Yet Another CASB Integration Takeover of Active Integrations
Cloudflare Public Bug Bounty disclosed a bug submitted by suzuka: https://hackerone.com/reports/2094346 - Bounty: $1000 [Source]
CVE-2023-42663: Apache Airflow: Bypass permission verification to view task instances of other dags
Internet Bug Bounty disclosed a bug submitted by balis0ng: https://hackerone.com/reports/2208656 - Bounty: $540 [Source]
Subdomain takeover on one of the subdomain under mozgcp.net
Mozilla Core Services disclosed a bug submitted by mikey96: https://hackerone.com/reports/2140976 [Source]
Subdomain takeover on one of the subdomain under mozgcp.net
Mozilla Core Services disclosed a bug submitted by d0xing: https://hackerone.com/reports/2143408 [Source]
Subdomain takeover on one of the subdomain under mozgcp.net
Mozilla Core Services disclosed a bug submitted by d0xing: https://hackerone.com/reports/2190380 [Source]
Password of talk conversations can be bruteforced
Nextcloud disclosed a bug submitted by nickvergessen: https://hackerone.com/reports/2094473 [Source]
Memcached used as RateLimiter backend is no-op
Nextcloud disclosed a bug submitted by nickvergessen: https://hackerone.com/reports/2110945 [Source]
CSRF + XSS REFLECT
Daimler Truck disclosed a bug submitted by 1smael0liveira: https://hackerone.com/reports/2050122 [Source]
Bypass R2 payment screen
Cloudflare Public Bug Bounty disclosed a bug submitted by hacker_t_dog: https://hackerone.com/reports/2170559 - Bounty: $350 [Source]
YAML schema injection risk in Swagger UI via schema_url parameter at developers.cloudflare.com
Cloudflare Public Bug Bounty disclosed a bug submitted by aliend89: https://hackerone.com/reports/2174818 [Source]
Cross-Site Request Forgery
ownCloud disclosed a bug submitted by pascal_geuter: https://hackerone.com/reports/2041007 [Source]
Google Docs link in JS files allows editing & reading survey information
HackerOne disclosed a bug submitted by bebiks: https://hackerone.com/reports/2180521 - Bounty: $2500 [Source]
Get to know our new Head of Hackers: @r0adrunn3r!
We’re thrilled to introduce our new Head of Hackers, Soti Giannitsari! In her previous role as Head of Community at HackTheBox, Soti played a pivotal role in expanding one of the world’s largest Capture The Flag (CTF) communities, interacting with hackers on a daily basis. As she joins Intigriti, Soti...
Bug bounty ROI: Can investing in crowdsourced security help mitigate costly security breaches?
Factoring in whether to include a bug bounty program in your annual cybersecurity budget can be confusing. It’s not often clear exactly what benefits you’ll reap until the program is up and running and while you might know that bug bounty can offer serious security rewards, you might want to...
Bug Bytes #216 – SQL injections, Android XSS and Writing Quality Reports
Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The second series is curated by InsiderPhD. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources. This issue covers the week from October 23rd to October 29th...