Unreleased Hackerone Copilot is vulnerable to IDOR
HackerOne disclosed a bug submitted by bebiks: https://hackerone.com/reports/2218334 - Bounty: $2500 [Source]
Code inject via nginx.ingress.kubernetes.io/permanent-redirect annotation
Kubernetes disclosed a bug submitted by jkroepke: https://hackerone.com/reports/2039464 - Bounty: $2500 [Source]
Improper Access Control allows OTP bypass
Lark Technologies disclosed a bug submitted by kongwenbin: https://hackerone.com/reports/1948506 [Source]
Search input is vulnerable for XSS in qa.td.com and dev.td.com
TD Bank disclosed a bug submitted by allenshaji: https://hackerone.com/reports/1861545 [Source]
Accessing apps protected via ZT’s Access when user account is deleted/disabled even after clearing user session/seat
Cloudflare Public Bug Bounty disclosed a bug submitted by suzuka: https://hackerone.com/reports/2122690 - Bounty: $1000 [Source]
New Search Feature: Search for non-public words in limited disclosure reports
HackerOne disclosed a bug submitted by ahacker1: https://hackerone.com/reports/2213251 [Source]
Blind SSRF on https://my.exnessaffiliates.com/ allows for internal network enumeration
EXNESS disclosed a bug submitted by null_hypothesis: https://hackerone.com/reports/1832494 - Bounty: $2000 [Source]
Bug Bytes #215 – Hackers in Lisbon, AI bug bounty and is this the end?
Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The second series is curated by InsiderPhD. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources. This issue covers the week from October 15th to October 22nd...