TGViewer
Channel Public Channel
Hackerone Reports

Hackerone Reports

@hackeronereports

Last Check 2026-10-16 19:45:01
Open in Telegram
Subscribers
243
Photos
0
Videos
0
Links
787

Showing posts older than #800 · Back to latest

Older Posts 20 shown
Post #790 51
🎯 New Report #3384615: Insufficient checks in the file path parameter allow writing to unauthorized directories
🔺Severity: Low
👽 Reporter: axolot23
⭐️ Reputation: 301
🛠 State: resolved
💼 Team: SingleStore
💵 Bounty: null
🕐 Submitted: 2025-10-15
⏰ Disclosed: 2026-06-24 07:03:12
📝 Summary: A directory traversal vulnerability was identified in the file upload functionality. Authenticated users could write files to parent directories outside the intended upload location by manipulating the path parameter. The issue was classified as Low severity due to limited impact. The vulnerability has been remediated through proper path sanitization.
📂 Report JSON File: 3384615
@hackeronereports
Post #789 57
🎯 New Report #3734676: Taskcluster web-server OAuth2 authorization codes are reusable and the exchange handler checks the wrong expiry column
🔺Severity: Medium
👽 Reporter: anshuman bh
⭐️ Reputation: 3737
🛠 State: resolved
💼 Team: Mozilla
💵 Bounty: 2000
🕐 Submitted: 2026-05-14
⏰ Disclosed: 2026-06-23 12:37:52
📝 Summary: The Taskcluster web-server's OAuth2 token-exchange handler did not consume authorization codes and did not enforce the authorization-code expiry. A leaked authorization code could be replayed to mint additional bridge access tokens for the original user, past the 10-minute window required by the OAuth2 standard. The expiry check in the token-exchange handler and the bridge-token-to-credentials handler read the wrong expiry column, allowing expired codes to remain usable until the daily cleanup cron deleted them.
📂 Report JSON File: 3734676
@hackeronereports
Post #787 71
🎯 New Report #3723458: 1-Click Account Takeover via Open Redirect through Regex Bypass in Domain Validation
🔺Severity: Critical
👽 Reporter: farr
⭐️ Reputation: 136
🛠 State: resolved
💼 Team: Khan Academy
💵 Bounty: null
🕐 Submitted: 2026-05-09
⏰ Disclosed: 2026-06-20 15:58:07
📝 Summary: A vulnerability was discovered in the Khan Academy platform that allowed an attacker to achieve full account takeover of any user. The vulnerability was caused by an unescaped dot flaw in the regular expression used to validate redirect URLs. This allowed the attacker to register a malicious domain that passed the validation check, causing the victim's authentication token to be sent to the attacker's server. The attacker could then use this token to gain full access to the victim's account. The issue was addressed by escaping the dots in the regular expression.
📂 Report JSON File: 3723458
@hackeronereports
Post #786 69
🎯 New Report #3658225: HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors
🔺Severity: Medium
👽 Reporter: pimterry
⭐️ Reputation: 153
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-04-08
⏰ Disclosed: 2026-06-18 17:34:31
📝 Summary: A flaw in the Node.js HTTP/2 server API was discovered that could cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affected Node.js 22 and Node.js 24.
📂 Report JSON File: 3658225
@hackeronereports
Post #785 66
🎯 New Report #3692858: Permission Model Bypass via `process.report.writeReport()` Path Misvalidation
🔺Severity: Low
👽 Reporter: suul
⭐️ Reputation: 1062
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-04-24
⏰ Disclosed: 2026-06-18 14:48:28
📝 Summary: A flaw was discovered in the Node.js permission model that allowed bypassing of security controls via the process.report.writeReport() path misvalidation.
📂 Report JSON File: 3692858
@hackeronereports
Post #784 65
🎯 New Report #2509022: Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image Rendering
🔺Severity: Medium
👽 Reporter: saltymermaid
⭐️ Reputation: 1415
🛠 State: resolved
💼 Team: Shopify
💵 Bounty: 1600
🕐 Submitted: 2024-05-16
⏰ Disclosed: 2026-06-18 12:48:02
📝 Summary: A reflected XSS vulnerability was reported in the AI chat bot greetings at help.shopify.com. The issue was caused by the rendering of a markdown image in the greeting, which allowed the attacker to inject a payload through the image URL. The vulnerability was addressed by removing the attacker-controlled greeting input path.
📂 Report JSON File: 2509022
@hackeronereports
Post #783 62
🎯 New Report #3694007: Authenticated Elasticsearch Painless script execution via Query.search.sort query on hackerone.com/graphql
🔺Severity: High
👽 Reporter: brumbelow
⭐️ Reputation: 753
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: 7000
🕐 Submitted: 2026-04-24
⏰ Disclosed: 2026-06-17 14:17:26
📝 Summary: The GraphQL query on hackerone.com/graphql allowed authenticated users to execute arbitrary Painless scripts through the sort query argument, without server-side validation or allowlisting. This was confirmed by submitting requests with different Painless script payloads, and observing that the script's return value determined the document ordering in the search results.
📂 Report JSON File: 3694007
@hackeronereports
Post #781 67
🎯 New Report #3701692: Malicious Conflux Endpoint Can Leave Stale Global OOO Queue Accounting After Teardown
🔺Severity: Low
👽 Reporter: aptupdate
⭐️ Reputation: 120
🛠 State: resolved
💼 Team: Tor
💵 Bounty: 100
🕐 Submitted: 2026-04-28
⏰ Disclosed: 2026-06-16 07:16:47
📝 Summary: A vulnerability was discovered in Tor's Conflux OOO queue accounting. The vulnerability could cause the global OOO queue byte counter to remain inflated after a Conflux set was torn down, even though the memory had already been freed. This was due to a lack of accounting updates during the teardown process. No sensitive information was included in the report.
📂 Report JSON File: 3701692
@hackeronereports
Older posts →
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →