Hackerone Reports

🎯 New Report #3858504: connect.8x8.com: Automation Builder - Input Validation Issue in Workflow Step Outputs
🔺Severity: High
👽 Reporter: kyotozzx
⭐️ Reputation: 351
🛠 State: resolved
💼 Team: 8x8
💵 Bounty: 1337
🕐 Submitted: 2026-07-12
⏰ Disclosed: 2026-09-02 00:03:45
📝 Summary: An input validation issue was reported in the 8x8 Connect Automation Builder's API where workflow step output field names were not validated against reserved context variable names. The issue was addressed by implementing validation to reject reserved field names at workflow creation.
📂 Report JSON File: 3858504
@hackeronereports

🎯 New Report #1534465: Ticket Trick Attack allows access to Rockstar Games' workspaces
🔺Severity: High
👽 Reporter: recon ninja
⭐️ Reputation: 696
🛠 State: resolved
💼 Team: Rockstar Games
💵 Bounty: null
🕐 Submitted: 2022-04-07
⏰ Disclosed: 2026-09-01 19:03:44
📝 Summary: A vulnerability, referred to as "Ticket Trick Attack," was discovered in the support portal of Rockstar Games. The vulnerability allowed an attacker to gain unauthorized access to the company's workspaces by creating an account with an email address similar to the official support email address. This was possible because Rockstar Games did not properly validate the ownership of the email address before granting access on the support portal.
📂 Report JSON File: 1534465
@hackeronereports

🎯 New Report #3869124: **Unauthenticated IDOR allows modification of payment customer billing information**
🔺Severity: High
👽 Reporter: visionx7
⭐️ Reputation: 121
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-07-16
⏰ Disclosed: 2026-08-30 04:54:37
📝 Summary: The application contained an access control issue in the payment billing information edit functionality. An unauthenticated user was able to access the payment edit endpoint and modify the billing information associated with a payment without any authorization check. The issue occurred because the application allowed access to the edit page using only the payment identifier in the URL, and the server did not verify whether the requester was logged in or had permission to modify the customer information linked to that payment.
📂 Report JSON File: 3869124
@hackeronereports

🎯 New Report #3909372: Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint
🔺Severity: null
👽 Reporter: inventor0x01
⭐️ Reputation: 149
🛠 State: resolved
💼 Team: IBM
💵 Bounty: null
🕐 Submitted: 2026-08-02
⏰ Disclosed: 2026-08-28 18:20:00
📝 Summary: A vertical privilege escalation vulnerability was found on an ibm.com endpoint. The vulnerability was reported to IBM, analyzed, and remediated.
📂 Report JSON File: 3909372
@hackeronereports

🎯 New Report #3931771: Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get media item()`
🔺Severity: Critical
👽 Reporter: jakubk
⭐️ Reputation: 222
🛠 State: resolved
💼 Team: WordPress
💵 Bounty: null
🕐 Submitted: 2026-08-11
⏰ Disclosed: 2026-08-28 16:38:57
📝 Summary: A vulnerability was discovered in the WordPress media upload and finalize endpoints. An author could upload a crafted image with a malicious filename, which was then stored verbatim by the endpoint and rendered without proper escaping in the WordPress admin media library. This could allow the execution of arbitrary JavaScript in the context of an administrator's browser session.
📂 Report JSON File: 3931771
@hackeronereports

🎯 New Report #3931777: Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning ` wp attachment metadata`
🔺Severity: Critical
👽 Reporter: jakubk
⭐️ Reputation: 222
🛠 State: resolved
💼 Team: WordPress
💵 Bounty: null
🕐 Submitted: 2026-08-11
⏰ Disclosed: 2026-08-28 16:39:48
📝 Summary: A vulnerability was discovered in the WordPress media processing functionality. This vulnerability allowed an authenticated author to delete arbitrary files on the server. The vulnerability was caused by insufficient input validation in the finalize item() function, which allowed an attacker to control the file paths stored in the attachment metadata. This resulted in the wp delete attachment files() function deleting files outside of the expected upload directory. The vulnerability was present in WordPress versions 7.0.2 and trunk revisions up to 7.1-beta3-62852.
📂 Report JSON File: 3931777
@hackeronereports

🎯 New Report #3846922: HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion
🔺Severity: High
👽 Reporter: leduckhuong
⭐️ Reputation: 131
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-07-06
⏰ Disclosed: 2026-08-28 14:15:33
📝 Summary: A flaw in Node.js HTTP/2 handling was discovered that could cause HTTP/2 retained header blocks to evade the maxSessionMemory setting and enable remote memory exhaustion.
📂 Report JSON File: 3846922
@hackeronereports

🎯 New Report #3833629: Re-entrant `nghttp2 session mem send()` during `nghttp2 session mem recv()` causes heap-use-after-free in Node.js HTTP/2
🔺Severity: High
👽 Reporter: hahahkim
⭐️ Reputation: 130
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-30
⏰ Disclosed: 2026-08-28 14:15:35
📝 Summary: A flaw was discovered in the Node.js HTTP/2 implementation that allowed the nghttp2 session mem send() function to be called re-entrantly while nghttp2 session mem recv() was executing, resulting in a heap-use-after-free vulnerability. This issue affected Node.js versions 26.x, 24.x, and 22.x.
📂 Report JSON File: 3833629
@hackeronereports

🎯 New Report #3795900: node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely
🔺Severity: Medium
👽 Reporter: cantina-security
⭐️ Reputation: 2422
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-11
⏰ Disclosed: 2026-08-28 14:15:57
📝 Summary: A flaw was discovered in the node:sqlite package for Node.js that allowed a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it had been reset and rebound with new parameters. The vulnerability was caused by the SQLTagStore feature resetting cached statements using sqlite3 reset() directly, bypassing the iterator invalidation mechanism introduced in recent releases. This issue affected Node.js versions 22.x, 24.x, and 26.x.
📂 Report JSON File: 3795900
@hackeronereports

🎯 New Report #3795657: dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records
🔺Severity: Medium
👽 Reporter: cantina-security
⭐️ Reputation: 2422
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-11
⏰ Disclosed: 2026-08-28 14:16:02
📝 Summary: A flaw in Node.js was discovered where the dns.resolveAny() function aborted the Node.js process when a DNS response contained more than 256 A records.
📂 Report JSON File: 3795657
@hackeronereports

🎯 New Report #3857258: Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)
🔺Severity: Medium
👽 Reporter: byvini
⭐️ Reputation: 109
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-07-11
⏰ Disclosed: 2026-08-28 14:16:19
📝 Summary: A flaw was discovered in the synchronous Node.js zlib APIs that allowed a spoofed TypedArray byteLength to trigger a reachable assertion, causing the entire process to crash. All 11 synchronous zlib functions were affected.
📂 Report JSON File: 3857258
@hackeronereports

🎯 New Report #3564941: HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser
🔺Severity: Low
👽 Reporter: yushengchen
⭐️ Reputation: 151
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-02-20
⏰ Disclosed: 2026-08-28 14:16:19
📝 Summary: A flaw in the Node.js HTTP client was discovered that could cause a request desynchronization for Node.js-based forwarding proxies. The issue was caused by the Node.js HTTP parser omitting headers beyond the configured limit from the visible request headers, while still using those headers internally for HTTP message framing. This vulnerability was found to affect all supported Node.js release lines.
📂 Report JSON File: 3564941
@hackeronereports

🎯 New Report #3778282: Critical SQL Injection WDM API (████████)
🔺Severity: Critical
👽 Reporter: matty69v
⭐️ Reputation: 1039
🛠 State: resolved
💼 Team: Essity
💵 Bounty: null
🕐 Submitted: 2026-06-02
⏰ Disclosed: 2026-08-27 07:23:47
📝 Summary: A boolean-based and time-based blind SQL injection vulnerability was discovered in the searchText query parameter of the GET /api/WDMProduct endpoint. The vulnerability allowed an unauthenticated attacker to read or modify data in the backing Microsoft SQL Server database. The backend was found to be hosted on an Azure App Service and served by the in-scope Angular front-end application.
📂 Report JSON File: 3778282
@hackeronereports

🎯 New Report #3729501: Pre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass no rate limit)
🔺Severity: Critical
👽 Reporter: matty69v
⭐️ Reputation: 1039
🛠 State: resolved
💼 Team: Essity
💵 Bounty: null
🕐 Submitted: 2026-05-12
⏰ Disclosed: 2026-08-27 07:35:43
📝 Summary: A pre-authentication stored cross-site scripting (XSS) vulnerability was discovered in the customer service API of the Essity company. The API accepted unauthenticated ticket submissions with arbitrary HTML/JavaScript in multiple fields, bypassing reCAPTCHA validation, CSRF protection, and rate limiting. When customer service operators viewed these tickets in the Umbraco back-office, the stored XSS executed in their authenticated session, enabling potential account takeover and other attacks. Multiple stacked vulnerabilities, including lack of input sanitization and authorization checks, were identified.
📂 Report JSON File: 3729501
@hackeronereports

🎯 New Report #3689633: Hidden/restricted tags can be mutated through synonym ID paths without per-tag authorization
🔺Severity: Medium
👽 Reporter: ahpuh
⭐️ Reputation: 102
🛠 State: resolved
💼 Team: Discourse
💵 Bounty: null
🕐 Submitted: 2026-04-22
⏰ Disclosed: 2026-08-26 05:47:28
📝 Summary: A vulnerability was discovered in Discourse where a non-admin user with tag-editing permission could modify hidden or restricted tags by supplying their numeric IDs to the synonym creation and tag settings endpoints. Although the user could not view the hidden tags, the controller only authorized the visible target tag and did not re-check authorization for each synonym tag ID, allowing the non-admin user to update the synonym relationship of hidden tags.
📂 Report JSON File: 3689633
@hackeronereports

🎯 New Report #3527788: Add labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gating
🔺Severity: Medium
👽 Reporter: ahacker1
⭐️ Reputation: 7839
🛠 State: resolved
💼 Team: GitHub
💵 Bounty: null
🕐 Submitted: 2026-01-27
⏰ Disclosed: 2026-08-25 21:22:31
📝 Summary: A vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a project to modify issue and pull request metadata through the project. When adding an item to a project that already existed, column value updates were applied without verifying the actor's repository write permissions.
📂 Report JSON File: 3527788
@hackeronereports

🎯 New Report #3889473: @jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)
🔺Severity: Low
👽 Reporter: a3z4km3
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: 8x8
💵 Bounty: null
🕐 Submitted: 2026-07-25
⏰ Disclosed: 2026-08-25 02:09:50
📝 Summary: An unsafe nginx regex pattern was discovered in the /colibri-relay-ws/ location of the @jitsi/docker-jitsi-meet project. The regex [a-zA-Z0-9-\\. ] accepted arbitrary domain names and IP addresses for proxy pass directives, allowing unauthenticated requests to be proxied to attacker-specified destinations. The vulnerable nginx location and associated relay WebSocket proxy configuration have been removed.
📂 Report JSON File: 3889473
@hackeronereports

🎯 New Report #3727743: URI scheme validation bypass in ActionText `to markdown` via user-supplied `<action-text-markdown>` marker tag
🔺Severity: Medium
👽 Reporter: offsetmd
⭐️ Reputation: 329
🛠 State: resolved
💼 Team: Ruby on Rails
💵 Bounty: null
🕐 Submitted: 2026-05-11
⏰ Disclosed: 2026-08-24 16:21:36
📝 Summary: null
📂 Report JSON File: 3727743
@hackeronereports

🎯 New Report #3696266: Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider
🔺Severity: Medium
👽 Reporter: mirachael
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-04-26
⏰ Disclosed: 2026-08-24 01:23:22
📝 Summary: A vulnerability in Nextcloud Talk Android allowed an external Android app to write and retrieve config files by pinging an internal endpoint.
📂 Report JSON File: 3696266
@hackeronereports

🎯 New Report #3515557: Loss of multisig funds through single malicious participant's deliberate deception
🔺Severity: Medium
👽 Reporter: k-privacy-enjoyer
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-01-18
⏰ Disclosed: 2026-08-20 23:47:36
📝 Summary: A vulnerability was discovered in the Monero multisig implementation. A single malicious participant of a multisig could trick other users into sending funds multiple times to a certain recipient, which could not be easily distinguished from a legitimate user action. This issue was caused by the inability to view the inputs of partially signed multisig transactions, and the lack of a mechanism to deliberately select the same inputs when re-creating a transaction.
📂 Report JSON File: 3515557
@hackeronereports