Hackerone Reports

🎯 New Report #3930102: CORS Misconfiguration / Broken Access Control
🔺Severity: null
👽 Reporter: shubham71
⭐️ Reputation: 109
🛠 State: resolved
💼 Team: Myndr
💵 Bounty: null
🕐 Submitted: 2026-08-10
⏰ Disclosed: 2026-09-10 08:16:39
📝 Summary: A CORS misconfiguration was discovered on the admin panel that allowed any website hosted on a subdomain of the target organization to read authenticated admin responses, including CSRF nonces and session data. This vulnerability could have enabled full admin account takeover through a CSRF attack.
📂 Report JSON File: 3930102
@hackeronereports

🎯 New Report #3788482: Stack Buffer Overflow in mariadb-dump quote name() Allows Malicious Server to Execute Arbitrary Code on Client
🔺Severity: Critical
👽 Reporter: byteoverride
⭐️ Reputation: 210
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-06-08
⏰ Disclosed: 2026-09-08 13:30:27
📝 Summary: A stack buffer overflow was discovered in the quote name() function of the mariadb-dump client application. The overflow occurred due to a lack of length validation on table names returned by a malicious MySQL server. This allowed a server to provide an excessively long table name that would overflow the fixed-size buffer, leading to the overwriting of the return address and other control-flow data on the stack. The vulnerability was confirmed to provide full control of the instruction pointer and several general-purpose registers, enabling remote code execution against any mariadb-dump client that connected to the malicious server.
📂 Report JSON File: 3788482
@hackeronereports

🎯 New Report #3897914: Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking
🔺Severity: High
👽 Reporter: pinebudweiser
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-29
⏰ Disclosed: 2026-09-08 08:19:08
📝 Summary: A vulnerability was discovered in MariaDB where the key part->fieldnr value parsed from a crafted .frm file was not validated before being used as an index into the share->field[] array. This resulted in an out-of-bounds read, allowing an attacker to hijack the C virtual method call and achieve arbitrary code execution within the context of the MariaDB server process. The vulnerability was successfully reproduced on MariaDB versions 10.4.18, 11.8.8, 12.3.2, and 13.1.0 Preview.
📂 Report JSON File: 3897914
@hackeronereports

🎯 New Report #3889667: ACL cache collision lets a role inherit privileges from a same-named socket user
🔺Severity: null
👽 Reporter: dogeshark
⭐️ Reputation: 403
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-25
⏰ Disclosed: 2026-09-07 19:55:04
📝 Summary: A vulnerability was discovered in MariaDB's database privilege cache where a role and a UNIX-socket user with the same name were not distinguished. When the socket user warmed the cache with their privileges, a different account that activated the same-named role then received the cached user privileges, even though those privileges were never granted to the role.
📂 Report JSON File: 3889667
@hackeronereports

🎯 New Report #3897588: KILL authorization trusts the presented login name instead of the authenticated anonymous account
🔺Severity: null
👽 Reporter: dogeshark
⭐️ Reputation: 403
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-28
⏰ Disclosed: 2026-09-07 19:55:50
📝 Summary: A vulnerability was discovered in the KILL authorization process of a database management system. The vulnerability allowed an anonymous account to terminate connections using a supplied login name, even if the authenticated identity was different. This was because the KILL authorization relied on the presented login name instead of the authenticated account identity.
📂 Report JSON File: 3897588
@hackeronereports

🎯 New Report #3909248: MariaDB: heap buffer overflow in ha tina::chain append() lets a low-privileged user crash the server via CSV row deletion
🔺Severity: Medium
👽 Reporter: v3rtical
⭐️ Reputation: 153
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-08-02
⏰ Disclosed: 2026-09-07 19:59:03
📝 Summary: A heap buffer overflow vulnerability was discovered in the ha tina::chain append() function of the MariaDB database server. The vulnerability was caused by an incorrect memory allocation during the growth of a data structure. This could allow a low-privileged user to crash the server by executing a specific SQL command involving CSV data deletion. The vulnerability was confirmed to affect both the stock Ubuntu package and a source build of MariaDB.
📂 Report JSON File: 3909248
@hackeronereports

🎯 New Report #3876430: MariaDB GRANT PROXY permits unauthorized authentication changes and administrator account takeover
🔺Severity: High
👽 Reporter: kevin mizu
⭐️ Reputation: 6792
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-20
⏰ Disclosed: 2026-09-07 20:07:40
📝 Summary: A vulnerability was discovered in MariaDB that allowed an authenticated user with only USAGE privileges to change the password of an existing administrator account. This was achieved through the grantee clause of the GRANT PROXY statement, which permitted bypassing the authorization checks and directly modifying the target account's authentication information. The vulnerability was tested on MariaDB versions 12.3.2 and 13.1.0.
📂 Report JSON File: 3876430
@hackeronereports

🎯 New Report #3828431: PII Exposure of Credit Applications and Social Security Numbers equifax-6070.my.salesforce-sites.com (Salesforce guest user)
🔺Severity: High
👽 Reporter: dr32
⭐️ Reputation: 432
🛠 State: resolved
💼 Team: Equifax-vdp
💵 Bounty: null
🕐 Submitted: 2026-06-27
⏰ Disclosed: 2026-09-06 10:03:04
📝 Summary: A Salesforce community portal belonging to Equifax was found to be leaking tens of thousands of credit reports and other sensitive financial information. The portal's Salesforce guest user profile and sharing settings granted unauthenticated access to multiple objects, including Contact, Online Credit Application c, and related financial data. This exposure allowed an anonymous user to read a large number of records containing sensitive personally identifiable information.
📂 Report JSON File: 3828431
@hackeronereports

🎯 New Report #3534050: Activity app does not verify federated file activity received from remote servers
🔺Severity: Low
👽 Reporter: cyebrsunita
⭐️ Reputation: 146
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: 150
🕐 Submitted: 2026-02-01
⏰ Disclosed: 2026-09-05 14:18:55
📝 Summary: The activity app stored activity content received from remote servers without verifying the content first.
📂 Report JSON File: 3534050
@hackeronereports

🎯 New Report #3521646: Missing Duplicate Check allowing Multiple Retention Rules per System Tag
🔺Severity: Low
👽 Reporter: charankumar39
⭐️ Reputation: 109
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-01-23
⏰ Disclosed: 2026-09-05 14:23:50
📝 Summary: A bug allowed admins to create multiple retention rules for the same tag, causing potential confusion for other admins.
📂 Report JSON File: 3521646
@hackeronereports

🎯 New Report #3521639: Improper Input Validation and Integer Overflow in timeamount parameter of files retention app
🔺Severity: Low
👽 Reporter: nishantbaswal1996
⭐️ Reputation: 109
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-01-23
⏰ Disclosed: 2026-09-05 14:29:27
📝 Summary: The timeamount parameter of the files retention app lacked proper input validation, allowing an administrator to store an unintended long time amount as the retention period. This vulnerability could have potentially led to files never getting deleted.
📂 Report JSON File: 3521639
@hackeronereports

🎯 New Report #3507273: Email Enumeration via Password-Protected Share Identity Verification
🔺Severity: Low
👽 Reporter: cybershinu90
⭐️ Reputation: 92
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: 100
🕐 Submitted: 2026-01-12
⏰ Disclosed: 2026-09-05 14:38:27
📝 Summary: The vulnerability allowed email enumeration through password-protected share identity verification. Requesting a password for an email share resulted in different response messages depending on whether the email address was the intended recipient, enabling confirmation of the share recipient.
📂 Report JSON File: 3507273
@hackeronereports

🎯 New Report #3513471: Unauthenticated testing endpoint of notify push expose internal IP
🔺Severity: Medium
👽 Reporter: chinnuy935336
⭐️ Reputation: 114
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: 150
🕐 Submitted: 2026-01-16
⏰ Disclosed: 2026-09-05 14:45:39
📝 Summary: The testing endpoint of the notify push component exposed internal IP addresses to unauthenticated users.
📂 Report JSON File: 3513471
@hackeronereports

🎯 New Report #3617729: Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope
🔺Severity: Medium
👽 Reporter: njh215
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-20
⏰ Disclosed: 2026-09-04 20:38:01
📝 Summary: A vulnerability was discovered in the Mail contact autocomplete feature of Nextcloud that allowed an authenticated user to bypass administrator-configured user enumeration restrictions and expose member information outside the intended scope. The vulnerability was present in the ContactIntegrationController::autoComplete() handler, which did not apply the stricter user enumeration controls used elsewhere in the product.
📂 Report JSON File: 3617729
@hackeronereports

🎯 New Report #3521434: View-only guests could see deleted Collectives pages in the trashbin
🔺Severity: Low
👽 Reporter: yoyomiski
⭐️ Reputation: 1031
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-01-23
⏰ Disclosed: 2026-05-08 08:35:48
📝 Summary: A vulnerability was discovered where view-only guests could see deleted Collectives pages in the trashbin.
📂 Report JSON File: 3521434
@hackeronereports

🎯 New Report #3898281: Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate
🔺Severity: High
👽 Reporter: type5afe
⭐️ Reputation: 157
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-07-29
⏰ Disclosed: 2026-09-04 08:10:22
📝 Summary: A vulnerability was discovered in Weblate, an open-source translation management system. The vulnerability was caused by the search query grammar implementation in Weblate, which was built using the pyparsing library. The grammar was ambiguous at every position and did not enable memoization, leading to exponential backtracking during parsing of search queries with nested parentheses. This resulted in a significant performance impact, with a 33-byte query string consuming 52 seconds of CPU time. The parsing was performed while holding a process-global lock, causing all other search, browse, translate, and zen page requests to stall in the same worker process.
📂 Report JSON File: 3898281
@hackeronereports

🎯 New Report #3825141: API token sent to URL dictated by an untrusted project .weblate file
🔺Severity: Medium
👽 Reporter: type5afe
⭐️ Reputation: 157
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-06-25
⏰ Disclosed: 2026-09-04 08:10:51
📝 Summary: A vulnerability was discovered in the wlc Python library used to interact with the Weblate translation management system. The vulnerability allowed an untrusted .weblate file to specify the Weblate API URL, which could then receive the API token set in the environment. The API token was resolved independently and was not bound to a trusted URL source, allowing the secret to be sent to an attacker-chosen server.
📂 Report JSON File: 3825141
@hackeronereports

🎯 New Report #3769676: Stack Overflow DoS in ST GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire Server
🔺Severity: Medium
👽 Reporter: byteoverride
⭐️ Reputation: 210
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-05-29
⏰ Disclosed: 2026-09-03 22:13:55
📝 Summary: A vulnerability was discovered in the MariaDB database server's ST GeomFromGeoJSON function. Any authenticated user with basic SELECT privileges could crash the entire server by passing a deeply nested GeoJSON GeometryCollection. The crash was caused by unbounded recursion in the GeoJSON parser, which consumed the server's stack until it overflowed, leading to a SIGSEGV crash that killed all active connections and required a full server restart. The vulnerability existed since the introduction of ST GeomFromGeoJSON in MariaDB 10.2.4 and affected all versions through the current development trunk.
📂 Report JSON File: 3769676
@hackeronereports

🎯 New Report #3887969: SSRF via URL Parser Differential in `normalize request url` (wlc)
🔺Severity: High
👽 Reporter: dark river
⭐️ Reputation: 179
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-07-24
⏰ Disclosed: 2026-09-02 07:49:35
📝 Summary: The Weblate CLI client (wlc) was found to be vulnerable to Server-Side Request Forgery (SSRF) due to a differential in URL parsing between the urllib and urllib3 libraries. The vulnerability was present in the normalize request url function, which was meant to validate that outgoing API requests stayed on the configured server's origin. However, the actual HTTP request was dispatched by the requests library, which relied on urllib3's URL parser. This allowed an attacker-controlled server to return a crafted URL that passed the origin validation but resulted in the client making a request to an arbitrary host.
📂 Report JSON File: 3887969
@hackeronereports

🎯 New Report #3861550: connect.8x8.com: Deserialization Vulnerability in Automation Builder via Jint→Newtonsoft serializer coercion (TypeNameHandling)
🔺Severity: Critical
👽 Reporter: kyotozzx
⭐️ Reputation: 351
🛠 State: resolved
💼 Team: 8x8
💵 Bounty: 3000
🕐 Submitted: 2026-07-13
⏰ Disclosed: 2026-09-01 23:51:36
📝 Summary: A deserialization vulnerability was reported in the 8x8 Connect Automation Builder's HTTP request step. The vulnerability occurred when server-side template evaluation exposed Newtonsoft JSON objects directly to the Jint JavaScript engine. By providing a specially crafted JSON response, an authenticated user could coerce Jint's overload resolution to construct a JsonSerializer with attacker-controlled TypeNameHandling settings, enabling deserialization of arbitrary .NET types. The issue was addressed by projecting HTTP responses to plain JavaScript values before template evaluation, removing all Newtonsoft object exposure from the template scope.
📂 Report JSON File: 3861550
@hackeronereports