Ability to join an arbitrary workspace by utilizing a proxy to manipulate invite links
Slack disclosed a bug submitted by salh4ckr: https://hackerone.com/reports/1716016 - Bounty: $10000 [Source]
External service interaction ( DNS and HTTP ) in www.
U.S. Dept Of Defense disclosed a bug submitted by 0xmzm: https://hackerone.com/reports/1704024 [Source]
Docker Registry without authentication leads to docker images download
U.S. Dept Of Defense disclosed a bug submitted by samuelsiv: https://hackerone.com/reports/1989884 [Source]
IDOR ‘ can delete any animal from other account ‘ at https://www.miroyalcanin.cl/
Mars disclosed a bug submitted by 0xs4m: https://hackerone.com/reports/1947376 [Source]
Stored XSS via ‘ profile ‘ at https://www.miroyalcanin.cl/
Mars disclosed a bug submitted by 0xs4m: https://hackerone.com/reports/1921606 [Source]
CRLF Inection at `banfieldassets.com`
Mars disclosed a bug submitted by ze2paac: https://hackerone.com/reports/1943013 [Source]
Information Exposure Through Directory Listing
Mars disclosed a bug submitted by ze2paac: https://hackerone.com/reports/1948562 [Source]
‘ Full Account Takeover ‘ at https://www.miroyalcanin.cl/
Mars disclosed a bug submitted by 0xs4m: https://hackerone.com/reports/1959540 [Source]
IDOR ‘ can change any account email and cannot retrieve his account and access it ‘ at https://www.miroyalcanin.cl/
Mars disclosed a bug submitted by 0xs4m: https://hackerone.com/reports/1952771 [Source]
user_oidc app is missing bruteforce protection
Nextcloud disclosed a bug submitted by nickvergessen: https://hackerone.com/reports/1954711 [Source]