fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks.
Node.js disclosed a bug submitted by haxatron1: https://hackerone.com/reports/2037887 [Source]
Permission model bypass by specifying a path traversal sequence in a buffer,
Node.js disclosed a bug submitted by haxatron1: https://hackerone.com/reports/2038134 [Source]
Policy-restricted modules can escalate to higher privileges by impersonating other modules in a policy list using module.constructor.createRequire()
Node.js disclosed a bug submitted by haxatron1: https://hackerone.com/reports/2043807 [Source]
DNS rebinding in –inspect (again) via invalid IP addresses
Node.js disclosed a bug submitted by haxatron1: https://hackerone.com/reports/1574078 [Source]
Node 18 reads openssl.cnf from /home/iojs/build/… upon startup.
Node.js disclosed a bug submitted by msvrmiscovet: https://hackerone.com/reports/1623175 [Source]
Nginx Alias Traversal – babel.bluetab.net
IBM disclosed a bug submitted by dk4trin: https://hackerone.com/reports/2061826 [Source]
IDOR in channel ID leads to customer email disclosure on https://video.ibm.com
IBM disclosed a bug submitted by tusnj: https://hackerone.com/reports/2083270 [Source]
Hackerone All Private Program Name Leaked to Public Via Collaborator OR Attacker can Easily Dump all Private Program Names through Collaborator
HackerOne disclosed a bug submitted by hackit_bharat: https://hackerone.com/reports/2053051 - Bounty: $2500 [Source]
RXSS at image.hackerone.live via the `url` parameter
HackerOne disclosed a bug submitted by todayisnew: https://hackerone.com/reports/2035332 - Bounty: $500 [Source]
Create miscellaneous support ticket on anyone’s account through support@hackerone.com email
HackerOne disclosed a bug submitted by sayaanalam: https://hackerone.com/reports/2001913 [Source]
HackerOne Support System Doesn’t Require Any Authentication May Lead Unauthorized Action
HackerOne disclosed a bug submitted by rafsanzami: https://hackerone.com/reports/2068830 [Source]
[WiiU/Switch] Remote code execution inside the ENL library
Nintendo disclosed a bug submitted by crazy_man123: https://hackerone.com/reports/1541273 [Source]