An Attacker Can Flag Draft Job Posts And Can Disclose The Draft Job Posts Details [ Similar to #1581528 Resolved Report]
LinkedIn disclosed a bug submitted by tushar6378: https://hackerone.com/reports/1675674 [Source]
Attackers can use TRIAL Premium only by paying **IDR 10,000.00** from the original price of `IDR462,400.00` per month
LinkedIn disclosed a bug submitted by find_me_here: https://hackerone.com/reports/1808719 [Source]
A Unverified User Can Post Newsletter (Which Is Not Allowed Through Application UI)
LinkedIn disclosed a bug submitted by tushar6378: https://hackerone.com/reports/1691603 [Source]
IDOR allows an attacker to delete anyone’s featured photo.
LinkedIn disclosed a bug submitted by adilnbabras: https://hackerone.com/reports/1608735 [Source]
Improper access control on Linkedin Page
LinkedIn disclosed a bug submitted by cybergoddess: https://hackerone.com/reports/1587246 [Source]
Complete Admin account takeover due to PhpDebugBar turned on in Uber’s production server
Uber disclosed a bug submitted by lalit2020: https://hackerone.com/reports/1883806 - Bounty: $2750 [Source]
Issuer not verified from obtained token in user_oidc
Nextcloud disclosed a bug submitted by rullzer: https://hackerone.com/reports/2021684 - Bounty: $250 [Source]
App stores client secret unencrypted in database
Nextcloud disclosed a bug submitted by rullzer: https://hackerone.com/reports/1994328 [Source]
Text does not respect ‘Allow download’ permissions
Nextcloud disclosed a bug submitted by rullzer: https://hackerone.com/reports/1965156 [Source]
Bug Bytes #209 – The only graphQL wordlist you need, ML bug hunting and VDP submissions
Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The second series is curated by InsiderPhD. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources. This issue covers the week from August 14th – August 20th...