TGViewer
Channel Public Channel
Hackerone Reports

Hackerone Reports

@hackeronereports

Last Check 2026-10-17 15:45:01
Open in Telegram
Subscribers
243
Photos
0
Videos
0
Links
788

Showing posts older than #720 · Back to latest

Older Posts 20 shown
Post #719 20
🎯 New Report #3590583: Unquoted body background attribute enables CSS injection that bypasses remote image blocking
🔺Severity: Medium
👽 Reporter: nullcathedral
⭐️ Reputation: 150
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-07
⏰ Disclosed: 2026-04-20 12:03:51
📝 Summary: A vulnerability was discovered in Roundcube's HTML sanitizer that enabled CSS injection when the allow remote option was set to false. The sanitizer failed to quote the value of the background attribute from the email's <body> element, allowing a crafted data: URI to terminate the url() function and inject arbitrary CSS properties. This bypass allowed external resources to be loaded even when remote image blocking was enabled.
📂 Report JSON File: 3590583
@hackeronereports
Post #718 22
🎯 New Report #3590586: position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays.
🔺Severity: Medium
👽 Reporter: nullcathedral
⭐️ Reputation: 150
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-07
⏰ Disclosed: 2026-04-20 12:04:03
📝 Summary: A vulnerability was discovered in the CSS sanitization process of the Roundcube webmail application. The sanitizer failed to properly handle the "position: fixed !important" CSS declaration, allowing an attacker to bypass the mitigation for fixed-position overlays. This could enable the creation of full-viewport phishing overlays.
📂 Report JSON File: 3590586
@hackeronereports
Post #717 21
🎯 New Report #3486747: SVG filter primitives bypass remote image blocking, enabling email tracking without consent.
🔺Severity: Medium
👽 Reporter: nullcathedral
⭐️ Reputation: 150
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-01-04
⏰ Disclosed: 2026-04-20 12:57:06
📝 Summary: A vulnerability was discovered in the HTML sanitizer of the Roundcube webmail application. The sanitizer did not properly handle the <feImage> SVG filter primitive, allowing external resources to be loaded even when the "Block remote images" setting was enabled. This vulnerability could be used to track email opens and obtain the recipient's IP address without the user's consent.
📂 Report JSON File: 3486747
@hackeronereports
Post #714 16
🎯 New Report #3556769: Incomplete fix for CVE-2026-21637: loadSNI() in tls wrap.js lacks try/catch leading to Remote DoS
🔺Severity: High
👽 Reporter: mbarbs
⭐️ Reputation: 109
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-02-15
⏰ Disclosed: 2026-04-23 22:21:16
📝 Summary: A flaw was discovered in the Node.js TLS error handling that left SNICallback invocations unprotected against synchronous exceptions. This represented an incomplete fix of the prior CVE-2026-21637 vulnerability, where the equivalent ALPN and PSK callbacks were already addressed. The issue could lead to a Remote Denial of Service when an SNICallback threw synchronously on unexpected input, causing the exception to bypass TLS error handlers and propagate as an uncaught exception, crashing the Node.js process.
📂 Report JSON File: 3556769
@hackeronereports
Post #712 16
🎯 New Report #3518571: Argument Injection in /manage/ssh/ via host parameter leads to sensitive file disclosure on Weblate
🔺Severity: null
👽 Reporter: alexb 616
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-01-20
⏰ Disclosed: 2026-04-26 13:21:45
📝 Summary: A vulnerability was discovered in the SSH management interface of Weblate, a web-based translation tool. The vulnerability allowed an attacker with administrative privileges to inject command-line arguments into the host parameter, leading to sensitive file disclosure on the server. The vulnerable code was found in the ssh() function, where the host parameter was directly appended to a subprocess command without proper sanitization, enabling the attacker to read files like /etc/passwd, Django settings.py, and private SSH keys.
📂 Report JSON File: 3518571
@hackeronereports
Post #711 16
🎯 New Report #3183520: Non-premium user can disable Ads in japanese version of dic.pixiv.net
🔺Severity: High
👽 Reporter: lainkusanagi
⭐️ Reputation: 161
🛠 State: resolved
💼 Team: pixiv
💵 Bounty: 3000
🕐 Submitted: 2025-06-09
⏰ Disclosed: 2026-04-27 03:58:30
📝 Summary: A vulnerability was identified in the Japanese version of the pixiv dictionary website where non-premium users could disable advertisements. Normally, the ability to disable ads was restricted to premium users only. However, due to improper access control, any authenticated user could modify their ad display preferences without verification of premium status.
📂 Report JSON File: 3183520
@hackeronereports
Post #710 14
🎯 New Report #3100570: Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.net
🔺Severity: Low
👽 Reporter: aaqibhussain
⭐️ Reputation: 224
🛠 State: resolved
💼 Team: pixiv
💵 Bounty: 200
🕐 Submitted: 2025-04-19
⏰ Disclosed: 2026-04-27 04:00:54
📝 Summary: A vulnerability was discovered in the messaging system of Pixiv.net. The vulnerability allowed any user to bypass the inbox privacy settings and send messages to another user who had disabled their inbox. The vulnerability was triggered by manipulating the id parameter in the message-sending POST request. Additionally, the lack of rate limiting or duplicate request validation allowed attackers to spam users by repeatedly sending the same or modified requests.
📂 Report JSON File: 3100570
@hackeronereports
Post #709 15
🎯 New Report #3279441: Bypass of Restricted Keyword "Mozilla" in Display Name Field via Unicode Homoglyphs on addons.allizom.org
🔺Severity: Low
👽 Reporter: icecream 23
⭐️ Reputation: 160
🛠 State: resolved
💼 Team: Mozilla
💵 Bounty: 500
🕐 Submitted: 2025-07-31
⏰ Disclosed: 2026-04-27 09:43:17
📝 Summary: A restricted keyword bypass vulnerability was discovered on the Firefox Add-ons platform that allowed an attacker to register a display name visually identical to "Mozilla" by using a Unicode homoglyph character. This circumvented the intended restriction and could have been used to impersonate official accounts.
📂 Report JSON File: 3279441
@hackeronereports
Post #708 14
🎯 New Report #3340797: IBM Aspera HTTP Gateway stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user.
🔺Severity: High
👽 Reporter: jhon1231248e
⭐️ Reputation: 1314
🛠 State: resolved
💼 Team: IBM
💵 Bounty: null
🕐 Submitted: 2025-09-16
⏰ Disclosed: 2026-04-27 13:29:35
📝 Summary: The IBM Aspera HTTP Gateway stored sensitive information in clear text in easily obtainable files, which could be read by an unauthenticated user. The issue was submitted to IBM, analyzed, and remediated.
📂 Report JSON File: 3340797
@hackeronereports
Post #707 16
🎯 New Report #3452696: PS4 BD-J privilege escalation using nested JAR
🔺Severity: Medium
👽 Reporter: gezine
⭐️ Reputation: 255
🛠 State: resolved
💼 Team: PlayStation
💵 Bounty: 2500
🕐 Submitted: 2025-12-05
⏰ Disclosed: 2026-04-29 05:09:03
📝 Summary: A PS4 vulnerability was discovered in the Blu-ray Disc Java (BD-J) privilege escalation using nested JAR files. The vulnerability was found in the PS4 system software versions 13.00 to the latest version 13.02. The vulnerability was caused by a discrepancy between the security policy's path canonicalization and the actual class loading path. The security policy granted AllPermission to code that appeared to be loaded from a trusted directory, while the actual code was loaded from an untrusted nested JAR on the Blu-ray disc. This resulted in a Time-of-Check/Time-of-Use (TOCTOU) vulnerability that allowed untrusted code to obtain AllPermission.
📂 Report JSON File: 3452696
@hackeronereports
Post #705 18
🎯 New Report #3577145: QuickSight Authorization Bypass: Chat Agents Accessible Despite Custom Permissions Denial
🔺Severity: None
👽 Reporter: jcow
⭐️ Reputation: 7776
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-03-04
⏰ Disclosed: 2026-05-12 14:54:33
📝 Summary: A vulnerability was discovered in Amazon Quick Suite (formerly QuickSight) that allowed users to access and interact with AI chat agents, despite administrative restrictions being in place to disable this functionality. The vulnerability was caused by the lack of proper server-side authorization checks, which enabled users to bypass the configured custom permissions and access the AI chat agents.
📂 Report JSON File: 3577145
@hackeronereports
Post #703 16
🎯 New Report #3713682: IDOR: autotranslate.translateMessage Full Message Content Leak
🔺Severity: Medium
👽 Reporter: josan george
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Rocket.Chat
💵 Bounty: null
🕐 Submitted: 2026-05-05
⏰ Disclosed: 2026-05-18 00:37:59
📝 Summary: The /api/v1/autotranslate.translateMessage endpoint allowed any authenticated user to retrieve the full content of any message from any room, including private groups, direct messages, and channels. The endpoint fetched the message without performing a room access check, returning the complete message object including the message text, sender information, room ID, timestamps, and markdown content.
📂 Report JSON File: 3713682
@hackeronereports
Post #702 14
🎯 New Report #3589247: Unauthenticated File Upload to CDN
🔺Severity: Medium
👽 Reporter: ph0r3nsic
⭐️ Reputation: 1579
🛠 State: resolved
💼 Team: Enjin
💵 Bounty: null
🕐 Submitted: 2026-03-06
⏰ Disclosed: 2026-05-18 07:52:16
📝 Summary: An unauthenticated file upload vulnerability was discovered in the NFT.io platform. The vulnerability allowed an unauthenticated user to upload files to the platform's content delivery network. The issue was reported and promptly fixed by the Enjin team, despite the low-impact nature of the vulnerability.
📂 Report JSON File: 3589247
@hackeronereports
Post #701 14
🎯 New Report #3560256: Cross-repository IDOR in `/settings/security analysis/bypass reviewers` allows unauthorized delegated bypass reviewer modification
🔺Severity: Medium
👽 Reporter: ahacker1
⭐️ Reputation: 7035
🛠 State: resolved
💼 Team: GitHub
💵 Bounty: null
🕐 Submitted: 2026-02-18
⏰ Disclosed: 2026-05-19 00:49:24
📝 Summary: A vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository. Authorization was verified against the repository in the URL, but the action was applied to a different repository specified in the request body. The vulnerability was limited to assigning existing trusted users as bypass reviewers and did not allow adding arbitrary external users. The vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4 and 3.20.1. The vulnerability was reported via the GitHub Bug Bounty program.
📂 Report JSON File: 3560256
@hackeronereports
Post #700 15
🎯 New Report #3670955: HMAC signature verification omits endpoint and payload allowing request forgery on CoinMate API
🔺Severity: Low
👽 Reporter: glferreira-devsecops
⭐️ Reputation: 49
🛠 State: resolved
💼 Team: CoinMate.io
💵 Bounty: null
🕐 Submitted: 2026-04-13
⏰ Disclosed: 2026-05-20 09:26:10
📝 Summary: A vulnerability was discovered in the HMAC signature verification process of the CoinMate API. The signature was calculated using only the nonce, client ID, and public key, omitting the HTTP endpoint and request payload. This allowed an attacker to hijack a valid signature intended for a read-only action and use it to execute a malicious action on a different endpoint, bypassing the cryptographic constraints.
📂 Report JSON File: 3670955
@hackeronereports
Older posts →
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →