Bug Bounty News Feed Archives - Page 3 of 36

jazz.net – publicly accessible .svn repositories

IBM disclosed a bug submitted by cyber_punk: https://hackerone.com/reports/2398335 [Source]

Unauthenticated arbitrary file upload on the https:/// ()

U.S. Dept Of Defense disclosed a bug submitted by sp1d3rs: https://hackerone.com/reports/698789 [Source]

Blind Stored XSS on the internal host –

U.S. Dept Of Defense disclosed a bug submitted by sp1d3rs: https://hackerone.com/reports/923912 [Source]

DoD workstation exposed to internet via TinyPilot KVM with no authentication

U.S. Dept Of Defense disclosed a bug submitted by socpuppet: https://hackerone.com/reports/2633988 [Source]

moderate: Apache HTTP Server: mod_rewrite proxy handler substitution (CVE-2024-39573) CWE-20 Improper Input Validation

Internet Bug Bounty disclosed a bug submitted by orange: https://hackerone.com/reports/2585374 - Bounty: $2600 [Source]

Subdomain takeover in GitLab Pages [george.ratelimited.me]

RATELIMITED disclosed a bug submitted by fdeleite: https://hackerone.com/reports/2523677 [Source]

Guest Privilege Escalation to admin group

Rocket.Chat disclosed a bug submitted by gronke: https://hackerone.com/reports/501081 [Source]

XSS via /api/v1/chat.postMessage

Rocket.Chat disclosed a bug submitted by gronke: https://hackerone.com/reports/219957 [Source]

Online Status of arbitrary users can be changed

Rocket.Chat disclosed a bug submitted by gronke: https://hackerone.com/reports/501077 [Source]

Upload of Avatars for other Users

Rocket.Chat disclosed a bug submitted by gronke: https://hackerone.com/reports/501084 [Source]

CSS Injection in Message Avatar

Rocket.Chat disclosed a bug submitted by gronke: https://hackerone.com/reports/1031613 [Source]

Unauthenticated clients can modify Livechat Business Hours

Rocket.Chat disclosed a bug submitted by gronke: https://hackerone.com/reports/1063164 [Source]

Registration bypass with leaked Invite Token

Rocket.Chat disclosed a bug submitted by gronke: https://hackerone.com/reports/1071102 [Source]

Unread Messages can leak Message IDs

Rocket.Chat disclosed a bug submitted by gronke: https://hackerone.com/reports/1063114 [Source]

User Impersonation through sendMessage options

Rocket.Chat disclosed a bug submitted by gronke: https://hackerone.com/reports/1031525 [Source]

Improper ACL in Message Starring

Rocket.Chat disclosed a bug submitted by gronke: https://hackerone.com/reports/1060837 [Source]

Content-Security Policy bypass with File Uploads

Rocket.Chat disclosed a bug submitted by gronke: https://hackerone.com/reports/1380157 [Source]

Impersonation in Sequential Messages

Rocket.Chat disclosed a bug submitted by gronke: https://hackerone.com/reports/1379645 [Source]

Authentication Bypass in login-token Authentication Method

Rocket.Chat disclosed a bug submitted by gronke: https://hackerone.com/reports/1447619 [Source]

Pinning leaks message content

Rocket.Chat disclosed a bug submitted by gronke: https://hackerone.com/reports/1062538 [Source]

XSS in various MessageTypes

Rocket.Chat disclosed a bug submitted by gronke: https://hackerone.com/reports/1379400 [Source]

Bypassing 2FA with conventional session management – open.rocket.chat

Rocket.Chat disclosed a bug submitted by hackeriron1: https://hackerone.com/reports/1701378 [Source]

IDOR lets a malicious user reveal the unpinned achievement badges of any Reddit user

Reddit disclosed a bug submitted by saurabhb: https://hackerone.com/reports/2618486 [Source]

Leaking usernames through endpoints WordPress

MTN Group disclosed a bug submitted by alitoni224: https://hackerone.com/reports/1785021 [Source]

Permissions can be bypassed via arbitrary code execution through abusing libuv signal pipes

Node.js disclosed a bug submitted by xion: https://hackerone.com/reports/2260337 [Source]

Possible Subdomain Takeover For Inbound Emails

Smule disclosed a bug submitted by cryptic_: https://hackerone.com/reports/2567048 [Source]

https://srcds.valve.net/find/ is leaking server config / API keys

Valve disclosed a bug submitted by njbooher: https://hackerone.com/reports/1168557 [Source]

Unauthenticated full-read SSRF via Twilio integration

Rocket.Chat disclosed a bug submitted by mokusou: https://hackerone.com/reports/1886954 [Source]

CVE-2024-7264: ASN.1 date parser overread

curl disclosed a bug submitted by dubek: https://hackerone.com/reports/2629968 [Source]

Access body and title of Internal Repo Issues in Projects

GitHub disclosed a bug submitted by ahacker1: https://hackerone.com/reports/2501036 - Bounty: $4000 [Source]

Shell command injection in https://partner.steamgames.com/admin/game/publish/ via screenshot URL

Valve disclosed a bug submitted by njbooher: https://hackerone.com/reports/949361 [Source]

Add any depot to your app and access its contents without decryption key; via /apps/setcommonredists

Valve disclosed a bug submitted by njbooher: https://hackerone.com/reports/1018368 [Source]

GitHub Apps can access suspended installations via scoped user-to-server tokens

GitHub disclosed a bug submitted by ahacker1: https://hackerone.com/reports/2484635 - Bounty: $4000 [Source]

SQL injection in /errors/viewbuild/

Valve disclosed a bug submitted by njbooher: https://hackerone.com/reports/690349 [Source]

Shell command injection in https://partner.steamgames.com/apps/communityitems/ via file extension of item_image_small and item_image_large

Valve disclosed a bug submitted by njbooher: https://hackerone.com/reports/840243 [Source]