/06/02 8:51 p.m.48 views

HackerOne: Asset Inventory Internal Descriptions are leaked in CSV export

An internal asset description in the Asset Inventory feature of HackerOne was leaked in the CSV export, potentially exposing sensitive information stored in the description...

6.5AI score
SaveExploits0
Hacker One
Hacker One
added 2023/04/18 1:45 p.m.48 views

Cloudflare Public Bug Bounty: Cloudflare CASB Confused Deputy Problem

A vulnerability was found in Cloudflare CASB on Microsoft and GitHub integrations, allowing an attacker to create a new integration and access sensitive information if they were able to enumerate a valid tenant UUID or domain. The issue was resolved by disallowing the creation of multiple...

6.7AI score
SaveExploits0
Hacker One
Hacker One
added 2023/02/07 11:3 p.m.48 views

Internet Bug Bounty: Open Redirect Vulnerability in Action Pack

An open redirect vulnerability was discovered in Action Pack, specifically in the redirectto helper function. This vulnerability allowed for the possibility of an attacker to craft a URL that could bypass the protection against open redirects introduced in Rails 7.0. The vulnerability was fixed i...

6.1CVSS6.2AI score0.00595EPSS
SaveExploits0
Hacker One
Hacker One
added 2022/09/28 2:45 p.m.48 views

Yelp: Subdomain Takeover on delivey.yelp.com

Summary: Subdomain takeover vulnerabilities occur when a subdomain delivery.yelp.com is pointing to a service Vulnerable url : delivery.yelp.com This is an verify Link. F1959331 Platforms Affected: website Steps To Reproduce 1. Create the Amazon S3 Bucket on this Name : delivery.yelp.com F1959320...

1.7AI score
SaveExploits0
Hacker One
Hacker One
added 2022/07/15 10:52 a.m.48 views

GitHub: Command injection in GitHub Actions ContainerStepHost

GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands wa...

6.5CVSS2.4AI score0.01474EPSS
SaveExploits0
Hacker One
Hacker One
added 2022/05/16 3:19 p.m.48 views

curl: curl "globbing" can lead to denial of service attacks

Summary: add summary of the vulnerability The curl "globbing" allows too much scope, which can cause the server to be denied service or used to attack third-party websites. The globbing allow 1-9999999999999999999 to parse in the url. So when curl request for...

1.2AI score
SaveExploits0
Hacker One
Hacker One
added 2022/05/12 8:9 p.m.48 views

IBM: sql injection via https://setup.p2p.ihost.com/

A SQL Injection against an IBM domain was reported to IBM, analyzed and has been remediated. Thank you to exploitmsf...

1.4AI score
SaveExploits0
Hacker One
Hacker One
added 2022/04/24 6:11 a.m.48 views

Reddit: Reflected xss in https://sh.reddit.com

Summary: Reflected cross-site scripting or XSS arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way. Impact: attacker can execute malicious java script and steal cookies Steps To Reproduce: add details for how we can...

1AI score
SaveExploits0
Hacker One
Hacker One
added 2022/04/17 3:11 a.m.48 views

curl: curl proceeds with unsafe connections when -K file can't be read

Summary: I'm using curl 7.82.0 on Linux. When the file specified by the -K option can't be read, curl sends network traffic as specified by the other options that are explicitly included on the command line in other words, there's only a warning and I'd like it to be a fatal error. This behavior...

7AI score
SaveExploits0
Hacker One
Hacker One
added 2022/04/09 7:56 p.m.48 views

SMTP2GO BBP: Origin IP found, WAF Cloudflare Bypass

Description: I have discovered that the http://172.105.190.180/login/ site exposed it's IP which could allow bypassing of anti-DDoS mechanisms i.e you are using Cloudflare for protection. For Originate IP address which I found from https://search.censys.io/ By using these IP address as a resolver...

6.7AI score
SaveExploits0
Hacker One
Hacker One
added 2022/03/05 10:21 p.m.48 views

HackerOne: An attacker can archive and unarchive any structured scope object on HackerOne

Summary: Hello, I have discovered an IDOR vulnerability that allows the scope of any program to be archived. Scopes are used to give information about the valid scopes of a program. For example HackerOne has the following scopes: https://hackerone.com https://api.hackerone.com ... Steps To...

6.7AI score
SaveExploits0
Hacker One
Hacker One
added 2022/02/26 9:5 a.m.48 views

IBM: Public Jenkins instance with /script enabled

An RCE/LFI due to Public Jenkins instance with /script enabled was reported to IBM February 26th, analyzed and has been remediated since March 3rd, 2022. Thank you to Sanjok Karki thesanjok for the finding. RCE/LFI due to Public Jenkins instance with /script enabled...

2AI score
SaveExploits0
Total number of security vulnerabilities5000