TGViewer
Channel Public Channel
Hackerone Reports

Hackerone Reports

@hackeronereports

Last Check 2026-10-16 07:45:01
Open in Telegram
Subscribers
243
Photos
0
Videos
0
Links
785

Showing posts older than #820 · Back to latest

Older Posts 20 shown
Post #819 73
🎯 New Report #3789570: jitsi-meet: Prosody/Jigasi missing header whitelist in mod filter iq rayo allows arbitrary SIP header injection and Caller ID spoofing
🔺Severity: Low
👽 Reporter: pmgjoe
⭐️ Reputation: 247
🛠 State: resolved
💼 Team: 8x8
💵 Bounty: 100
🕐 Submitted: 2026-06-08
⏰ Disclosed: 2026-07-02 15:50:32
📝 Summary: A vulnerability was discovered in the Prosody and Jigasi components of Jitsi Meet. The Prosody filter implemented an incomplete blocklist that allowed authenticated users with outbound-call privileges to inject arbitrary SIP headers, enabling Caller ID spoofing on outgoing SIP calls in environments where Jigasi operates as a trusted SIP peer.
📂 Report JSON File: 3789570
@hackeronereports
Post #818 68
🎯 New Report #3813932: [Splatoon 3 Kick other players with NplnLogin message](https://hackerone.com/reports/3813932)
🔺Severity: Medium
👽 Reporter: alzxk11
⭐️ Reputation: 122
🛠 State: resolved
💼 Team: Nintendo
💵 Bounty: null
🕐 Submitted: 2026-06-20
⏰ Disclosed: 2026-07-02 01:25:44
📝 Summary: A vulnerability was discovered that allowed players to kick other players from a Splatoon 3 game using an NplnLogin message.
📂 Report JSON File: 3813932
@hackeronereports
Post #817 67
🎯 New Report #3559522: Splatoon 3 In-Match Integrity Bypass via Consensus Reflection Attack on Unordered Peer Submission
🔺Severity: High
👽 Reporter: hana2736
⭐️ Reputation: 224
🛠 State: resolved
💼 Team: Nintendo
💵 Bounty: null
🕐 Submitted: 2026-02-17
⏰ Disclosed: 2026-07-02 01:26:11
📝 Summary: A consensus reflection attack on unordered peer submission was discovered in Splatoon 3, allowing an in-match integrity bypass.
📂 Report JSON File: 3559522
@hackeronereports
Post #816 62
🎯 New Report #3353000: Privilege Escalation – Access to the Alert Subscribers page for users with low privileges
🔺Severity: Low
👽 Reporter: bl4ck-
⭐️ Reputation: 907
🛠 State: resolved
💼 Team: SingleStore
💵 Bounty: null
🕐 Submitted: 2025-09-22
⏰ Disclosed: 2026-07-01 17:36:56
📝 Summary: A privilege escalation vulnerability was discovered in the SingleStore Helios alert management system. The vulnerability allowed users with low privileges to access the Alert Subscribers API endpoint and retrieve email addresses and alert severity level preferences of notification subscribers, despite lacking authorization to view this information.
📂 Report JSON File: 3353000
@hackeronereports
Post #815 66
🎯 New Report #3353035: Delete any folder for any user within the organization
🔺Severity: Low
👽 Reporter: bl4ck-
⭐️ Reputation: 907
🛠 State: resolved
💼 Team: SingleStore
💵 Bounty: null
🕐 Submitted: 2025-09-22
⏰ Disclosed: 2026-07-01 17:39:22
📝 Summary: A vulnerability in the SingleStore backend API allowed low-privileged users to delete folders belonging to other users within the same organization by manipulating the folder id parameter in DELETE requests. The vulnerability was rated CVSS 3.0 Low (3.8) due to high attack complexity requiring knowledge of two UUIDs, reported on September 22, 2025, triaged on October 2, 2025, and successfully patched by SingleStore on April 21, 2026.
📂 Report JSON File: 3353035
@hackeronereports
Post #814 67
🎯 New Report #3353057: Insecure Direct Object Reference (IDOR) allows creating folders.
🔺Severity: Low
👽 Reporter: bl4ck-
⭐️ Reputation: 907
🛠 State: resolved
💼 Team: SingleStore
💵 Bounty: null
🕐 Submitted: 2025-09-22
⏰ Disclosed: 2026-07-01 17:41:16
📝 Summary: An Insecure Direct Object Reference (IDOR) vulnerability was discovered in the backend API of a software product. The vulnerability allowed authenticated users with low privileges to create unauthorized folders and files in other users' workspaces within the same organization. The issue was reported, triaged, and resolved by the security team through the implementation of a patch to properly validate cluster ownership before allowing resource creation.
📂 Report JSON File: 3353057
@hackeronereports
Post #813 70
🎯 New Report #3295500: Exceeding the maximum number of spaces allowed by exploiting a Race Condition in the Workspace creation process
🔺Severity: Low
👽 Reporter: bl4ck-
⭐️ Reputation: 907
🛠 State: resolved
💼 Team: SingleStore
💵 Bounty: null
🕐 Submitted: 2025-08-12
⏰ Disclosed: 2026-07-01 17:42:23
📝 Summary: A race condition vulnerability was discovered in the workspace creation process of SingleStore. The vulnerability allowed users to bypass the limit of one workspace per organization by sending multiple parallel requests to create workspaces. The lack of server-level locking during the creation process enabled concurrent transactions to bypass the workspace limit. The vulnerability was validated and classified as low severity due to limited practical attack vectors and financial impact. The underlying database transactional logic was subsequently patched to prevent this issue.
📂 Report JSON File: 3295500
@hackeronereports
Post #812 71
🎯 New Report #3648681: Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status Line
🔺Severity: Medium
👽 Reporter: saif-01
⭐️ Reputation: 109
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-04-04
⏰ Disclosed: 2026-07-01 15:39:11
📝 Summary: The llhttp HTTP response parser in Node.js up to version 24.14.1 (llhttp v9.3.0 and v9.3.1) was found to unconditionally accept a bare carriage return (CR) as a valid response status line terminator. This parsing asymmetry was present in the response path but not in the request parsing, enabling potential HTTP response queue poisoning attacks. The vulnerability was triggered in strict mode without requiring any lenient flags.
📂 Report JSON File: 3648681
@hackeronereports
Post #811 80
🎯 New Report #3400140: Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint
🔺Severity: High
👽 Reporter: dpaysm
⭐️ Reputation: 401
🛠 State: resolved
💼 Team: Discourse
💵 Bounty: 1024
🕐 Submitted: 2025-10-26
⏰ Disclosed: 2026-06-30 02:28:06
📝 Summary: A Denial of Service (DoS) vulnerability was identified in the /drafts.json endpoint on the Discourse forum. Large payloads (around 800,000 characters or more) submitted to create drafts caused the server to process the request, return a 502 Bad Gateway error, but still save the draft. Submitting multiple such large drafts led to significant server delays, with response times exceeding 32 seconds, indicating resource exhaustion.
📂 Report JSON File: 3400140
@hackeronereports
Post #810 83
🎯 New Report #876530: Remote node DOS
🔺Severity: Medium
👽 Reporter: xnbya
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2020-05-17
⏰ Disclosed: 2026-06-29 17:06:45
📝 Summary: A vulnerability was discovered in monerod, the Monero daemon. The vulnerability allowed an attacker to repeatedly request enough objects to fill the outgoing send queue for each peer-to-peer connection, causing the connection threads to sleep for approximately 6 seconds and then terminate the connections. This could result in a denial of service against the targeted node.
📂 Report JSON File: 876530
@hackeronereports
Post #809 69
🎯 New Report #3547349: Inverted ternary in peerlist manager::filter() allows unlimited whitelist entries per host via different ports
🔺Severity: null
👽 Reporter: kklam32
⭐️ Reputation: 111
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-02-10
⏰ Disclosed: 2026-06-29 17:14:19
📝 Summary: The peerlist manager::filter() function in the Monero project's p2p/net peerlist.h file contained an incorrect ternary operator that operated on the wrong peer list. When called with 'white=true', it filtered the gray list instead of the white list. As a result, a single host could accumulate unlimited white list entries on different ports.
📂 Report JSON File: 3547349
@hackeronereports
Post #808 85
🎯 New Report #3793243: Reflected XSS in stats‑video.php via improperly encoded URL parameters
🔺Severity: Medium
👽 Reporter: kanon4
⭐️ Reputation: 1160
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-06-10
⏰ Disclosed: 2026-06-25 13:39:58
📝 Summary: A reflected XSS vulnerability was discovered in the stats‑video.php script due to improper encoding of user input in the URL parameters.
📂 Report JSON File: 3793243
@hackeronereports
Post #807 80
🎯 New Report #3780709: Missing ownership validation allows cross‑manager tracker–campaign linking
🔺Severity: Medium
👽 Reporter: hakuopi
⭐️ Reputation: 97
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-06-03
⏰ Disclosed: 2026-06-25 13:40:14
📝 Summary: A vulnerability was reported in Revive Adserver version 6.0.7 and earlier that allowed a low-privileged user to link their trackers to campaigns owned by other managers on the same instance. This was due to a lack of proper ownership validation in the tracker-campaigns.php script, which handled the reverse operation of linking campaigns and trackers.
📂 Report JSON File: 3780709
@hackeronereports
Post #806 71
🎯 New Report #3781691: CSRF in zone‑include.php allows unauthorized banner and campaign linking
🔺Severity: Medium
👽 Reporter: an gr y
⭐️ Reputation: 155
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-06-04
⏰ Disclosed: 2026-06-25 13:40:31
📝 Summary: The zone-include.php script in Revive Adserver 6.0.7 was vulnerable to a CSRF attack. Linking and unlinking banners or campaigns to zones could be triggered via crafted GET or POST requests without any verification of the CSRF token, allowing an attacker to perform these actions on behalf of an authenticated administrator.
📂 Report JSON File: 3781691
@hackeronereports
Post #805 71
🎯 New Report #3781311: Stored XSS in maintenance tools via unescaped entity names
🔺Severity: Medium
👽 Reporter: an gr y
⭐️ Reputation: 155
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-06-04
⏰ Disclosed: 2026-06-25 13:40:45
📝 Summary: A stored XSS vulnerability was discovered in the maintenance tools of Revive Adserver 6.0.7. The issue was caused by entity names being displayed without proper escaping when inconsistencies were detected in the maintenance-acl-check.php and maintenance-banners-check.php files.
📂 Report JSON File: 3781311
@hackeronereports
Post #804 63
🎯 New Report #3780854: PHP code injection in delivery-limitation `logical` validation bypass
🔺Severity: High
👽 Reporter: riodrwn
⭐️ Reputation: 488
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-06-03
⏰ Disclosed: 2026-06-25 13:40:57
📝 Summary: A vulnerability in the delivery-limitation logical validation was reported. The vulnerability allowed bypassing the fix for CVE-2026-34916 by sending a disallowed but otherwise valid plugin identifier as type, or using the ox.setChannelTargeting XML-RPC API method.
📂 Report JSON File: 3780854
@hackeronereports
Post #803 63
🎯 New Report #3780806: Reflected XSS via unsanitised refresh parameter in zone invocation tag
🔺Severity: Medium
👽 Reporter: kanon4
⭐️ Reputation: 1160
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-06-03
⏰ Disclosed: 2026-06-25 13:41:12
📝 Summary: A missing sanitization of user input in the zone-include.php script of Revive Adserver 6.0.7 and earlier was reported. This vulnerability allowed a low-privileged user to perform reflected XSS attacks by exploiting the refresh parameter of the iFrame invocation tag.
📂 Report JSON File: 3780806
@hackeronereports
Older posts →
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →