Bug Bounty News Feed Archives - BugBountyBlog.com

Potential IP revealing using UNC Path in Windows File Picker

Tor disclosed a bug submitted by newfunction: https://hackerone.com/reports/376004 [Source]

SQL Injection in parameter REPORT

Tor disclosed a bug submitted by wiloos: https://hackerone.com/reports/269347 [Source]

Zip bomb

Tor disclosed a bug submitted by zerx: https://hackerone.com/reports/263663 [Source]

Use of unitialized value in crypto_pk_num_bits (src/common/crypto.c:971)

Tor disclosed a bug submitted by geeknik: https://hackerone.com/reports/274998 [Source]

solving TOR vulnerability, in other to make bruteforce difficult

Tor disclosed a bug submitted by joelisto: https://hackerone.com/reports/268320 [Source]

[rt.torproject.org] No Rate Limitting on Login Form

Tor disclosed a bug submitted by 0xspade: https://hackerone.com/reports/265706 [Source]

Report Regarding Security Vulnerability

Tor disclosed a bug submitted by srkfan: https://hackerone.com/reports/269243 [Source]

Multiple Path Transversal Vulnerabilites

Tor disclosed a bug submitted by myselfphoton: https://hackerone.com/reports/273377 [Source]

https://get.ooni.torproject.org/

Tor disclosed a bug submitted by ba4fe4ca95021d367f8a574: https://hackerone.com/reports/274285 [Source]

Tor Project – Full Path Disclosure

Tor disclosed a bug submitted by yox: https://hackerone.com/reports/269426 [Source]

Content spoofing on

Tor disclosed a bug submitted by nonamehiiden: https://hackerone.com/reports/273819 [Source]

CSRF to Information disclosure on password reset

Mozilla Critical Services disclosed a bug submitted by hackeriron1: https://hackerone.com/reports/2106662 [Source]

Ingress nginx annotation injection causes arbitrary command execution

Kubernetes disclosed a bug submitted by suanve: https://hackerone.com/reports/1728174 - Bounty: $2500 [Source]

Blind SQL injection on id.indrive.com

inDrive disclosed a bug submitted by kristoferent: https://hackerone.com/reports/2051931 - Bounty: $4134 [Source]

Password Reset Token Leak Via Referrer

Liberapay disclosed a bug submitted by 0xthem7: https://hackerone.com/reports/2133308 [Source]

Bug Bytes #217 – How to Submit Vulnerabilities, Writing a Great WriteUp and 2 years of Bug Bounty

Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The second series is curated by InsiderPhD. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources. This issue covers the weeks from November 6th to November 19th...

Delete external storage of any user

Nextcloud disclosed a bug submitted by cx75fa: https://hackerone.com/reports/2212627 [Source]

user_ldap app logs user passwords in the log file on level debug

Nextcloud disclosed a bug submitted by alacn1: https://hackerone.com/reports/2101165 [Source]

HTML injection in search UI when selecting a circle with HTML in the display name

Nextcloud disclosed a bug submitted by cx75fa: https://hackerone.com/reports/2210038 [Source]

Enabling Birthday Contact to any user

Nextcloud disclosed a bug submitted by nvz: https://hackerone.com/reports/2112973 [Source]

XSS in Cisco Endpoint

U.S. Dept Of Defense disclosed a bug submitted by r00tdaddy: https://hackerone.com/reports/2233421 [Source]

Full account takeover of any user through reset password

U.S. Dept Of Defense disclosed a bug submitted by maskedpersian: https://hackerone.com/reports/2194928 [Source]

Unathenticated file read (CVE-2020-3452)

U.S. Dept Of Defense disclosed a bug submitted by r00tdaddy: https://hackerone.com/reports/2233418 [Source]

Unauthorised CocoaPods Auth via Token Leakage & HTTP Header Injection

Snowplow disclosed a bug submitted by reefspek: https://hackerone.com/reports/2228086 [Source]

subdomain takeover at

Mars disclosed a bug submitted by skoll101: https://hackerone.com/reports/2106886 [Source]

debug.log File Exposure that exposes (user/) username and password at

Mars disclosed a bug submitted by skoll101: https://hackerone.com/reports/2122938 [Source]

Able to see highest poll result without voting or view result

FetLife disclosed a bug submitted by deepblue29: https://hackerone.com/reports/2248116 [Source]

reflected xss in https://wordpress.com/start/account/user

Automattic disclosed a bug submitted by secureighty: https://hackerone.com/reports/2055132 [Source]

”CSRF Vulnerability in Royal Canin Website Allows Attackers to Change User Profile Picture at my.royalcanin.pt”

Mars disclosed a bug submitted by bx00: https://hackerone.com/reports/2144870 [Source]

OAuth2 client_secret stored in plain text in the database

Nextcloud disclosed a bug submitted by rullzer: https://hackerone.com/reports/1994324 - Bounty: $100 [Source]

Buffer overflow and affected url:-https://github.com/curl/curl/blob/master/docs/examples/hsts-preload.c

curl disclosed a bug submitted by cyberguardianrd: https://hackerone.com/reports/2252307 [Source]

CVE-2023-42663: Apache Airflow: Bypass permission verification to view task instances of other dags

Internet Bug Bounty disclosed a bug submitted by balis0ng: https://hackerone.com/reports/2208656 - Bounty: $540 [Source]

Yet Another CASB Integration Takeover of Active Integrations

Cloudflare Public Bug Bounty disclosed a bug submitted by suzuka: https://hackerone.com/reports/2094346 - Bounty: $1000 [Source]

Subdomain takeover on one of the subdomain under mozgcp.net

Mozilla Core Services disclosed a bug submitted by mikey96: https://hackerone.com/reports/2140976 [Source]

Subdomain takeover on one of the subdomain under mozgcp.net

Mozilla Core Services disclosed a bug submitted by d0xing: https://hackerone.com/reports/2143408 [Source]

Password of talk conversations can be bruteforced

Nextcloud disclosed a bug submitted by nickvergessen: https://hackerone.com/reports/2094473 [Source]

Subdomain takeover on one of the subdomain under mozgcp.net

Mozilla Core Services disclosed a bug submitted by d0xing: https://hackerone.com/reports/2190380 [Source]

CSRF + XSS REFLECT

Daimler Truck disclosed a bug submitted by 1smael0liveira: https://hackerone.com/reports/2050122 [Source]

Memcached used as RateLimiter backend is no-op

Nextcloud disclosed a bug submitted by nickvergessen: https://hackerone.com/reports/2110945 [Source]

YAML schema injection risk in Swagger UI via schema_url parameter at developers.cloudflare.com

Cloudflare Public Bug Bounty disclosed a bug submitted by aliend89: https://hackerone.com/reports/2174818 [Source]

Bypass R2 payment screen

Cloudflare Public Bug Bounty disclosed a bug submitted by hacker_t_dog: https://hackerone.com/reports/2170559 - Bounty: $350 [Source]

Cross-Site Request Forgery

ownCloud disclosed a bug submitted by pascal_geuter: https://hackerone.com/reports/2041007 [Source]

Google Docs link in JS files allows editing & reading survey information

HackerOne disclosed a bug submitted by bebiks: https://hackerone.com/reports/2180521 - Bounty: $2500 [Source]

Get to know our new Head of Hackers: @r0adrunn3r!

We’re thrilled to introduce our new Head of Hackers, Soti Giannitsari! In her previous role as Head of Community at HackTheBox, Soti played a pivotal role in expanding one of the world’s largest Capture The Flag (CTF) communities, interacting with hackers on a daily basis. As she joins Intigriti, Soti...

Bug bounty ROI: Can investing in crowdsourced security help mitigate costly security breaches?

Factoring in whether to include a bug bounty program in your annual cybersecurity budget can be confusing. It’s not often clear exactly what benefits you’ll reap until the program is up and running and while you might know that bug bounty can offer serious security rewards, you might want to...