I found some api keys in js files ,huge leak of token addresses and huge amount of js files are not forbidden
AMBER AI disclosed a bug submitted by orange_h: https://hackerone.com/reports/1787121 [Source]
potential denial of service attack via the locale parameter
Internet Bug Bounty disclosed a bug submitted by benjaoming_realone: https://hackerone.com/reports/1746098 - Bounty: $2400 [Source]
WordPress users Disclosure [ /wp-json/wp/v2/users/ ]
MTN Group disclosed a bug submitted by shubham_srt: https://hackerone.com/reports/1735586 [Source]
Exception logging in Sharepoint app reveals clear-text connection details
Nextcloud disclosed a bug submitted by kichernde_erbse: https://hackerone.com/reports/1652903 [Source]
CVE-2022-42915: HTTP proxy double-free
curl disclosed a bug submitted by bagder: https://hackerone.com/reports/1722065 [Source]
CVE-2022-32221: POST following PUT confusion
curl disclosed a bug submitted by robbotic: https://hackerone.com/reports/1704017 [Source]
Profile of disabled user stays accessible
Nextcloud disclosed a bug submitted by mikaelgundersen: https://hackerone.com/reports/1675014 - Bounty: $100 [Source]
Database resource exhaustion for logged-in users via sharee recommendations with circles
Nextcloud disclosed a bug submitted by michag86: https://hackerone.com/reports/1688199 - Bounty: $250 [Source]
SSRF mitigation bypass using DNS Rebind attack
Concrete CMS disclosed a bug submitted by adrian_t: https://hackerone.com/reports/1369312 [Source]
open redirect to a remote website which can phish users
Concrete CMS disclosed a bug submitted by adrian_t: https://hackerone.com/reports/1397804 [Source]
SSRF – pivoting in the private LAN
Concrete CMS disclosed a bug submitted by adrian_t: https://hackerone.com/reports/1364797 [Source]
XSS in Desktop Client in call notification popup
Nextcloud disclosed a bug submitted by mikeisastar: https://hackerone.com/reports/1711847 [Source]
XSS in Desktop Client via user status and information
Nextcloud disclosed a bug submitted by mikeisastar: https://hackerone.com/reports/1707977 [Source]
XSS in Desktop Client in the notifications
Nextcloud disclosed a bug submitted by mikeisastar: https://hackerone.com/reports/1668028 - Bounty: $750 [Source]
CGI::Cookie
Ruby disclosed a bug submitted by htokumaru: https://hackerone.com/reports/1204977 [Source]
RubyCGIHTTPHTTP
Ruby disclosed a bug submitted by htokumaru: https://hackerone.com/reports/1204695 [Source]
DoS via Playbook
Mattermost disclosed a bug submitted by vultza: https://hackerone.com/reports/1685979 - Bounty: $300 [Source]
DoS via Automatic Response Message
Mattermost disclosed a bug submitted by vultza: https://hackerone.com/reports/1680241 - Bounty: $300 [Source]
Support Portal Takeover via Leaked API KEY
AMBER AI disclosed a bug submitted by khizer47: https://hackerone.com/reports/1766228 - Bounty: $1500 [Source]
Scaling security automation with Docker
The post Scaling security automation with Docker appeared first on Detectify Labs. [Source]
Why you should consider running a live hacking event
Group hacking is a collaborative and creative sport. Organize it as a live hacking event with in-person attendees and you’ll get incredible synergy. Security researchers really thrive when they come together to give their all testing assets and systems for cybersecurity vulnerabilities during a set period of time. At Intigriti,...