Hackerone Reports

🎯 New Report #3189580: Password Reset Allows Reusing Old Password -- [AUTH-3820](https://hackerone.com/reports/3189580)
🔺Severity: None
👽 Reporter: ka reem2004
⭐️ Reputation: 46
🛠 State: resolved
💼 Team: Remitly
💵 Bounty: null
🕐 Submitted: 2025-06-12
⏰ Disclosed: 2026-10-12 18:34:54
📝 Summary: A password reset functionality was identified that accepted the user's current password as the new password without validation. The system did not reject or warn against reusing the same password during the reset process.
📂 Report JSON File: 3189580
@hackeronereports

🎯 New Report #3910393: Stack Buffer Overflow in MariaDB CONNECT storage engine when reading DOUBLE columns from TABLE TYPE=DOS tables
🔺Severity: null
👽 Reporter: dstesk
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-08-02
⏰ Disclosed: 2026-10-12 17:08:52
📝 Summary: A stack buffer overflow vulnerability was identified in the CONNECT storage engine. The vulnerability existed in a function that converts character data to double-precision floating-point values. When reading DOUBLE columns from DOS table files, the function copied data into a 64-byte buffer but wrote a null terminator at an unchecked offset based on the SQL-declared field width rather than the actual copied length. This allowed the null terminator to be written up to 191 bytes beyond the buffer boundary. The issue could be triggered by declaring columns with widths up to 255 characters, causing the database server to crash.
📂 Report JSON File: 3910393
@hackeronereports

🎯 New Report #3662095: SQL Injection found on ibm.com subdomain
🔺Severity: Critical
👽 Reporter: xetnus
⭐️ Reputation: 387
🛠 State: resolved
💼 Team: IBM
💵 Bounty: null
🕐 Submitted: 2026-04-10
⏰ Disclosed: 2026-10-12 16:03:29
📝 Summary: A SQL injection vulnerability was identified on a subdomain, reported to the vendor, analyzed, and remediated.
📂 Report JSON File: 3662095
@hackeronereports

🎯 New Report #3872248: Connector/C : heap out-of-bounds read when malicious server field length exceeds declared column length in binary result path
🔺Severity: Medium
👽 Reporter: fg0x0
⭐️ Reputation: 808
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-18
⏰ Disclosed: 2026-10-12 09:26:55
📝 Summary: A heap out-of-bounds read vulnerability was identified in the connector library when processing binary result sets. The vulnerability occurred because the buffer for each result column was sized based on the server-declared column length, but then the actual field length reported by the server in row packets was read from that buffer without proper bounds checking. A malicious server could declare a small column length while sending a larger field value, causing adjacent process memory to be read and leaked into application-visible column values or triggering a process crash. The vulnerability was reachable through the binary protocol path when server-side prepared statements were used or when stored procedure calls were executed. Information disclosure of adjacent heap memory and denial of service were possible impacts.
📂 Report JSON File: 3872248
@hackeronereports

🎯 New Report #3871977: Connector/ODBC: malicious server's long version string wraps size t PrefixLen via negative snprintf return, causing heap out-of-bounds write
🔺Severity: Medium
👽 Reporter: fg0x0
⭐️ Reputation: 808
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-18
⏰ Disclosed: 2026-10-12 09:27:31
📝 Summary: A memory corruption vulnerability was discovered in the MariaDB Connector/ODBC driver. When a malicious server sent a handshake with an excessively long version string exceeding approximately 500 bytes, a custom snprintf function returned a negative value. This negative value was added to an unsigned integer, causing integer wraparound. The corrupted value was subsequently used as an offset into a fixed-size buffer, resulting in out-of-bounds heap writes. The vulnerability was triggered unauthenticated and remotely when an application allocated a statement on a poisoned connection. The flaw was confirmed to cause heap buffer overflow with address sanitizer testing on the driver built from source.
📂 Report JSON File: 3871977
@hackeronereports

🎯 New Report #3871740: r2dbc-mariadb Parsec auth: server-controlled PBKDF2 iteration count causes CPU-exhaustion DoS ( regression from b7766de )
🔺Severity: Medium
👽 Reporter: fg0x0
⭐️ Reputation: 808
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-18
⏰ Disclosed: 2026-10-12 09:06:59
📝 Summary: A server-controlled PBKDF2 iteration count vulnerability was discovered in the Parsec authentication plugin. The iteration value was read directly from the server response and only validated against a minimum threshold, allowing a malicious server to force excessive cryptographic computations. An attacker could specify a high iteration count that resulted in approximately 1.07 billion PBKDF2-HMAC-SHA512 rounds, causing a client CPU core to be pinned for extended periods during connection attempts. The vulnerability was introduced by a prior commit that loosened the iteration count validation. This vulnerability could be exploited repeatedly without valid credentials and was exposed by default plaintext connections.
📂 Report JSON File: 3871740
@hackeronereports

🎯 New Report #3801107: Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint
🔺Severity: Critical
👽 Reporter: winstoncrooker
⭐️ Reputation: 292
🛠 State: resolved
💼 Team: WordPress
💵 Bounty: null
🕐 Submitted: 2026-06-14
⏰ Disclosed: 2026-10-12 06:53:02
📝 Summary: A forum plugin version 2.7.0 registered post types with REST API exposure without enforcing the same access restrictions applied on other platforms. Private and hidden forum topics and replies were stored with public status, and forum visibility was only enforced through query filters that were bypassed by direct REST API single-item requests. Unauthenticated attackers could retrieve the full content of restricted forum posts by making direct REST API calls with sequential post identifiers. The vulnerability was not present in the previous release line, which did not expose these post types to the REST API.
📂 Report JSON File: 3801107
@hackeronereports

🎯 New Report #3896507: Server crash (stack-overflow DoS) via unbounded recursion in MariaDB WKB GEOMETRYCOLLECTION parser
🔺Severity: Medium
👽 Reporter: tsg1696
⭐️ Reputation: 131
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-28
⏰ Disclosed: 2026-10-11 12:16:14
📝 Summary: A server crash vulnerability was identified in the WKB GEOMETRYCOLLECTION parser of a database server. The parser employed unbounded recursion without depth limits or stack overflow checks when processing nested geometry collections, allowing crafted input with deeply nested structures to exhaust thread stack memory and trigger a denial of service condition. The vulnerability was confirmed through testing with nested geometry structures that caused server crashes. The issue affected spatial functions and geometry column operations accessible to authenticated users with low privileges. A fix was recommended through implementation of recursion depth guards or maximum nesting limits.
📂 Report JSON File: 3896507
@hackeronereports

🎯 New Report #4082665: ActionText `to markdown` still allows `javascript:` links in kramdown via Rails-generated table cells after PR #58754
🔺Severity: Medium
👽 Reporter: deah313
⭐️ Reputation: 167
🛠 State: informative
💼 Team: Ruby on Rails
💵 Bounty: null
🕐 Submitted: 2026-10-03
⏰ Disclosed: 2026-10-10 21:22:44
📝 Summary: null
📂 Report JSON File: 4082665
@hackeronereports

🎯 New Report #4053546: Information Disclosure - Unauthen Leak Private Content
🔺Severity: Medium
👽 Reporter: thewindghost
⭐️ Reputation: 137
🛠 State: resolved
💼 Team: WordPress
💵 Bounty: null
🕐 Submitted: 2026-09-23
⏰ Disclosed: 2026-10-10 17:55:44
📝 Summary: A vulnerability was discovered in the BuddyPress integration of a forum plugin where the hide sitewide flag for new topic and reply activity was computed by checking only the posting forum's own status, not its parent forums. This allowed topics posted in a public-status subforum nested under a private or hidden parent forum to be broadcast in full to the public activity stream, including title, forum name, permalink, and body content. The content was disclosed despite the topic's direct permalink correctly returning a 404 error for unauthorized viewers. Unauthenticated users and low-privileged accounts were able to read restricted content via the public feed and API.
📂 Report JSON File: 4053546
@hackeronereports

🎯 New Report #4071670: HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocks
🔺Severity: Low
👽 Reporter: sujitjaunjal
⭐️ Reputation: 199
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: 200
🕐 Submitted: 2026-09-30
⏰ Disclosed: 2026-10-08 10:21:14
📝 Summary: A password reset token was transmitted to a real user monitoring service before the reset form was submitted. The token was passed as a query string parameter in the URL and recorded by the monitoring SDK without any redaction. The same monitoring session also captured the account identifier after the user authenticated. The monitoring service was configured with sampling at 100 percent and no URL sanitization callback, resulting in every reset token being recorded. The token was a live, single-use credential that could be used to reset any account without further authentication. A previously reported similar issue affecting a different telemetry service had been patched with path-specific redaction, but this left the same vulnerability open through an alternate monitoring sink that was not covered by that remediation.
📂 Report JSON File: 4071670
@hackeronereports

🎯 New Report #3915935: Heap Use-After-Free in Materialized cursor::open via SYS REFCURSOR Array Reallocation
🔺Severity: High
👽 Reporter: akkoul
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-08-04
⏰ Disclosed: 2026-10-07 19:46:11
📝 Summary: A heap-use-after-free vulnerability was identified in the cursor handling mechanism of the database server. The vulnerability existed in the cursor opening function where array reallocation during nested cursor operations caused dangling pointer references. When a cursor's SELECT statement invoked a function that opened additional cursors, the underlying memory buffer was reallocated, invalidating previously stored pointer addresses. These stale pointers were subsequently used for virtual method calls and memory writes, resulting in potential code execution and heap corruption. The issue affected authenticated users with function creation privileges and was distinct from a previously addressed related bug that had removed a stored member variable but had not corrected the parameter passing at the call site.
📂 Report JSON File: 3915935
@hackeronereports

🎯 New Report #3856148: Low-privilege RCE in MariaDB: SYS REFCURSOR cursor-array use-after-free chained with an ST Area heap over-read
🔺Severity: Critical
👽 Reporter: rdjgr
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-10
⏰ Disclosed: 2026-10-07 19:47:06
📝 Summary: A critical remote code execution vulnerability was discovered in MariaDB Server 13.0.2. The vulnerability chained two memory-safety bugs to allow an authenticated low-privilege user to execute arbitrary operating system commands as the database process user without requiring FILE, SUPER, or administrative privileges.

The first bug was a use-after-free condition in the system reference cursor array implementation. When the cursor array expanded, the backing buffer was reallocated, but open cursors retained raw pointers to the freed memory. Subsequent fetch operations dereferenced these dangling pointers, resulting in a virtual function call through an attacker-controlled vtable.

The second bug was an out-of-bounds heap read in the ST Area geospatial function. A missing bounds check in the multipolygon area calculation allowed reading past the geometry buffer when processing a crafted multipolygon with a declared polygon count exceeding the actual polygons present. This enabled an in-process memory disclosure oracle.

The exploit chain combined these bugs to leak heap and code addresses for defeating address space layout randomization and position-independent execution, then used the use-after-free to gain elevated database privileges and execute arbitrary commands. The complete end-to-end exploit was demonstrated against the released Docker image.
📂 Report JSON File: 3856148
@hackeronereports

🎯 New Report #3849040: #mysql50# legacy alias / stale table cache identity mismatch
🔺Severity: null
👽 Reporter: vortfu
⭐️ Reputation: 519
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-07
⏰ Disclosed: 2026-10-07 19:47:34
📝 Summary: A legacy compatibility mechanism for table name prefixes in MariaDB was exploited to cause a mismatch between the table definition cache and actual table metadata. By opening a table through one spelling and replacing it through an alternative alias, the cache was poisoned with stale metadata. This stale metadata was then used against new attacker-controlled file data, enabling out-of-bounds memory reads, arbitrary memory reads and writes, and remote code execution through various exploitation chains involving different storage engines and field types.
📂 Report JSON File: 3849040
@hackeronereports

🎯 New Report #3849051: #mysql50# legacy alias / internal table collisions
🔺Severity: null
👽 Reporter: vortfu
⭐️ Reputation: 519
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-07
⏰ Disclosed: 2026-10-07 19:48:18
📝 Summary: A vulnerability was discovered in MariaDB related to the legacy #mysql50# table name prefix feature. The issue involved improper encoding of table names prefixed with #mysql50#, which allowed attackers to create tables that collided with internal reserved filenames used by the database system and storage engines. This encoding bypass enabled unauthorized access to hidden tables, manipulation of partition metadata, and circumvention of access control lists. The vulnerability could be exploited to achieve remote code execution through multiple attack vectors including partition physical-table record overflows, vector index helper table manipulation, and merge table ACL bypasses.
📂 Report JSON File: 3849051
@hackeronereports

🎯 New Report #3880451: Privilege escalation via user controlled usernames / roles and views
🔺Severity: null
👽 Reporter: vortfu
⭐️ Reputation: 519
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-22
⏰ Disclosed: 2026-10-07 19:48:29
📝 Summary: A privilege escalation vulnerability was discovered in the handling of user-controlled usernames and roles in view and stored procedure definers. Newline characters embedded in usernames or roles were not properly sanitized when saved as raw option strings, allowing users to inject arbitrary definer configurations. This enabled attackers to execute SQL queries with elevated privileges by creating views or procedures that would be executed under the context of other users or roles. The vulnerability affected both username-based and role-based definer specifications.
📂 Report JSON File: 3880451
@hackeronereports

🎯 New Report #3849025: DATA / INDEX DIRECTORY Abuse
🔺Severity: null
👽 Reporter: vortfu
⭐️ Reputation: 519
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-07
⏰ Disclosed: 2026-10-07 19:53:07
📝 Summary: A vulnerability was identified in the DATA DIRECTORY and INDEX DIRECTORY functionality of a database system. Users with ordinary schema-level privileges were able to write arbitrary data to attacker-chosen locations by exploiting path traversal issues in how external table directories were processed. The vulnerability occurred because directory traversal checks failed when target paths contained non-existent segments, and because filename length limitations could be bypassed to create table files with arbitrary extensions in unintended locations. Additionally, a separate issue was identified in the ARCHIVE storage engine that allowed existing files to be overwritten when creating tables with specially crafted data directory paths.
📂 Report JSON File: 3849025
@hackeronereports

🎯 New Report #3836021: Missing FILE-privilege enforcement in CONNECT file UDFs allows server-side file read and write
🔺Severity: High
👽 Reporter: duongtt
⭐️ Reputation: 128
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-01
⏰ Disclosed: 2026-10-07 19:53:34
📝 Summary: A privilege enforcement vulnerability was discovered in file user-defined functions (UDFs) of a database engine. The file UDFs failed to enforce FILE privilege requirements and secure file path restrictions that were already implemented in the file-backed table handler. This allowed users with only SELECT privileges to read arbitrary files accessible to the database process and write files outside the configured secure directory. The vulnerability affected multiple file-related UDFs and was reproducible on multiple versions of the database software. The issue resulted from file UDFs not performing the same access control checks that were already in place for equivalent table operations.
📂 Report JSON File: 3836021
@hackeronereports

🎯 New Report #3781201: Pre-authentication `size t` integer underflow → out-of-bounds read / server crash in MariaDB `caching sha2 password` (auth mysql sha2) via an RSA-OAEP
🔺Severity: Medium
👽 Reporter: vnth4nhnt
⭐️ Reputation: 136
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-06-04
⏰ Disclosed: 2026-10-07 19:54:09
📝 Summary: A pre-authentication integer underflow vulnerability was discovered in the caching sha2 password authentication plugin. When a client sent an RSA-OAEP encrypted empty message over plaintext TCP, the decrypted length was not validated before being used in a subtraction operation. This caused a size t integer underflow that resulted in an out-of-bounds read in the SHA-256 hashing routine. The vulnerability allowed an unauthenticated attacker to crash the database server without requiring valid credentials.
📂 Report JSON File: 3781201
@hackeronereports

🎯 New Report #3908943: DROP PACKAGE leaves PACKAGE BODY grant in mysql.procs priv causing privilege escalation
🔺Severity: High
👽 Reporter: heyoimjeb
⭐️ Reputation: 109
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-08-01
⏰ Disclosed: 2026-10-07 19:57:10
📝 Summary: A privilege escalation vulnerability was discovered in package management functionality. When a package was dropped, the associated grant in the privilege table for the package body was not removed, while the package object itself was deleted from the system catalog. If a new package with the same name was subsequently created, the orphaned grant allowed previous users to execute the new package without explicit authorization, running with the new definer's privileges. The vulnerability also propagated through role-based access control to all role members. The issue was specific to package drops, as other similar drop operations correctly cleaned up their respective privilege rows.
📂 Report JSON File: 3908943
@hackeronereports