Lucene search
+L
HackeroneMost viewed

15402 matches found

Hacker One
Hacker One
added 2016/06/27 2:12 a.m.45 views

Coinbase: Application error message

poc url:https://developers.coinbase.com/api/%e3h This page contains an error/warning message that may disclose sensitive information.The message can also contain the location of the file that produced the unhandled exception.This may be a false positive if the error message is found in...

6.8AI score
SaveExploits0
Hacker One
Hacker One
added 2016/05/26 5:34 a.m.45 views

drchrono: SSL/TLS BEAST ATTACK

Supported versions: TLSv1.0 TLSv1.1 TLSv1.2 Deflate compression: no Supported cipher suites ORDER IS NOT SIGNIFICANT: TLSv1.0 RSAWITH3DESEDECBCSHA RSAWITHAES128CBCSHA RSAWITHAES256CBCSHA TLSECDHERSAWITH3DESEDECBCSHA TLSECDHERSAWITHAES128CBCSHA TLSECDHERSAWITHAES256CBCSHA TLSv1.1: idem TLSv1.2...

3.1AI score
SaveExploits0
Hacker One
Hacker One
added 2016/05/12 12:11 p.m.45 views

Zomato: Instagram OAuth2 Implementation Leaks Access Token; Allows for Cross-Site Script Inclusion (XSSI)

Once a user connects his Zomato account to Instagram via OAuth2, the page https://www.zomato.com/php/instagramtagrelay leaks the Instagram OAuth2 Access Token issued to Zomato: PoC: https://www.zomato.com/php/instagramtagrelay?callback=aaabc Result personal data x'ed: HTTP/1.1 200 OK...

0.7AI score
SaveExploits0
Hacker One
Hacker One
added 2016/04/26 6:34 a.m.45 views

Automattic: WordPress Flash XSS in *flashmediaelement.swf*

Intro == WordPress is vulnerable against a reflected XSS that stems from an insecure URL sanitization problem performed in the file flashmediaelement.swf. The code in the file attempts to remove flashVars ¹ in case they have been set GET parameters but fails to do so, enabling XSS via...

6.1AI score
SaveExploits0
Hacker One
Hacker One
added 2016/04/01 7:4 p.m.45 views

HackerOne: New hacktivity view discloses report IDs of non-public reports

url: https://hackerone.com/hacktivity.json this url reveals information of reporters Report id ./...

0.5AI score
SaveExploits0
Hacker One
Hacker One
added 2016/03/16 4:52 a.m.45 views

Veris: Security Vulnerability - SMTP protection not used

Hi, I'm checking your website found SPF record there. You should apply strict SMPT policy to stop spoofed email sending from your domain. An attacker would send a Fake email from [email protected] saying that Please change your password, The victim is aware of phishing attacks, But when he sees...

7AI score
SaveExploits0
Hacker One
Hacker One
added 2016/03/01 7:4 p.m.45 views

Pornhub: Unprotected Memcache Installation running

The consultant was able to connect to the stage.pornhub.com subdomain via port 60893, it was determined that the target host was running memcached and required no authentication...

2.2AI score
SaveExploits0
Hacker One
Hacker One
added 2016/02/28 6:54 a.m.45 views

Uber: Open Redirection on Uber.com

There seems to be an open redirection on Uber.com When a user uses https://www.uber.com//google.com/cities it will lead to a Page Not Found on the Uber website but if the google.com is changed to an IP address such as https://www.uber.com//216.58.217.206/param it will lead to either a 404 or an S...

6.9AI score
SaveExploits0
Hacker One
Hacker One
added 2016/02/07 8:17 p.m.45 views

Zomato: XSS and CSRF in Zomato Contact form

URL affected:-- https://www.zomato.com/contact CSRF Payload:-- Step to Reproduce:---- 1I have tested it after Login and without Login .This CSRF worked with executing XSS due to CSRF in Contact form.It is tested in Latest Firefox browser. 2Just run the above payload and you will find below image...

6.1AI score
SaveExploits0
Hacker One
Hacker One
added 2016/01/16 11:32 a.m.45 views

withinsecurity: Content Spoofing OR Text Injection in https://withinsecurity.com

Hi, I just found Content Spoofing OR Text-based injection vulnerability in https://withinsecurity.com site that would like to get fixed, Below are the POC and steps to reproduced an issue. 1 Go to https://withinsecurity.com this site 2 Then just changed above url like this...

7AI score
SaveExploits0
Hacker One
Hacker One
added 2016/01/11 2:12 a.m.45 views

Udemy: CSRF in Udemy.com

The investigator removed cookies that are not used by our site and thought he had found a bypass. We were greatly delayed in getting this response to him...

6.7AI score
SaveExploits0
Hacker One
Hacker One
added 2015/11/24 12:31 a.m.45 views

Radancy: RC4 cipher suites detected

A group of researchers Nadhem AlFardan, Dan Bernstein, Kenny Paterson, Bertram Poettering and Jacob Schuldt have found new attacks against TLS that allows an attacker to recover a limited amount of plaintext from a TLS connection when RC4 encryption is used. The attacks arise from statistical fla...

0.4AI score
SaveExploits0
Hacker One
Hacker One
added 2015/11/20 1:8 p.m.45 views

Shopify: CSV Excel Macro Injection Vulnerability in export list of current users - app.shopify.com

Hi , I have found that when a user tries to Export list of current users who installed his apps through: https://app.shopify.com/services/partners/apiclients//exportinstalledusers the fields of the CSV file are not properly escaped. which makes them vulnerable to CSV Excel Macro Injection...

0.6AI score
SaveExploits0
Hacker One
Hacker One
added 2015/10/19 4:0 p.m.45 views

Whisper: SMS Invite Form Abuse

whisper.sh fails to protect the invite form from abuse from attackers. If a malicious individual wants to abuse this functionality, they could send repeated/automated requests to the same phone number or range of phone numbers that do no actually belong to himself. This would result in lots of...

0.9AI score
SaveExploits0
Hacker One
Hacker One
added 2015/06/09 7:20 p.m.45 views

Internet Bug Bounty: Misusing of FPU Instruction Could Cause Security Vulnerabilities in Adobe Flash Player

Misusing of FPU Instruction Could Cause Security Vulnerabilities in Adobe Flash Player This vulnerability CVE-2015-3100 was reported to Adobe on March 10, 2015 and has been patched today via APSB15-11 https://helpx.adobe.com/security/products/flash-player/apsb15-11.html. Following is the original...

10CVSS6.8AI score0.07715EPSS
SaveExploits0
Hacker One
Hacker One
added 2015/05/12 7:27 p.m.45 views

Sandbox Escape: Internet Explorer Enhanced Protected Mode sandbox escape via a broker vulnerability

Internet Explorer Enhanced Protected Mode sandbox escape via a broker vulnerability =================================================================================== Full source code demonstrating the escape from IE's sandbox -- by launching a medium-integrity calc at login -- is attached with...

7.1AI score
SaveExploits0
Hacker One
Hacker One
added 2015/05/05 9:25 a.m.45 views

Concrete CMS: Local File Inclusion Vulnerability in Concrete5 version 5.7.3.1

Concrete5 is vulnerable to a Local File Inclusion because it fails to properly validate the path for incoming requests during the dispatching process. This vulnerability exists because the path is retrieved using the Request::getPathInfo method from the Symfony framework, which allows to specify...

6.8AI score
SaveExploits0
Hacker One
Hacker One
added 2015/05/05 9:24 a.m.45 views

Concrete CMS: SQL Injection Vulnerability in Concrete5 version 5.7.3.1

Concrete5 is vulnerable to a SQL Injection attack because certain user input is being used to construct a SQL query without proper validation. This vulnerability can be exploited only by authenticated users with privileges to edit page permissions...

7.7AI score
SaveExploits0
Hacker One
Hacker One
added 2015/02/06 11:8 p.m.45 views

Vimeo: subdomain takeover 1511493148.cloud.vimeo.com

The researcher found a DNS entry pointing to an unused IP address. This was a domain hijacking issue and was resolved by removing the DNS entry...

1.3AI score
SaveExploits0
Hacker One
Hacker One
added 2014/05/02 1:24 a.m.45 views

Coinbase: CSRF on "Set as primary" option on the accounts page

On navigating to the Accounts page, a Coinbase user can create multiple accounts. The user can then make any of these accounts as their primary account. There are also other options of renaming and deleting these accounts. Although there is a CSRF token being sent as a POST parameter for the dele...

6.9AI score
SaveExploits0
Hacker One
Hacker One
added 2014/04/21 7:45 p.m.45 views

Cloudflare: Content spoofing /CSRF at https://www.cloudflare.com/ajax/modal-dialog.html

Hi there, I noticed two things on the following url: https://www.cloudflare.com/ajax/modal-dialog.html 1. CSRF There are some csrf countermeasures in place e.g. X-Requested-With: XMLHttpRequest, however they're not validated on the server. This leads to an uncritical csrf: 2. Content spoofing Usi...

6.7AI score
SaveExploits0
Hacker One
Hacker One
added 2014/04/17 8:6 p.m.45 views

Localize: Server header - information disclosure

X-Powered-By: PleskLin HTTP/1.1 200 OK Date: Thu, 17 Apr 2014 19:52:33 GMT Server: Apache Pragma: no-cache Expires: Mon, 24 Mar 2008 00:00:00 GMT Cache-Control: no-cache X-Powered-By: PleskLin Vary: Accept-Encoding Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html;...

0.6AI score
SaveExploits0
Hacker One
Hacker One
added 2014/04/12 4:54 p.m.45 views

IRCCloud: Host Header is not validated resulting in Open Redirect

Please see the attached screenshot where I am sending a request to irccloud.com with an invalid HOST header and I am getting redirected to that domain. This is because the HOST header is not validated to ensure that the request is originating from that target host or not...

1AI score
SaveExploits0
Hacker One
Hacker One
added 2014/04/07 3:45 p.m.45 views

Yahoo!: reflected XSS, http://extprodweb11.cc.gq1.yahoo.com/, 4/8/14, #SpringClean

Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...

6.7AI score
SaveExploits0
Hacker One
Hacker One
added 2014/04/02 9:42 p.m.45 views

C2FO: Password reset token leakage through referrer at https://app.c2fo.com/password/reset/

Hi there, another bug I came across. There's a possible password reset token leakage on the password reset page. Steps to reproduce 1. Go to https://app.c2fo.com/password-reset and request a new password with your existing test account 2. Click on the password reset link which you'll receive via...

7.1AI score
SaveExploits0
Hacker One
Hacker One
added 2014/03/26 10:36 a.m.45 views

Yahoo!: From Unrestricted File Upload to Remote Command Execution

Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...

6.7AI score
SaveExploits0
Hacker One
Hacker One
added 2014/03/25 7:2 p.m.45 views

Concrete CMS: XSS in Theme Preview Tools File

https://github.com/concrete5/concrete5/blob/master/web/concrete/tools/themes/preview.phpL7 Note that one of those values near the end is not escaped...

6.9AI score
SaveExploits0
Hacker One
Hacker One
added 2014/03/22 6:15 a.m.45 views

Slack: Open Redirect in Slack

This link shall redirect to google.co.in: http://prakhar.slack.com/link?url=http%3A%2F%2Fgoogle.co.in Straight, open redirection! Thanks!...

SaveExploits0
Hacker One
Hacker One
added 2026/06/22 3:21 p.m.44 views

Node.js: Node --run POSIX positional argument escaping allows shell command injection

Summary Node.js node --run -- attempts to append positional arguments to a package script after escaping each argument for the shell. On POSIX platforms, the escaping logic handles single quotes incorrectly. A positional argument containing a single quote can break out of the intended quoted...

6.8AI score
SaveExploits0
Hacker One
Hacker One
added 2024/07/11 4:44 p.m.44 views

U.S. Dept Of Defense: Blind Sql Injection in https://████

A SQL injection vulnerability was discovered in the User-Agent parameter of the website "https://██████████/". The vulnerability allowed an attacker to inject SQL commands through the User-Agent HTTP header...

8.2AI score
SaveExploits0
Hacker One
Hacker One
added 2024/04/30 7:6 a.m.44 views

HackerOne: [IDOR] Improper Access Control on Embedded Submission Form

The researcher discovered an improper access control vulnerability that allowed them to access sensitive program information for private/inactive embedded submission forms by leveraging the form's UUID. The researcher used reconnaissance techniques to obtain a list of UUIDs for various private...

6.6AI score
SaveExploits0
Hacker One
Hacker One
added 2024/03/26 4:32 p.m.44 views

U.S. Dept Of Defense: Reflected Cross-site Scripting via search query on ██████

The summary is as follows: A reflected cross-site scripting vulnerability was discovered in the search query functionality of the ████████ website. An attacker could execute arbitrary JavaScript code in the victim's browser by injecting malicious payload into the search query parameter...

6.8AI score
SaveExploits0
Hacker One
Hacker One
added 2024/01/10 7:10 a.m.44 views

HackerOne: New Hacktivity features:Bounty rewards leakage Where programs doesn’t decide to disclose bounty in limited disclosure report

The report describes a vulnerability where users could access hidden bounty information on the HackerOne Hacktivity page. Specifically, by using a filter to search for reports with a specific total awarded amount, the actual bounty amount was revealed, even if the program chose to limit the...

6.5AI score
SaveExploits0
Hacker One
Hacker One
added 2024/01/08 5:33 p.m.44 views

Mars: Datadog api keys exposed can be used to do all the read and write access to the instance

A vulnerability was identified where Datadog API keys were exposed in a JavaScript file, which could have enabled unauthorized access to Datadog services. The issue was responsibly disclosed along with a proof-of-concept demonstration...

7AI score
SaveExploits0
Hacker One
Hacker One
added 2023/12/04 6:2 a.m.44 views

Internet Bug Bounty: ASAR Integrity bypass via filetype confusion

A vulnerability was discovered in Electron that allowed bypassing ASAR integrity checks via filetype confusion. Maliciously crafted directories could trick apps into loading non-validated code. This impacted apps with certain fuses enabled on macOS that relied on filesystem protections. The issue...

7CVSS6.5AI score0.00207EPSS
SaveExploits0
Hacker One
Hacker One
added 2023/11/09 8:35 a.m.44 views

Nextcloud: App PIN code can be bypassed in Files iOS

A vulnerability was discovered in the PIN code implementation of the Files iOS app version 4.9.1 that allowed an attacker to bypass the PIN code protection via brute force due to lack of rate limiting, enabling unauthorized access to the app...

4.3CVSS4.3AI score0.00288EPSS
SaveExploits0
Hacker One
Hacker One
added 2023/10/05 6:29 a.m.44 views

Mozilla: Subdomain takeover on one of the subdomain under mozaws.net

Vulnerability description not provided...

7.1AI score
SaveExploits0
Hacker One
Hacker One
added 2023/09/06 4:53 p.m.44 views

Internet Bug Bounty: Context isolation bypass via nested unserializable return value

A vulnerability was discovered in Electron that allowed for a bypass of context isolation. This meant that code running in the main world context in the renderer could access the isolated Electron context and perform privileged actions. The vulnerability was fixed in versions 25.0.0-alpha.2,...

8.5CVSS6.9AI score0.0049EPSS
SaveExploits0
Hacker One
Hacker One
added 2023/08/08 12:28 p.m.44 views

HackerOne: Able to see Bonus amount given to a report even if the bounty and Bonus is not visible to public or mentioned in {Report-Id}.json

A vulnerability allowed users to see the bonus amount given to a report, even if the bounty and bonus were not visible to the public or mentioned in the report's JSON file. This resulted in the exposure of confidential information...

6.9AI score
SaveExploits0
Hacker One
Hacker One
added 2023/07/12 5:33 p.m.44 views

Sorare: Operation CreateOrUpdateSo5LineupMutation does not restrict multiple captains

The CreateOrUpdateSo5LineupMutation operation in the Sorare API allowed users to set multiple captains for a football team, which violated the game logic of having only one captain. This vulnerability could be exploited to gain an unfair advantage over other players...

7.1AI score
SaveExploits0
Hacker One
Hacker One
added 2023/04/27 8:51 a.m.44 views

Omise: Subdomain takeover http://accessday.opn.ooo/

Vulnerability description not provided...

7.1AI score
SaveExploits0
Hacker One
Hacker One
added 2023/01/29 4:35 p.m.44 views

Nextcloud: Chat room member disclosure via autocomplete API

It was possible to find out who is in a Spreed chat room using the autocomplete API, even if the person is not a member of the room. This vulnerability could have been exploited to gain information about the members of a chat room for malicious purposes...

3.5CVSS3.9AI score0.00445EPSS
SaveExploits0
Hacker One
Hacker One
added 2023/01/14 6:46 a.m.44 views

Brave Software: S3 Bucket Takeover "brave-browser-rpm-staging-release-test"

An unclaimed S3 bucket was found on the domain hosting services of brave.com, which could have been taken over by an attacker to spread malware using the keyrings of the brave browser. The bucket was used to get keyrings of the browser in Linux distros, and it was pointing towards an unclaimed S3...

7.1AI score
SaveExploits0
Hacker One
Hacker One
added 2022/11/08 8:5 p.m.44 views

Nextcloud: Exposed Log File Lead to Full Internal path disclosure at [https://nextcloud.com/wp-content/debug.log]

Hi team , i found wp-content/debug.log endpoint public accessible That lead to full path disclosure Steps : Open : https://nextcloud.com/wp-content/debug.log You can See Internal paths disclosed and date is : 02-Nov-2022 02-Nov-2022 08:50:36 UTC PHP Fatal error: Uncaught Error: Call to undefined...

SaveExploits0
Hacker One
Hacker One
added 2022/10/12 5:32 p.m.44 views

GitHub: Github app Privilege Escalation to Administrator/Owner of the Organization

Vulnerability description not provided...

7.2CVSS6.9AI score0.01097EPSS
SaveExploits0
Hacker One
Hacker One
added 2022/05/27 10:17 a.m.44 views

Reddit: Misconfigurated login page able to lock login action for any account without user interaction

Summary While observing a few things about the login feature, I found that the account was locked after a certain number of requests. Although this feature is actually added to prevent problems such as rate limit, it is open to account lock attacks by attackers. PoC 1. Save this code as exploit.p...

7AI score
SaveExploits0
Hacker One
Hacker One
added 2022/05/24 12:53 p.m.44 views

Nextcloud: Ownership check missing when updating or deleting attachments

Summary: Ownership check is missing for attachments. Steps To Reproduce: 1. Open mail app 2. Compose a new message 3. Attach some file 4. Send message 5. Copy the xhr request and modify the attachment ids 6. See that localmessageid is changed for a different user When you compose a message and pu...

4CVSS2.2AI score0.0074EPSS
SaveExploits1
Hacker One
Hacker One
added 2022/05/23 8:44 p.m.44 views

GitHub Security Lab: [Java]: Flow sources and steps for JMS and RabbitMQ

This bug was reported directly to GitHub Security Lab...

2AI score
SaveExploits0
Hacker One
Hacker One
added 2022/05/06 11:0 a.m.44 views

TikTok: disclosure the live_analytics information of any livestream.

A possible disclosure of the liveanalytics information for any livestream was found by accessing the roomid parameter via devtools. We thank @datph4m for reporting this to our team...

2.3AI score
SaveExploits0
Hacker One
Hacker One
added 2022/04/17 7:52 p.m.44 views

TikTok: CSRF protection bypass on TikTok Webcast Endpoints

Vulnerability description not provided...

7.1AI score
SaveExploits0
Total number of security vulnerabilities5000