Bug Bounty

HackerOne Bug Bounty Disclosure: link-shortener-bypass-(regression-on-fix-for-#1032610)byjub0bs

December 12, 2022

Programme HackerOne Twitter Twitter Submitted by jub0bs jub0bs Report Link-shortener bypass (regression on fix for #1032610) Full Report A considerable...

HackerOne Bug Bounty Disclosure: cd=false-(dnssec)-not-respected-in-dns-over-https-json-requestsbymattipv4

December 12, 2022

Programme HackerOne Cloudflare Public Bug Bounty Cloudflare Public Bug Bounty Submitted by mattipv4 mattipv4 Report cd=false (DNSSEC) not respected in...

HackerOne Bug Bounty Disclosure: unauthorized-access-to-resumes-stored-on-linkedinbyheadhunter

December 7, 2022

Programme HackerOne LinkedIn LinkedIn Submitted by headhunter headhunter Report Unauthorized access to resumes stored on LinkedIn Full Report A considerable...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – Reflected Cross Site Scripting (XSS) on https://gamemaker.io/account/dashboard – By abitsec

December 7, 2022

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

HackerOne Bug Bounty Disclosure: unprotected-atlantis-server-at-https://152-70–byshuvam321

December 6, 2022

Programme HackerOne 8x8 8x8 Submitted by shuvam321 shuvam321 Report Unprotected Atlantis Server at https://152.70.. Full Report A considerable amount of...

HackerOne Bug Bounty Disclosure: xss-in-linktr-ee—on-link-thumbnail-addingbyjagata

December 6, 2022

Programme HackerOne Linktree Linktree Submitted by jagata jagata Report XSS in linktr.ee - on link thumbnail adding Full Report A...

HackerOne Bug Bounty Disclosure: idor-in-stats-api-endpoint-allows-viewing-equity-or-net-profit-of-any-mt-accountbyashwarya

December 5, 2022

Programme HackerOne EXNESS EXNESS Submitted by ashwarya ashwarya Report IDOR in Stats API Endpoint Allows Viewing Equity or Net Profit...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – HTML Injection > licensing.fcc.gov‏‏‏‏‏‏‏‏‏‏ – By Naplon

December 5, 2022

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

HackerOne Bug Bounty Disclosure: authentication-bypass-in-https://nin-mtn-ngbyroland_hack

December 2, 2022

Programme HackerOne MTN Group MTN Group Submitted by roland_hack roland_hack Report Authentication bypass in https://nin.mtn.ng Full Report A considerable amount...

HackerOne Bug Bounty Disclosure: calendar-name-length-not-validated-before-writing-to-databasebyerrorx404

December 1, 2022

Programme HackerOne Nextcloud Nextcloud Submitted by errorx404 errorx404 Report Calendar name length not validated before writing to database Full Report...

HackerOne Bug Bounty Disclosure: firebase-database-takeover-in-https://pulseradio-mtn-co-ug/byshuvam321

December 1, 2022

Programme HackerOne MTN Group MTN Group Submitted by shuvam321 shuvam321 Report Firebase Database Takeover in https://pulseradio.mtn.co.ug/ Full Report A considerable...

HackerOne Bug Bounty Disclosure: double-evaluation-in–bash_prompt-of-dotfiles-allows-a-malicious-repository-to-execute-arbitrary-commandsbyryotak

December 1, 2022

Programme HackerOne Ian Dunn Ian Dunn Submitted by ryotak ryotak Report Double evaluation in .bash_prompt of dotfiles allows a malicious...

HackerOne Bug Bounty Disclosure: cve-2022-45402:-apache-airflow:-open-redirect-during-loginbybugra

December 1, 2022

Programme HackerOne Internet Bug Bounty Internet Bug Bounty Submitted by bugra bugra Report CVE-2022-45402: Apache Airflow: Open redirect during login...

HackerOne Bug Bounty Disclosure: remove-every-user,-admin,-and-owner-out-of-their-teams-on-developers-mtn-com-via-idor-+-information-disclosurebywallotry

December 1, 2022

Programme HackerOne MTN Group MTN Group Submitted by wallotry wallotry Report Remove Every User, Admin, And Owner Out Of Their...

HackerOne Bug Bounty Disclosure: unprotected-direct-object-referencebycoyemerald

December 1, 2022

Programme HackerOne MTN Group MTN Group Submitted by coyemerald coyemerald Report Unprotected Direct Object Reference Full Report A considerable amount...

HackerOne Bug Bounty Disclosure: if-the-website-does-not-impose-additional-defense-against-csrf-attacks,-failing-to-use-the-‘lax’-or-‘strict’-values-could-increase-the-risk-of-exposurbyshubhangirathore836

November 30, 2022

Programme HackerOne Yelp Yelp Submitted by shubhangirathore836 shubhangirathore836 Report If the website does not impose additional defense against CSRF attacks,...

HackerOne Bug Bounty Disclosure: i-found-some-api-keys-in-js-files-,huge-leak-of–token-addresses-and-huge-amount-of-js-files-are-not-forbiddenbyorange_h

November 29, 2022

Programme HackerOne AMBER AI AMBER AI Submitted by orange_h orange_h Report I found some api keys in js files ,huge...

HackerOne Bug Bounty Disclosure: stored-xss-in-dovetale-by-application-of-creatorbykun_19

November 29, 2022

Programme HackerOne Shopify Shopify Submitted by kun_19 kun_19 Report Stored XSS in Dovetale by application of creator Full Report A...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – Vulnerable to Log4j – By Ractiurd

November 28, 2022

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – Information Disclosure of sensitive data CVE-2017-5487 – By technoking

November 28, 2022

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – Reflected XSS – By mewtw0

November 28, 2022

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – HTML Injection in meeting owner email – By mega7

November 28, 2022

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – Panel access at https://news-push-88.op-mobile.opera.com/. – By rahul0x01

November 28, 2022

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – Publisher owner doesn’t able to delete low privilege user – By AlWaYsHuNt

November 28, 2022

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

Bug Bounty

HackerOne Bug Bounty Disclosure: link-shortener-bypass-(regression-on-fix-for-#1032610)byjub0bs

HackerOne Bug Bounty Disclosure: cd=false-(dnssec)-not-respected-in-dns-over-https-json-requestsbymattipv4

HackerOne Bug Bounty Disclosure: unauthorized-access-to-resumes-stored-on-linkedinbyheadhunter

BugCrowd Bug Bounty Disclosure: – Reflected Cross Site Scripting (XSS) on https://gamemaker.io/account/dashboard – By abitsec

HackerOne Bug Bounty Disclosure: unprotected-atlantis-server-at-https://152-70–byshuvam321

HackerOne Bug Bounty Disclosure: xss-in-linktr-ee—on-link-thumbnail-addingbyjagata

HackerOne Bug Bounty Disclosure: idor-in-stats-api-endpoint-allows-viewing-equity-or-net-profit-of-any-mt-accountbyashwarya

BugCrowd Bug Bounty Disclosure: – HTML Injection > licensing.fcc.gov‏‏‏‏‏‏‏‏‏‏ – By Naplon

HackerOne Bug Bounty Disclosure: authentication-bypass-in-https://nin-mtn-ngbyroland_hack

HackerOne Bug Bounty Disclosure: calendar-name-length-not-validated-before-writing-to-databasebyerrorx404

HackerOne Bug Bounty Disclosure: firebase-database-takeover-in-https://pulseradio-mtn-co-ug/byshuvam321

HackerOne Bug Bounty Disclosure: double-evaluation-in–bash_prompt-of-dotfiles-allows-a-malicious-repository-to-execute-arbitrary-commandsbyryotak

HackerOne Bug Bounty Disclosure: cve-2022-45402:-apache-airflow:-open-redirect-during-loginbybugra

HackerOne Bug Bounty Disclosure: remove-every-user,-admin,-and-owner-out-of-their-teams-on-developers-mtn-com-via-idor-+-information-disclosurebywallotry

HackerOne Bug Bounty Disclosure: unprotected-direct-object-referencebycoyemerald

HackerOne Bug Bounty Disclosure: if-the-website-does-not-impose-additional-defense-against-csrf-attacks,-failing-to-use-the-‘lax’-or-‘strict’-values-could-increase-the-risk-of-exposurbyshubhangirathore836

HackerOne Bug Bounty Disclosure: i-found-some-api-keys-in-js-files-,huge-leak-of–token-addresses-and-huge-amount-of-js-files-are-not-forbiddenbyorange_h

HackerOne Bug Bounty Disclosure: stored-xss-in-dovetale-by-application-of-creatorbykun_19

BugCrowd Bug Bounty Disclosure: – Vulnerable to Log4j – By Ractiurd

BugCrowd Bug Bounty Disclosure: – Information Disclosure of sensitive data CVE-2017-5487 – By technoking

BugCrowd Bug Bounty Disclosure: – Reflected XSS – By mewtw0

BugCrowd Bug Bounty Disclosure: – HTML Injection in meeting owner email – By mega7

BugCrowd Bug Bounty Disclosure: – Panel access at https://news-push-88.op-mobile.opera.com/. – By rahul0x01

BugCrowd Bug Bounty Disclosure: – Publisher owner doesn’t able to delete low privilege user – By AlWaYsHuNt

HackerOne Bug Bounty Disclosure: ability-to-add-and-verify-uncontrolled-mobile-numbers-leading-to-account-takeover-ato-trev-ck

HackerOne Bug Bounty Disclosure: sensitive-api-key-leakage-hemant

[FOG] – Ransomware Victim: Pampili (pampili[.]com[.]br)

[BIANLIAN] – Ransomware Victim: Keystone Pacific Property Management LLC

[BIANLIAN] – Ransomware Victim: Mosley Glick O’Brien, Inc[.]

You may have missed