TGViewer
Channel Public Channel
Hackerone Reports

Hackerone Reports

@hackeronereports

Last Check 2026-10-17 14:45:01
Open in Telegram
Subscribers
243
Photos
0
Videos
0
Links
788

Showing posts older than #740 · Back to latest

Older Posts 20 shown
Post #738 29
🎯 New Report #3079931: Memory leak in gem decode logic can allow attacker to take down Rubygems.org application
🔺Severity: Medium
👽 Reporter: mclaren650sspider
⭐️ Reputation: 6390
🛠 State: resolved
💼 Team: RubyGems
💵 Bounty: null
🕐 Submitted: 2025-04-06
⏰ Disclosed: 2026-04-09 11:46:38
📝 Summary: A memory leak vulnerability was discovered in the gem decode logic of the Rubygems.org application. The vulnerability allowed an attacker with a valid API key to set arbitrary instance variables during the decoding of gem metadata, which would cause the server to exhaust its memory. The issue was addressed by restricting the instance variables that can be set during metadata decoding.
📂 Report JSON File: 3079931
@hackeronereports
Post #737 21
🎯 New Report #3325582: User Can Delete Other Users' Personal Access Tokens at /delete-token/{token id}/ on Mozilla Pontoon
🔺Severity: Low
👽 Reporter: adilnbabras
⭐️ Reputation: 268
🛠 State: resolved
💼 Team: Mozilla
💵 Bounty: null
🕐 Submitted: 2025-09-03
⏰ Disclosed: 2026-04-10 01:12:47
📝 Summary: A vulnerability was discovered in the Mozilla Pontoon application that allowed users to delete other users' personal access tokens at the /delete-token/{token id}/ endpoint without proper permission checks. The vulnerability was caused by the absence of user permission verification in the delete token view function, which allowed anyone to delete any user's personal access token. This could have resulted in users losing access to their accounts if their personal access tokens were deleted.
📂 Report JSON File: 3325582
@hackeronereports
Post #736 21
🎯 New Report #3020021: [Vertical Privilege Escalation User can Unapproved any Approved Translation at /translations/unapprove/](https://hackerone.com/reports/3020021)
🔺Severity: Medium
👽 Reporter: adilnbabras
⭐️ Reputation: 268
🛠 State: resolved
💼 Team: Mozilla
💵 Bounty: null
🕐 Submitted: 2025-03-01
⏰ Disclosed: 2026-04-10 01:13:22
📝 Summary: A vulnerability was discovered in the Pontoon web application where any logged-in user could unapprove any approved translation, regardless of their privileges. This was due to a logical error in the validation logic, which allowed bypassing the authorization check. The vulnerability could be exploited by intercepting the request to the "/translations/unapprove/" endpoint and modifying the necessary parameters.
📂 Report JSON File: 3020021
@hackeronereports
Post #735 19
🎯 New Report #3418031: Open Redirect in Rocket.Chat
🔺Severity: Medium
👽 Reporter: soohyun
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Rocket.Chat
💵 Bounty: null
🕐 Submitted: 2025-11-09
⏰ Disclosed: 2026-04-10 02:16:18
📝 Summary: An open redirect vulnerability was identified in Rocket.Chat. The / saml/sloRedirect/:provider endpoint included the redirect query string value directly in the Location header for a 302 redirect without any server-side validation. This issue was fixed in v8.4.0.
📂 Report JSON File: 3418031
@hackeronereports
Post #733 16
🎯 New Report #3400143: Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute)
🔺Severity: Medium
👽 Reporter: py0zz1
⭐️ Reputation: 122
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: 250
🕐 Submitted: 2025-10-26
⏰ Disclosed: 2026-04-13 16:23:08
📝 Summary: The Nextcloud Desktop Client was found to automatically include user credentials (Authorization header with username and password in Base64) when downloading files via the "directDownloadUrl" feature. This allowed a malicious Nextcloud server to specify an attacker-controlled URL, causing the client to leak the user's credentials to the attacker's server. The root cause was the failure to validate the origin of the "directDownloadUrl" and the lack of setting the "DontAddCredentialsAttribute" for cross-origin requests.
📂 Report JSON File: 3400143
@hackeronereports
Post #732 16
🎯 New Report #3665151: Brave Shields Domain Reordering Leads to Origin Confusion
🔺Severity: Low
👽 Reporter: mousepadkalilinux12
⭐️ Reputation: 112
🛠 State: resolved
💼 Team: Brave Software
💵 Bounty: null
🕐 Submitted: 2026-04-10
⏰ Disclosed: 2026-04-13 19:59:26
📝 Summary: The Brave Shields feature was observed to reorder domain names, leading to potential origin confusion. Specifically, the domain "1.attacker.com" was displayed as "attacker.com.1", and "1.1.1.1.attacker.com" was displayed as "attacker.com.1.1.1.1". This behavior could potentially mislead users about the actual source of the website.
📂 Report JSON File: 3665151
@hackeronereports
Post #731 17
🎯 New Report #3321406: [Variation of #1554049 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp Auth](https://hackerone.com/reports/3321406)
🔺Severity: High
👽 Reporter: matured kazama
⭐️ Reputation: 2383
🛠 State: resolved
💼 Team: Cloudflare Public Bug Bounty
💵 Bounty: null
🕐 Submitted: 2025-08-31
⏰ Disclosed: 2026-04-14 05:53:46
📝 Summary: A vulnerability was discovered in Cloudflare Access that could allow for unauthorized approvals within the Temporary Auth workflow. The issue was resolved after the researcher reported it to Cloudflare.
📂 Report JSON File: 3321406
@hackeronereports
Post #730 20
🎯 New Report #3423950: [Variation of #3321406 YetAnother 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in AccessTempAuth](https://hackerone.com/reports/3423950)
🔺Severity: High
👽 Reporter: matured kazama
⭐️ Reputation: 2383
🛠 State: resolved
💼 Team: Cloudflare Public Bug Bounty
💵 Bounty: null
🕐 Submitted: 2025-11-12
⏰ Disclosed: 2026-04-14 05:54:53
📝 Summary: A vulnerability in Cloudflare Access involving the Browser Isolation email field was discovered, which could allow for unauthorized approvals within the Temporary Auth workflow. The issue has been fully remediated.
📂 Report JSON File: 3423950
@hackeronereports
Post #728 17
🎯 New Report #3543475: Improper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosure
🔺Severity: Low
👽 Reporter: xavlimsg
⭐️ Reputation: 551
🛠 State: resolved
💼 Team: Basecamp
💵 Bounty: 218
🕐 Submitted: 2026-02-07
⏰ Disclosed: 2026-04-14 19:25:39
📝 Summary: The vulnerability allowed for cross-tenant ActionText reference resolution and data disclosure during the account import flow. The import process did not properly verify the ownership of the referenced records before minting signed global IDs, enabling an attacker to access and disclose data from other accounts.
📂 Report JSON File: 3543475
@hackeronereports
Post #727 18
🎯 New Report #3608199: DOM XSS in `fizzy.do` import filename preview enables one-click victim account takeover
🔺Severity: High
👽 Reporter: xavlimsg
⭐️ Reputation: 551
🛠 State: resolved
💼 Team: Basecamp
💵 Bounty: 500
🕐 Submitted: 2026-03-16
⏰ Disclosed: 2026-04-14 21:36:22
📝 Summary: A DOM XSS vulnerability was discovered in the file import functionality of the Fizzy application. The vulnerability allowed an attacker to craft a malicious filename that, when previewed by the victim user, would inject a second form submission into the import page. This enabled the attacker to perform actions on the victim's account, such as changing the email address, creating a personal access token, and deleting the account, all using the victim's authenticated session.
📂 Report JSON File: 3608199
@hackeronereports
Post #725 17
🎯 New Report #3642600: Authorization header leak in ssrf filter via cross-host redirect leads to credential theft and unauthorized access
🔺Severity: null
👽 Reporter: argareksapatii
⭐️ Reputation: 182
🛠 State: resolved
💼 Team: arkadiyt-projects
💵 Bounty: null
🕐 Submitted: 2026-04-01
⏰ Disclosed: 2026-04-15 20:43:58
📝 Summary: A vulnerability was discovered in the ssrf filter library. The vulnerability allowed an attacker-controlled redirect target to receive credentials that were intended only for the original request origin. This was possible because ssrf filter followed redirects by rebuilding each redirected request from the original request options, including the Authorization header. As a result, sensitive state such as bearer tokens was forwarded across cross-host redirects, leading to credential theft and unauthorized access.
📂 Report JSON File: 3642600
@hackeronereports
Post #724 16
🎯 New Report #3287208: DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification API
🔺Severity: null
👽 Reporter: hellokbit
⭐️ Reputation: 139
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: 12500
🕐 Submitted: 2025-08-05
⏰ Disclosed: 2026-04-16 12:00:20
📝 Summary: The GraphQL API's 'verifyAccountRecoveryPhoneNumber' mutation was found to be vulnerable to denial-of-service attacks through mutation aliasing. The vulnerability allowed multiple aliases of the same mutation to be included in a single request, causing the server to process each mutation sequentially and increasing the response time linearly. This resource exhaustion issue could potentially have led to service disruption for legitimate users.
📂 Report JSON File: 3287208
@hackeronereports
Post #723 14
🎯 New Report #3168691: Residual Malicious Payloads on HackerOne after Vulnerability Fixes
🔺Severity: Medium
👽 Reporter: joejoe5
⭐️ Reputation: 324
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: null
🕐 Submitted: 2025-05-30
⏰ Disclosed: 2026-04-16 12:06:13
📝 Summary: A vulnerability was previously discovered on the HackerOne platform that allowed users to add malicious payloads to their profile pages. Despite remediation efforts, some of these malicious payloads were not fully removed from user profiles. This situation meant that the malicious content could still be triggered when users visited certain profile pages.
📂 Report JSON File: 3168691
@hackeronereports
Post #722 14
🎯 New Report #3601655: Rails::HTML::Sanitizer.allowed uri? returns true for entity-encoded control-character-split javascript: URLs
🔺Severity: Low
👽 Reporter: smlee
⭐️ Reputation: 143
🛠 State: resolved
💼 Team: Ruby on Rails
💵 Bounty: null
🕐 Submitted: 2026-03-12
⏰ Disclosed: 2026-04-18 15:27:19
📝 Summary: A vulnerability was discovered in the Rails::HTML::Sanitizer.allowed uri? method of the rails-html-sanitizer library. The method incorrectly returned true for entity-encoded control-character-split javascript: URLs, which could lead to potential security issues if the application relied on the method's result to make security decisions.
📂 Report JSON File: 3601655
@hackeronereports
Post #721 14
🎯 New Report #3594137: Stored XSS in attachment-display exploitable through SameSite
🔺Severity: Medium
👽 Reporter: aikido security
⭐️ Reputation: 211
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-09
⏰ Disclosed: 2026-04-19 09:14:42
📝 Summary: A stored XSS vulnerability was discovered in the attachment-display feature of Roundcube. By uploading an HTML file and opening it through the display-attachment endpoint, the embedded script could execute under the Roundcube origin. The issue was caused by the lack of a restrictive Content Security Policy in the attachment display flow, unlike the general attachment viewer.
📂 Report JSON File: 3594137
@hackeronereports
Post #720 15
🎯 New Report #3590576: SMIL values and by attributes bypass remote image blocking via unvalidated resource-loading animations, enabling email tracking without consent
🔺Severity: Medium
👽 Reporter: nullcathedral
⭐️ Reputation: 150
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-07
⏰ Disclosed: 2026-04-20 12:03:33
📝 Summary: A vulnerability was discovered in the HTML sanitizer of the Roundcube webmail client. The vulnerability allowed attackers to bypass the "Block remote images" security feature by using SMIL animation attributes to load arbitrary external resources without validation. This could have enabled email tracking without the user's consent.
📂 Report JSON File: 3590576
@hackeronereports
Older posts →
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →