110, https://hackerone.com/reports/110, Login page password-guessing attack, informative 120, https://hackerone.com/reports/120, Missing SPF for hackerone.com, resolved 263, https://hackerone.com/reports/263, Report title autocompletion, resolved 275, https://hackerone.com/reports/275, Flawed account creation process allows registration of usernames corresponding to existing file names, resolved 280, https://hackerone.com/reports/280, Real impersonation, resolved 284, https://hackerone.com/reports/284, Broken Authentication and session management OWASP A2, resolved 288, https://hackerone.com/reports/288, Session Management, resolved 298, https://hackerone.com/reports/298, RTL override symbol not stripped from file names, resolved 321, https://hackerone.com/reports/321, CSP not consistently applied, resolved 345, https://hackerone.com/reports/345, Privilege escalation..., or not?!, resolved 353, https://hackerone.com/reports/353, Session not expired on logout, resolved 390, https://hackerone.com/reports/390, Pixel flood attack, resolved 400, https://hackerone.com/reports/400, GIF flooding, resolved 454, https://hackerone.com/reports/454, PNG compression DoS, resolved 477, https://hackerone.com/reports/477, Flawed account creation process allows registration of usernames corresponding to existing file names, resolved 487, https://hackerone.com/reports/487, DNS Cache Poisoning, resolved 499, https://hackerone.com/reports/499, Ruby: Heap Overflow in Floating Point Parsing, resolved 500, https://hackerone.com/reports/500, OpenSSH: Memory corruption in AES-GCM support, resolved 501, https://hackerone.com/reports/501, TLS Virtual Host Confusion, resolved 523, https://hackerone.com/reports/523, PHP openssl_x509_parse() Memory Corruption Vulnerability, resolved 546, https://hackerone.com/reports/546, Logical issues with account settings, resolved 547, https://hackerone.com/reports/547, CSRF login, resolved 575, https://hackerone.com/reports/575, Email spoofing , resolved 713, https://hackerone.com/reports/713, Upload profile photo from URL, resolved 727, https://hackerone.com/reports/727, Switching the user to the attacker's account, resolved 737, https://hackerone.com/reports/737, Improper session management, resolved 738, https://hackerone.com/reports/738, Information disclosure (reset password token) and changing the user's password, resolved 742, https://hackerone.com/reports/742, A password reset page does not properly validate the authenticity token at the server side., resolved 761, https://hackerone.com/reports/761, Enumeration of users, informative 774, https://hackerone.com/reports/774, Log in a user to another account, resolved 809, https://hackerone.com/reports/809, Improperly implemented password recovery link functionality, resolved 842, https://hackerone.com/reports/842, Autocomplete enabled in Paypal preferences, resolved 914, https://hackerone.com/reports/914, XSS Yahoo Messenger Via Calendar.Yahoo.Com , resolved 916, https://hackerone.com/reports/916, Cross-site scripting on the main page of flickr by tagging a user., resolved 933, https://hackerone.com/reports/933, Java Applet Execution On Y! Messenger, informative 940, https://hackerone.com/reports/940, Store XSS Flicker main page, resolved 1011, https://hackerone.com/reports/1011, XSS using yql and developers console proxy, informative 1066, https://hackerone.com/reports/1066, Bypass of anti-SSRF defenses in YahooCacheSystem (affecting at least YQL and Pipes), informative 1091, https://hackerone.com/reports/1091, Information Disclosure , informative 1092, https://hackerone.com/reports/1092, Directory Traversal , resolved 1171, https://hackerone.com/reports/1171, Security.allowDomain("*") in SWFs on img.autos.yahoo.com allows data theft from Yahoo Mail (and others), resolved 1203, https://hackerone.com/reports/1203, XSS in my yahoo, resolved 1207, https://hackerone.com/reports/1207, clickjacking , informative 1209, https://hackerone.com/reports/1209, Authentication Bypass in Yahoo Groups, informative 1229, https://hackerone.com/reports/1229, ClickJacking on http://au.launch.yahoo.com, informative 1258, https://hackerone.com/reports/1258, Vulnerability found, XSS (Cross site Scripting), informative 1356, https://hackerone.com/reports/1356, PHP Heap Overflow Vulnerability in imagecrop(), resolved 1376, https://hackerone.com/reports/1376, HTML Code Injection , resolved 1407, https://hackerone.com/reports/1407, Yahoo YQL Injection? , informative 1409, https://hackerone.com/reports/1409, Proxy discloses internal web servers, resolved 1425, https://hackerone.com/reports/1425, SSL Not Enforced, resolved 1429, https://hackerone.com/reports/1429, URL Redirection, resolved 1483, https://hackerone.com/reports/1483, HTML Injection on flickr screename using IOS App, resolved 1498, https://hackerone.com/reports/1498, Strict Transport Security on secret.ly, resolved 1509, https://hackerone.com/reports/1509, DNS Misconfiguration, resolved 1533, https://hackerone.com/reports/1533, Flickr: Invitations disclosure (resend feature), resolved 1538, https://hackerone.com/reports/1538, SQLi on http://sports.yahoo.com/nfl/draft, resolved 1553, https://hackerone.com/reports/1553, XSS Reflected - Yahoo Travel, resolved 1620, https://hackerone.com/reports/1620, A csrf vulnerability which add and remove a favorite team from a user account., informative 1675, https://hackerone.com/reports/1675, Local file inclusion , resolved 2101, https://hackerone.com/reports/2101, In Fantasy Sports iOS app, signup page is requested over HTTP, informative 2106, https://hackerone.com/reports/2106, Flash type confusion vulnerability leads to code execution, resolved 2107, https://hackerone.com/reports/2107, Handling of jar: URIs bypasses AllowScriptAccess=never, resolved 2126, https://hackerone.com/reports/2126, Insufficient validation of redirect URL on login page allows hijacking user name and password, informative 2127, https://hackerone.com/reports/2127, HK.Yahoo.Net Remote Command Execution, resolved 2140, https://hackerone.com/reports/2140, Flash local-with-fileaccess Sandbox Bypass, resolved 2168, https://hackerone.com/reports/2168, XSS on Every sports.yahoo.com page, resolved 2170, https://hackerone.com/reports/2170, Flash double free vulnerability leads to code execution, resolved 2193, https://hackerone.com/reports/2193, harvesting attack on user registration, informative 2221, https://hackerone.com/reports/2221, CSS leaks SCSS debug info, resolved 2224, https://hackerone.com/reports/2224, Bypass auth.email-domains, resolved 2228, https://hackerone.com/reports/2228, Login CSRF using Twitter OAuth, resolved 2233, https://hackerone.com/reports/2233, Bypass auth.email-domains (2), resolved 2240, https://hackerone.com/reports/2240, Reflected XSS in mail.yahoo.com, informative 2293, https://hackerone.com/reports/2293, Widespread failure of certificate validation in Android apps, resolved 2322, https://hackerone.com/reports/2322, Yahoo open redirect using ad, informative 2414, https://hackerone.com/reports/2414, open redirect, informative 2421, https://hackerone.com/reports/2421, Value of JSESSIONID and XSRF token parameter in cookie remains same before and after login, resolved 2427, https://hackerone.com/reports/2427, XSRF token problem, resolved 2429, https://hackerone.com/reports/2429, Hackerone Email Addresses Enumeration, informative 2439, https://hackerone.com/reports/2439, Cross Site Scripting (XSS) - app.relateiq.com, resolved 2497, https://hackerone.com/reports/2497, Reflective XSS can be triggered in IE, resolved 2559, https://hackerone.com/reports/2559, Broken Authentication (including Slack OAuth bugs), resolved 2575, https://hackerone.com/reports/2575, Slack OAuth2 "redirect_uri" Bypass , resolved 2582, https://hackerone.com/reports/2582, Session Fixation disclosing email address, informative 2584, https://hackerone.com/reports/2584, Weird Bug - Ability to see partial of other user's notification, resolved 2596, https://hackerone.com/reports/2596, Yahoo mail login page bruteforce protection bypass, informative 2598, https://hackerone.com/reports/2598, http://conf.member.yahoo.com configuration file disclosure, resolved 2617, https://hackerone.com/reports/2617, Stored XSS in www.slack-files.com, resolved 2622, https://hackerone.com/reports/2622, URL redirection flaw, resolved 2625, https://hackerone.com/reports/2625, Stored XSS in username.slack.com, resolved 2628, https://hackerone.com/reports/2628, CSRF vulnerability on https://sehacure.slack.com/account/settings, resolved 2635, https://hackerone.com/reports/2635, csrf, resolved 2638, https://hackerone.com/reports/2638, CSRF on add comment section, resolved 2639, https://hackerone.com/reports/2639, Stored XSS on this link https://sehacure.slack.com/help/requests/, resolved 2652, https://hackerone.com/reports/2652, Stored XSS in Channel Chat , resolved 2688, https://hackerone.com/reports/2688, State parameter missing on google OAuth, resolved 2731, https://hackerone.com/reports/2731, Open redirect vulnerability , informative 2735, https://hackerone.com/reports/2735, HTML injection in "Invite Collaborators", resolved 2746, https://hackerone.com/reports/2746, Data exports stored on S3 can be scraped easily, resolved 2766, https://hackerone.com/reports/2766, Email enumeration, informative 2777, https://hackerone.com/reports/2777, Reflected Xss, resolved 2857, https://hackerone.com/reports/2857, CSRF token valid even after the session logout of a particular user, informative 2926, https://hackerone.com/reports/2926, Stored XSS , resolved 2975, https://hackerone.com/reports/2975, Deleting Teams implemenation, informative 2979, https://hackerone.com/reports/2979, Content Spoofing, informative 3039, https://hackerone.com/reports/3039, SQL Injection ON HK.Promotion, resolved 3227, https://hackerone.com/reports/3227, Control Characters Not Stripped From Username on Signup, resolved 3356, https://hackerone.com/reports/3356, UnAuthorized Editorial Publishing to Blogs, resolved 3370, https://hackerone.com/reports/3370, Directory traversal attack in view resolver, resolved 3432, https://hackerone.com/reports/3432, RelateIQ GWT based application visible to unauthenticated users, informative 3441, https://hackerone.com/reports/3441, Captcha Bypass With Extension, resolved 3455, https://hackerone.com/reports/3455, flash content type sniff vulnerability in api.slack.com, resolved 3577, https://hackerone.com/reports/3577, Authentication bypass at fast.corp.yahoo.com, informative 3578, https://hackerone.com/reports/3578, Clickjacking at surveylink.yahoo.com, informative 3596, https://hackerone.com/reports/3596, OAuth access_token stealing in Phabricator, resolved 3709, https://hackerone.com/reports/3709, Criptographic Issue: Strisct Transport Security with not good max age..(TOO SHORT!), resolved 3722, https://hackerone.com/reports/3722, User impersonation is possible with incoming webhooks, informative 3921, https://hackerone.com/reports/3921, Control character allowed in username, resolved 3923, https://hackerone.com/reports/3923, Adding an user email address to the list before confirming., informative 3930, https://hackerone.com/reports/3930, OAuth Stealing Attack (New), resolved 3986, https://hackerone.com/reports/3986, Securing sensitive pages from SearchBots, resolved 3991, https://hackerone.com/reports/3991, Accepting Invalid characters on email address, resolved 4114, https://hackerone.com/reports/4114, Persistent XSS: Editor link, resolved 4184, https://hackerone.com/reports/4184, javascript: and mailto: links are allowed on users' profiles, resolved 4256, https://hackerone.com/reports/4256, XSS Vulnerability (my.yahoo.com), resolved 4276, https://hackerone.com/reports/4276, Here is another XSS i got for you, resolved 4277, https://hackerone.com/reports/4277, Stored Cross Site Scripting Vulnerability in Yahoo Mail, informative 4359, https://hackerone.com/reports/4359, Almost all the subdomains are infected., informative 4409, https://hackerone.com/reports/4409, TRACE disclosure attack may be possible, resolved 4461, https://hackerone.com/reports/4461, Server Side Request Forgery, resolved 4521, https://hackerone.com/reports/4521, Open URL Redirection, informative 4549, https://hackerone.com/reports/4549, Open Redirect in Slack, informative 4561, https://hackerone.com/reports/4561, Stored XSS in Slackbot Direct Messages, resolved 4570, https://hackerone.com/reports/4570, Open redirect on tw.money.yahoo.com, resolved 4638, https://hackerone.com/reports/4638, Duplicate of #4550, resolved 4689, https://hackerone.com/reports/4689, SPDY memory corruption, resolved 4690, https://hackerone.com/reports/4690, SPDY heap buffer overflow, resolved 4777, https://hackerone.com/reports/4777, XSS in Theme Preview Tools File, resolved 4792, https://hackerone.com/reports/4792, HttpOnly flag not set for cookie on concrete5.org, resolved 4795, https://hackerone.com/reports/4795, Bypass auth.email-domains, resolved 4808, https://hackerone.com/reports/4808, /index.php/dashboard/sitemap/explore/ Cross-site scripting, resolved 4811, https://hackerone.com/reports/4811, dashboard/pages/types [Unknown column 'Array' in 'where clause'] disclosure., resolved 4826, https://hackerone.com/reports/4826, XSS in private message, resolved 4836, https://hackerone.com/reports/4836, From Unrestricted File Upload to Remote Command Execution, resolved 4839, https://hackerone.com/reports/4839, XSS IN member List (Because of City Textbox), resolved 4931, https://hackerone.com/reports/4931, CONCRETE5 - path disclosure., resolved 4938, https://hackerone.com/reports/4938, page_controls_menu_js can reveal collection version of page, resolved 5073, https://hackerone.com/reports/5073, Information Disclosure That shows the webroot of CoinBase Server, informative 5199, https://hackerone.com/reports/5199, Improper Validation of the Referrer header leading to Open URL Redirection, informative 5200, https://hackerone.com/reports/5200, User Enumeration, Information Disclosure and Lack of Rate Limitation on API, informative 5204, https://hackerone.com/reports/5204, Cookie missing the HttpOnly flag , informative 5205, https://hackerone.com/reports/5205, IFRAME loaded from External Domains , informative 5221, https://hackerone.com/reports/5221, Out of date version, informative 5314, https://hackerone.com/reports/5314, Coinbase Android Application - Bitcoin Wallet Leaks OAuth Response Code, resolved 5426, https://hackerone.com/reports/5426, CRITICAL BUG!, resolved 5437, https://hackerone.com/reports/5437, Please contact me @sehacure otherwise i am going to disclose in Full disclosure mailing list :p , informative 5441, https://hackerone.com/reports/5441, Hack administrator password even if you are a guest, resolved 5442, https://hackerone.com/reports/5442, XSS in Yahoo! Web Analytics, resolved 5466, https://hackerone.com/reports/5466, Bug in Source Code Files(v1.1), resolved 5499, https://hackerone.com/reports/5499, Arbitrary command execution in MS-DOS, resolved 5534, https://hackerone.com/reports/5534, Permanent Denial of Service , resolved 5549, https://hackerone.com/reports/5549, History Disclosure of MS-Dos, resolved 5559, https://hackerone.com/reports/5559, Injecting Distrust and Disbelief in Addicted Gamers , resolved 5596, https://hackerone.com/reports/5596, एमएस डॉस प्राणघाती है। , informative 5617, https://hackerone.com/reports/5617, TLS1/SSLv3 Renegotiation Vulnerability, informative 5654, https://hackerone.com/reports/5654, OPTIONS Method Enabled, resolved 5688, https://hackerone.com/reports/5688, User guessing/enumeration at https://app.c2fo.com/api/password-reset, resolved 5691, https://hackerone.com/reports/5691, Password reset token leakage through referrer at https://app.c2fo.com/password/reset/, informative 5786, https://hackerone.com/reports/5786, Coinbase Android Security Vulnerabilities, informative 5928, https://hackerone.com/reports/5928, Uncontrolled Resource Consumption with XMPP-Layer Compression, resolved 5933, https://hackerone.com/reports/5933, Multiple Issues related to registering applications, resolved 5946, https://hackerone.com/reports/5946, Marking notifications as read CSRF bug, resolved 5986, https://hackerone.com/reports/5986, Information Disclosure, groups.yahoo.com,6-april-2014, #SpringClean, informative 6002, https://hackerone.com/reports/6002, Stored XSS in Slack.com, resolved 6017, https://hackerone.com/reports/6017, Facebook Takeover using Slack using 302 from files.slack.com with access_token, resolved 6035, https://hackerone.com/reports/6035, open redirect in https://slack.com, informative 6194, https://hackerone.com/reports/6194, Significant Information Disclosure/Load balancer access, http://extprodweb11.cc.gq1.yahoo.com/, 4/8/14, #SpringClean, resolved 6195, https://hackerone.com/reports/6195, reflected XSS, http://extprodweb11.cc.gq1.yahoo.com/, 4/8/14, #SpringClean, resolved 6268, https://hackerone.com/reports/6268, Cross-origin issue on rmaiauth.ads.vip.bf1.yahoo.com, resolved 6322, https://hackerone.com/reports/6322, Header injection on rmaitrack.ads.vip.bf1.yahoo.com, resolved 6344, https://hackerone.com/reports/6344, http://smarthistory.khanacademy.org/search-results.html XSS, resolved 6350, https://hackerone.com/reports/6350, creating titleless and non-closable bugs , resolved 6352, https://hackerone.com/reports/6352, Dom based XSS https://www.khanacademy.org/, resolved 6353, https://hackerone.com/reports/6353, Wildcard DNS in website, resolved 6357, https://hackerone.com/reports/6357, https://www.khanacademy.org/login open-redirect, resolved 6362, https://hackerone.com/reports/6362, Full Path Disclosure on [smarthistory.khanacademy.org], resolved 6369, https://hackerone.com/reports/6369, Stored XSS {dangerous?} https://www.khanacademy.org/coach/roster/?listId=allStudents, resolved 6370, https://hackerone.com/reports/6370, Possible clickjacking at shop.khanacademy.org, informative 6371, https://hackerone.com/reports/6371, Lighttpd version disclosure / directory listing, resolved 6376, https://hackerone.com/reports/6376, User guessing/enumeration at sw.khanacademy.org, informative 6378, https://hackerone.com/reports/6378, CSRF - Adding/Removing items to cart - shop.khanacademy.org, informative 6380, https://hackerone.com/reports/6380, Same Origin Security Bypass Vulnerability, resolved 6389, https://hackerone.com/reports/6389, Integer overflow in strop.expandtabs, resolved 6409, https://hackerone.com/reports/6409, https://www.khanacademy.org/coach/reports/activity XSS, resolved 6412, https://hackerone.com/reports/6412, Persistent class XSS [the fuck], resolved 6475, https://hackerone.com/reports/6475, https://concrete5.org ::: HeartBleed Attack (CVE-2014-0160), resolved 6488, https://hackerone.com/reports/6488, Weak Ciphers Enabled, resolved 6491, https://hackerone.com/reports/6491, c2fo.com is releasing sensitive Information about Database Configuration., resolved 6504, https://hackerone.com/reports/6504, Session Fixation Found, resolved 6547, https://hackerone.com/reports/6547, (lack of) smtp transport layer security, informative 6564, https://hackerone.com/reports/6564, Open Redirection in SmartHistory KhanAcademy, resolved 6574, https://hackerone.com/reports/6574, Login page password-guessing attack, resolved 6575, https://hackerone.com/reports/6575, XSS at http://smarthistory.khanacademy.org, resolved 6626, https://hackerone.com/reports/6626, TLS heartbeat read overrun, resolved 6665, https://hackerone.com/reports/6665, Comment Spoofing at http://suggestions.yahoo.com/detail/?prop=directory&fid=97721, resolved 6674, https://hackerone.com/reports/6674, REMOTE CODE EXECUTION/LOCAL FILE INCLUSION/XSPA/SSRF, view-source:http://sb*.geo.sp1.yahoo.com/, 4/6/14, #SpringClean, resolved 6697, https://hackerone.com/reports/6697, No Captcha or rate limit on Login Page, resolved 6700, https://hackerone.com/reports/6700, CSRF Token missing on http://baseball.fantasysports.yahoo.com/b1/127146/messages, resolved 6702, https://hackerone.com/reports/6702, CSRF Token is missing on DELETE message option on http://baseball.fantasysports.yahoo.com/b1/127146/messages, resolved 6704, https://hackerone.com/reports/6704, Open Proxy, http://www.smushit.com/ysmush.it/, 4/09/14, #SpringClean, resolved 6794, https://hackerone.com/reports/6794, The server supports only older protocols for HTTPS connections, resolved 6826, https://hackerone.com/reports/6826, Blocking yourself, resolved 6843, https://hackerone.com/reports/6843, Cross-Site Scripting in getMarketplacePurchaseFrame, resolved 6853, https://hackerone.com/reports/6853, XSS on [/concrete/concrete/elements/dashboard/sitemap.php], resolved 6871, https://hackerone.com/reports/6871, Login CSRF, resolved 6872, https://hackerone.com/reports/6872, Sign up CSRF, resolved 6877, https://hackerone.com/reports/6877, Unsecure cookies, cookie flag secure not set, resolved 6883, https://hackerone.com/reports/6883, Bruteforcing irccloud login, resolved 6888, https://hackerone.com/reports/6888, HTML Form without CSRF protection, resolved 6907, https://hackerone.com/reports/6907, Session Token is not Verified while changing Account Setting's which Result In account Takeover, resolved 6910, https://hackerone.com/reports/6910, Full account takeover using CSRF and password reset, resolved 6927, https://hackerone.com/reports/6927, Session cookie can be leaked over an unencrypted HTTP connection, resolved 6935, https://hackerone.com/reports/6935, Missing X-Content-Type-Options, resolved 7033, https://hackerone.com/reports/7033, "SESSION" Cookie without HttpOnly flag set, informative 7036, https://hackerone.com/reports/7036, Bug in iOS application which could lead to unauthorised access., resolved 7041, https://hackerone.com/reports/7041, iOS application does not destroy session upon logout., resolved 7051, https://hackerone.com/reports/7051, User Account Creation CSRF , resolved 7085, https://hackerone.com/reports/7085, DNS Misconfiguration, resolved 7116, https://hackerone.com/reports/7116, CSRF to Account Take Over Bug , resolved 7121, https://hackerone.com/reports/7121, Persistent Cross Site Scripting within the IRCCloud Pastebin , resolved 7226, https://hackerone.com/reports/7226, Login page password-guessing attack(Brute-force attack-High)., informative 7264, https://hackerone.com/reports/7264, Bypass of the Clickjacking protection on Flickr using data URL in iframes, resolved 7266, https://hackerone.com/reports/7266, XSS in https://hk.user.auctions.yahoo.com, resolved 7270, https://hackerone.com/reports/7270, Bruteforce attack in login panel, resolved 7277, https://hackerone.com/reports/7277, TLS Triple Handshake Attack, resolved 7332, https://hackerone.com/reports/7332, CSRF - Creating accounts, resolved 7357, https://hackerone.com/reports/7357, Host Header is not validated resulting in Open Redirect, resolved 7369, https://hackerone.com/reports/7369, 2 factor authentication design flaw, resolved 7436, https://hackerone.com/reports/7436, Unwanted Spamming Using CSRF [LOGGED IN USER], informative 7441, https://hackerone.com/reports/7441, Dangerous Persistent xss, resolved 7516, https://hackerone.com/reports/7516, Log Out Cross site Request Forgery, resolved 7531, https://hackerone.com/reports/7531, Login CSRF can be bypassed (Similar approach to previous one)., resolved 7571, https://hackerone.com/reports/7571, Simplenote Silverlight cross-domain policy misconfiguration, resolved 7608, https://hackerone.com/reports/7608, invite1.us2.msg.vip.bf1.yahoo.com/ - CSRF/email disclosure, resolved 7680, https://hackerone.com/reports/7680, Session Cookie without Secure flag set, informative 7731, https://hackerone.com/reports/7731, ads.yahoo.com Unvalidate open url redirection, informative 7736, https://hackerone.com/reports/7736, FULL PATH DISCLOSUR , resolved 7745, https://hackerone.com/reports/7745, clickjacking on leaving group(flick), informative 7779, https://hackerone.com/reports/7779, Local File Include on marketing-dam.yahoo.com, resolved 7803, https://hackerone.com/reports/7803, Security bypass could lead to information disclosure, resolved 7813, https://hackerone.com/reports/7813, readble .htaccess + Source Code Disclosure (+ .SVN repository), resolved 7843, https://hackerone.com/reports/7843, Session Cookie without Secure flag set, informative 7849, https://hackerone.com/reports/7849, HTML form without CSRF protection, informative 7862, https://hackerone.com/reports/7862, ClickJacking, resolved 7863, https://hackerone.com/reports/7863, HTML Form Without CSRF protection, resolved 7865, https://hackerone.com/reports/7865, Sign-up Form CSRF, resolved 7868, https://hackerone.com/reports/7868, XSS in Groups, resolved 7869, https://hackerone.com/reports/7869, No BruteForce Protection, resolved 7870, https://hackerone.com/reports/7870, Change user settings through CSRF, resolved 7873, https://hackerone.com/reports/7873, Stored XSS, resolved 7876, https://hackerone.com/reports/7876, XSS & HTML injection, resolved 7882, https://hackerone.com/reports/7882, XSS in main page, resolved 7883, https://hackerone.com/reports/7883, Password Policy, resolved 7886, https://hackerone.com/reports/7886, XSS in main page (invitation), resolved 7887, https://hackerone.com/reports/7887, XSS in invite approval, resolved 7888, https://hackerone.com/reports/7888, Unexpected array leaks information about the system, resolved 7890, https://hackerone.com/reports/7890, XSS in Localize.io, resolved 7894, https://hackerone.com/reports/7894, Full path disclosure, resolved 7897, https://hackerone.com/reports/7897, HTML/Javascript possible in "Discussion" section of reviews, resolved 7898, https://hackerone.com/reports/7898, Persistent Cross-site scripting vulnerability settings., resolved 7900, https://hackerone.com/reports/7900, OAuth open redirect, resolved 7903, https://hackerone.com/reports/7903, Path Disclosure (Info Disclosure) in http://www.localize.io, resolved 7909, https://hackerone.com/reports/7909, Business logic Failure - Browser cache management and logout vulnerability., resolved 7913, https://hackerone.com/reports/7913, Import emails from Gmail are activate XSS, resolved 7914, https://hackerone.com/reports/7914, Server header - information disclosure , resolved 7915, https://hackerone.com/reports/7915, Uninitialized variable error message leaks information , resolved 7916, https://hackerone.com/reports/7916, No Cross-Site Request Forgery protection at multiple locations, resolved 7917, https://hackerone.com/reports/7917, Find, private notes Cross-site scripting., resolved 7919, https://hackerone.com/reports/7919, XSS via Email, resolved 7921, https://hackerone.com/reports/7921, Assigning a non-existing role to user causes exception when opening project page, resolved 7923, https://hackerone.com/reports/7923, Apache2 /icons/ folder accessible, resolved 7924, https://hackerone.com/reports/7924, Clickjacking - changing role, resolved 7929, https://hackerone.com/reports/7929, Arbitrary file uploads to Amazon WS., informative 7930, https://hackerone.com/reports/7930, Information Disclosure (Directory Structure), resolved 7931, https://hackerone.com/reports/7931, Issue with remember_user_token, resolved 7936, https://hackerone.com/reports/7936, Login CSRF in Secret.ly, resolved 7941, https://hackerone.com/reports/7941, A Serious Bug on SIGNUP Process!, resolved 7945, https://hackerone.com/reports/7945, x-frame options-sameorigin warning, resolved 7949, https://hackerone.com/reports/7949, DNS Misconfiguration, resolved 7950, https://hackerone.com/reports/7950, User credentials are sent in clear text, informative 7954, https://hackerone.com/reports/7954, Password type input with auto-complete enabled, informative 7962, https://hackerone.com/reports/7962, CSRF in adding phrase., resolved 7968, https://hackerone.com/reports/7968, Sensitive file, resolved 7969, https://hackerone.com/reports/7969, HTTP Strict transport security policy not enabled, resolved 7972, https://hackerone.com/reports/7972, Full Path Disclosure, resolved 7995, https://hackerone.com/reports/7995, XSS in password, resolved 8010, https://hackerone.com/reports/8010, XSS via Email Link, resolved 8013, https://hackerone.com/reports/8013, Full Path Disclosure (2), resolved 8017, https://hackerone.com/reports/8017, Login page password-guessing attack, duplicate 8019, https://hackerone.com/reports/8019, Possible sensitive files, duplicate 8053, https://hackerone.com/reports/8053, X-Content-Type-Options header missing, resolved 8055, https://hackerone.com/reports/8055, Apache Documentation, resolved 8059, https://hackerone.com/reports/8059, X-Content-Type-Options header missing, resolved 8064, https://hackerone.com/reports/8064, Numerous open ports/services, resolved 8082, https://hackerone.com/reports/8082, Password Reset Bug, resolved 8088, https://hackerone.com/reports/8088, Full Path Disclosure (FPD) in www.localize.io, resolved 8090, https://hackerone.com/reports/8090, Full Path Disclosure / Info Disclosure in Creating New Group, resolved 8091, https://hackerone.com/reports/8091, Full Path Disclosure / Info Disclosure in Importing XML Section!, resolved 8093, https://hackerone.com/reports/8093, infinite number of new project creation!, resolved 8102, https://hackerone.com/reports/8102, Making groups in any project without permission , resolved 8104, https://hackerone.com/reports/8104, Deleting groups in any project without permission , resolved 8184, https://hackerone.com/reports/8184, OPTIONS Method Enabled, resolved 8216, https://hackerone.com/reports/8216, Group Creation Via CSRF, resolved 8218, https://hackerone.com/reports/8218, Group Deletion Via CSRF, resolved 8224, https://hackerone.com/reports/8224, Private Project Access Request Accpeted Via CSRF , resolved 8226, https://hackerone.com/reports/8226, Private Project Access Request Invitation Sent Via CSRF , resolved 8239, https://hackerone.com/reports/8239, No Wildcard DNS, resolved 8242, https://hackerone.com/reports/8242, Allowed method disclosure, resolved 8273, https://hackerone.com/reports/8273, Projects Watch or Notifications Settings Change Via CSRF, resolved 8281, https://hackerone.com/reports/8281, https://caldav.calendar.yahoo.com/ - XSS (STORED) , resolved 8284, https://hackerone.com/reports/8284, information disclosure (LOAD BALANCER + URI XSS), resolved 8375, https://hackerone.com/reports/8375, rs.mail.ru - Flash Based XSS, resolved 8448, https://hackerone.com/reports/8448, Xss On http://my.mail.ru/, resolved 8459, https://hackerone.com/reports/8459, Clicjacking on Login panel, resolved 8472, https://hackerone.com/reports/8472, Reflected XSS, resolved 8724, https://hackerone.com/reports/8724, Clickjacking, resolved 8737, https://hackerone.com/reports/8737, Deleting team members, resolved 8767, https://hackerone.com/reports/8767, CSRF in Cloudflare login, resolved 8780, https://hackerone.com/reports/8780, Information Disclosure (FPD) - stopthehacker.com, resolved 8786, https://hackerone.com/reports/8786, jplayer.swf Cross-site scripting, resolved 8803, https://hackerone.com/reports/8803, Admin panel of http://tp-test1.corp.mail.ru/ is acccessible publicly, resolved 8806, https://hackerone.com/reports/8806, Content spoofing /CSRF at https://www.cloudflare.com/ajax/modal-dialog.html, resolved 8817, https://hackerone.com/reports/8817, http://cdnjs.cloudflare.com/ Cross-site scripting 2, resolved 8843, https://hackerone.com/reports/8843, CSRF - Disabling orders at https://panel.stopthehacker.com/manage/disable-order/order/ID, informative 8846, https://hackerone.com/reports/8846, localStorage не чистится после выхода, resolved 8849, https://hackerone.com/reports/8849, csrf on password change functionality , resolved 8862, https://hackerone.com/reports/8862, XSS in Stopthehacker support, resolved 8873, https://hackerone.com/reports/8873, Apache Multiviews are enabled, informative 8920, https://hackerone.com/reports/8920, XSS - http://js.cloudflare.com, informative 8943, https://hackerone.com/reports/8943, System Status Update CSRF, resolved 8996, https://hackerone.com/reports/8996, No Bruteforce Protection, resolved 9008, https://hackerone.com/reports/9008, Criptographic Issue: Strisct Transport Security with not good max age..(TOO SHORT!), resolved 9017, https://hackerone.com/reports/9017, Flash-based XSS in cdnjs.cloudflare.com subdomain, resolved 9031, https://hackerone.com/reports/9031, Cookie missing the Secure flag , informative 9062, https://hackerone.com/reports/9062, No CSRF token used in Phone Verification POST, informative 9088, https://hackerone.com/reports/9088, Atttacker can send "Invitation Request" to a Project that is not even created yet!, resolved 9116, https://hackerone.com/reports/9116, Unproper usage of Mobile Number that will lead to Information Disclosure, informative 9137, https://hackerone.com/reports/9137, Full Path Disclosure, resolved 9148, https://hackerone.com/reports/9148, XSS Reflected - https://www.stopthehacker.com/, resolved 9230, https://hackerone.com/reports/9230, XSS 1, resolved 9256, https://hackerone.com/reports/9256, Full Path Disclosure (FPD) in www.localize.im, resolved 9318, https://hackerone.com/reports/9318, Home page reflected XSS, resolved 9375, https://hackerone.com/reports/9375, Stored XSS in all fields in Basic Google Maps Placemarks Settings, resolved 9391, https://hackerone.com/reports/9391, Xss in CampTix Event Ticketing, resolved 9460, https://hackerone.com/reports/9460, OAuth Bug, resolved 9479, https://hackerone.com/reports/9479, Anti-MIME-Sniffing header X-Content-Type-Options header has not been set., resolved 9485, https://hackerone.com/reports/9485, Multiple Path Disclosure, informative 9516, https://hackerone.com/reports/9516, PHP and Wordpress version disclosure, informative 9522, https://hackerone.com/reports/9522, https://polldaddy.com storage.swf XSS, resolved 9560, https://hackerone.com/reports/9560, Security issue with your "bag" script, resolved 9703, https://hackerone.com/reports/9703, Loadbalancer + URI XSS #3, resolved 9735, https://hackerone.com/reports/9735, Reflected cross site scripting in login page , resolved 9745, https://hackerone.com/reports/9745, Full Path Disclosure (FPD) in www.localize.im, resolved 9774, https://hackerone.com/reports/9774, Stored XSS Found, resolved 9775, https://hackerone.com/reports/9775, Threat control information leak, resolved 9919, https://hackerone.com/reports/9919, SQL injection [дырка в движке форума], resolved 9921, https://hackerone.com/reports/9921, Time based sql injection, resolved 9950, https://hackerone.com/reports/9950, All Active user sessions should be deleted when user change his password!, resolved 10027, https://hackerone.com/reports/10027, Login without SSL-Protection, informative 10037, https://hackerone.com/reports/10037, SQL inj, resolved 10081, https://hackerone.com/reports/10081, SQL , resolved 10109, https://hackerone.com/reports/10109, Flooding mailbox of user, informative 10154, https://hackerone.com/reports/10154, Persistent XSS in afisha.mail.ru, resolved 10186, https://hackerone.com/reports/10186, Old Sessions remain valid after the password change., informative 10297, https://hackerone.com/reports/10297, Stored XSS in slack.com (integrations), resolved 10373, https://hackerone.com/reports/10373, Bypassing Same Origin Policy With JSONP APIs and Flash, resolved 10377, https://hackerone.com/reports/10377, All Active user sessions should be destroyed when user change his password!, resolved 10468, https://hackerone.com/reports/10468, SQL inj, resolved 10554, https://hackerone.com/reports/10554, Bypassing 2FA for BTC transfers, resolved 10563, https://hackerone.com/reports/10563, CSRF on "Set as primary" option on the accounts page, resolved 10577, https://hackerone.com/reports/10577, XSS in Team Only Area, resolved 10767, https://hackerone.com/reports/10767, Yahoo! Messenger v11.5.0.228 emoticons.xml shortcut Value Handling Stack-Based Buffer Overflow, informative 10829, https://hackerone.com/reports/10829, CSRF in function "Set as primary" on accounts page, resolved 10841, https://hackerone.com/reports/10841, User's data leak, resolved 10912, https://hackerone.com/reports/10912, Authentication Bypass due to Session Mismanagement, informative 10927, https://hackerone.com/reports/10927, Content Spoofing vulnerability in Mail.ru mobile, informative 10975, https://hackerone.com/reports/10975, Bug Report, resolved 11073, https://hackerone.com/reports/11073, XSS in gist integration, resolved 11410, https://hackerone.com/reports/11410, XSS in https://e.mail.ru/cgi-bin/lstatic (Limited use), resolved 11414, https://hackerone.com/reports/11414, Infrastructure and Application Admin Interfaces (OWASP‐CM‐007), resolved 11625, https://hackerone.com/reports/11625, Subscribe User bug, resolved 11722, https://hackerone.com/reports/11722, Simultaneous Session Logon : Improper Session Management, informative 11729, https://hackerone.com/reports/11729, Path Disclosure Vulnerability, not-applicable 11828, https://hackerone.com/reports/11828, Password reset threshold not set, informative 11861, https://hackerone.com/reports/11861, SQL injection update.mail.ru, resolved 11919, https://hackerone.com/reports/11919, Stored XSS on http://top.mail.ru, resolved 11927, https://hackerone.com/reports/11927, Stored XSS on http://cards.mail.ru, resolved 11945, https://hackerone.com/reports/11945, HTTP Strict Transport Security (HSTS) Policy Not Enabled, informative 11951, https://hackerone.com/reports/11951, SSH Port Wide Open, informative 12011, https://hackerone.com/reports/12011, TESTING FOR REFLECTED CROSS SITE SCRIPTING (OWASP‐DV‐001), resolved 12034, https://hackerone.com/reports/12034, CSRF and No password requirement in this URL Billing Info, resolved 12035, https://hackerone.com/reports/12035, http://us.rd.yahoo.com/, informative 12042, https://hackerone.com/reports/12042, Login password guessing attack, resolved 12297, https://hackerone.com/reports/12297, Python vulnerability: reading arbitrary process memory, resolved 12341, https://hackerone.com/reports/12341, MISSING SPF (Sender Policy Framework) for meteorapm.com, resolved 12355, https://hackerone.com/reports/12355, Undeletable File, resolved 12389, https://hackerone.com/reports/12389, XSS in the input, resolved 12425, https://hackerone.com/reports/12425, API keys being cached , informative 12453, https://hackerone.com/reports/12453, Strict Transport Security Misconfiguration, resolved 12454, https://hackerone.com/reports/12454, Browser cross-site scripting filter misconfiguration, resolved 12457, https://hackerone.com/reports/12457, Content Sniffing not disabled, resolved 12497, https://hackerone.com/reports/12497, Adobe Flash Player FileReference Use-after-Free Vulnerability, resolved 12506, https://hackerone.com/reports/12506, Content Sniffing not disabled, resolved 12583, https://hackerone.com/reports/12583, XXE and SSRF on webmaster.mail.ru, resolved 12588, https://hackerone.com/reports/12588, XSS in a file or folder name, resolved 12613, https://hackerone.com/reports/12613, X-Content-Type-Options header missing, resolved 12617, https://hackerone.com/reports/12617, Account hijacking possible through ADB backup feature, resolved 12685, https://hackerone.com/reports/12685, Authorization issue on creative.yahoo.com, resolved 12708, https://hackerone.com/reports/12708, Testing for user enumeration (OWASP‐AT‐002) - https://gh.bouncer.login.yahoo.com, resolved 12782, https://hackerone.com/reports/12782, Spamming any user from Reset Password Function, not-applicable 12794, https://hackerone.com/reports/12794, Раскрытие путей сервера за счёт неопределённого индекса в сценарии /home/berserk-online.com/public_html/forum/Themes/berserker/Profile.template.php, resolved 12804, https://hackerone.com/reports/12804, Reflected XSS in User-Agent, resolved 12815, https://hackerone.com/reports/12815, Improper filtering of classes used in codeblocks in Markdown, resolved 12836, https://hackerone.com/reports/12836, missing sender policy framework (SPF), resolved 12929, https://hackerone.com/reports/12929, Reflected XSS connect.mail.ru (IE6-IE8), resolved 12949, https://hackerone.com/reports/12949, Open Redirection, resolved 12964, https://hackerone.com/reports/12964, Open URL Redirection, resolved 12977, https://hackerone.com/reports/12977, secret app for iOS and android is sending some info over HTTP, resolved 13195, https://hackerone.com/reports/13195, auth.mail.ru: XSS in login form, resolved 13200, https://hackerone.com/reports/13200, (m.mail.ru) Password type input with auto-complete enabled , informative 13237, https://hackerone.com/reports/13237, full path disclosure from false language, resolved 13285, https://hackerone.com/reports/13285, Suffix of url-path is vulnerable to XSS-attack, resolved 13286, https://hackerone.com/reports/13286, Host Header Injection - irccloud.com, resolved 13302, https://hackerone.com/reports/13302, api.video.mail.ru: XSS, resolved 13313, https://hackerone.com/reports/13313, files.mail.ru: XSS, resolved 13314, https://hackerone.com/reports/13314, CRLF Injection, informative 13319, https://hackerone.com/reports/13319, touch.afisha.mail.ru: XSS, resolved 13482, https://hackerone.com/reports/13482, https://217.69.135.63/rb/: money.mail.ru sources disclosure, resolved 13506, https://hackerone.com/reports/13506, Unchecking hidden parameter is vulnerable to XSS-attack, informative 13550, https://hackerone.com/reports/13550, Click jacking, resolved 13551, https://hackerone.com/reports/13551, HTML5 cross-origin resource sharing, resolved 13553, https://hackerone.com/reports/13553, Url Redirection, informative 13555, https://hackerone.com/reports/13555, Login CSRF using Twitter oauth, resolved 13557, https://hackerone.com/reports/13557, Leaking of password reset token through referer, informative 13563, https://hackerone.com/reports/13563, Missing SPF for factlink.com and Staging.factlink.com, resolved 13567, https://hackerone.com/reports/13567, Password Complexity very low., resolved 13583, https://hackerone.com/reports/13583, Sign up CSRF, resolved 13602, https://hackerone.com/reports/13602, Session not expired on logout, informative 13628, https://hackerone.com/reports/13628, Password type input with auto-complete enabled, informative 13634, https://hackerone.com/reports/13634, Missing Character Restriction, informative 13639, https://hackerone.com/reports/13639, X/Csrf token problem, resolved 13652, https://hackerone.com/reports/13652, Proxy service crash DoS, resolved 13679, https://hackerone.com/reports/13679, Meta characters not filtered on signup, resolved 13703, https://hackerone.com/reports/13703, xss in app.simplenote.com, resolved 13705, https://hackerone.com/reports/13705, logout csrf app.simplenote.com/logout, resolved 13746, https://hackerone.com/reports/13746, xss in simperium.com, resolved 13748, https://hackerone.com/reports/13748, Potential denial of service in hackerone.com/teams/new, resolved 13794, https://hackerone.com/reports/13794, XSS on gravatar, resolved 13856, https://hackerone.com/reports/13856, CSRF in crashlytics.com, resolved 13939, https://hackerone.com/reports/13939, information disclosure, resolved 13959, https://hackerone.com/reports/13959, privilege escalation, resolved 14033, https://hackerone.com/reports/14033, connect.mail.ru: SSRF, resolved 14080, https://hackerone.com/reports/14080, XSS in "About Video" , resolved 14092, https://hackerone.com/reports/14092, Remote file Inclusion - RFI in upload, informative 14127, https://hackerone.com/reports/14127, SSRF on https://whitehataudit.slack.com/account/photo, resolved 14177, https://hackerone.com/reports/14177, Token remains alive ever after logging out!, informative 14199, https://hackerone.com/reports/14199, uclfinal.twitter.com and euro2012.twitter.com are vulnerable to CRIME attack, informative 14248, https://hackerone.com/reports/14248, Multiple vulnerabilities, resolved 14303, https://hackerone.com/reports/14303, http://jetpack.me/ Self XSS, resolved 14305, https://hackerone.com/reports/14305, genericons.com - DOM based XSS., resolved 14461, https://hackerone.com/reports/14461, Password reset link doesn't expire., resolved 14485, https://hackerone.com/reports/14485, Flash XSS - http://hi-tech.mail.ru/, resolved 14494, https://hackerone.com/reports/14494, Clickjacking & CSRF attack can be done at https://app.mavenlink.com/login, resolved 14529, https://hackerone.com/reports/14529, The web application https://mavenlink.com discloses version details of the underlying Platform / Server, informative 14570, https://hackerone.com/reports/14570, Login password guessing attack, resolved 14631, https://hackerone.com/reports/14631, Clickjacking at https://www.mavenlink.com/ main website , resolved 14747, https://hackerone.com/reports/14747, Anonymous Proxy and IP leak , resolved 14803, https://hackerone.com/reports/14803, Serving Transitions From: HTTP Protocol (not secure), informative 14883, https://hackerone.com/reports/14883, [mobile.twitter.com / twitter.com] CSRF protection bypass, resolved 15047, https://hackerone.com/reports/15047, Captcha bypass with extension at http://www.mopub.com/about/contact/, informative 15125, https://hackerone.com/reports/15125, XSS vulnerability in video player page, resolved 15166, https://hackerone.com/reports/15166, Password reset token not expiring, resolved 15232, https://hackerone.com/reports/15232, Cookie not marked as secure., resolved 15250, https://hackerone.com/reports/15250, Flash XSS in http://lingvo.mail.ru, resolved 15298, https://hackerone.com/reports/15298, Open Redirect via Request-URI, resolved 15330, https://hackerone.com/reports/15330, Flash XSS in http://go.mail.ru, resolved 15356, https://hackerone.com/reports/15356, XSS ON MOPUB.COM, resolved 15362, https://hackerone.com/reports/15362, Flash Sandbox Bypass, resolved 15412, https://hackerone.com/reports/15412, Leaking CSRF token over HTTP resulting in CSRF protection bypass, resolved 15454, https://hackerone.com/reports/15454, NO CSRF token found on user details update, resolved 15476, https://hackerone.com/reports/15476, Session Token is not Verified while changing Account Setting's which Result In account Takeover, resolved 15492, https://hackerone.com/reports/15492, [corp.mail.ru] CRLF Injection / Insecure nginx configuration, resolved 15518, https://hackerone.com/reports/15518, Criptographic Issue: Strisct Transport Security with not good max age..(TOO SHORT!), resolved 15574, https://hackerone.com/reports/15574, Reporting Bugs, resolved 15578, https://hackerone.com/reports/15578, Same user name and uuid for multiple user names, resolved 15619, https://hackerone.com/reports/15619, Cookie fixation, resolved 15652, https://hackerone.com/reports/15652, Перечисление каталогов за счёт уязвимости в IIS, resolved 15654, https://hackerone.com/reports/15654, Reflected XSS, resolved 15679, https://hackerone.com/reports/15679, Bug on registration as new Translator user, resolved 15762, https://hackerone.com/reports/15762, SQL Injection on 11x11.mail.ru, resolved 15777, https://hackerone.com/reports/15777, Process of changing email address and password does not asks old Password., informative 15785, https://hackerone.com/reports/15785, Session not invalidated after password reset, resolved 15802, https://hackerone.com/reports/15802, Раскрытие полного серверного пути, resolved 15852, https://hackerone.com/reports/15852, Non Validation of session after password reset, resolved 15899, https://hackerone.com/reports/15899, PHP PDOException and Full Path Disclosure, resolved 16315, https://hackerone.com/reports/16315, Abusing VCS control on phabricator, resolved 16330, https://hackerone.com/reports/16330, Multiple issues in looking-glass software (aka from web to BGP injections), resolved 16392, https://hackerone.com/reports/16392, Abusing daemon logs for Privilege escalation under certain scenarios, resolved 16414, https://hackerone.com/reports/16414, Yahoo Sports Fantasy Golf (Join Public Group), resolved 16439, https://hackerone.com/reports/16439, User Enumeration and Guessable User Account Attack on WORDPRESS, informative 16568, https://hackerone.com/reports/16568, Failed Certificate Validation On Custom Server (Register), resolved 16571, https://hackerone.com/reports/16571, SSRF (Portscan) via Register Function (Custom Server), resolved 16696, https://hackerone.com/reports/16696, 2FA settings allowed to be changed with no delay/freeze on funds, informative 16718, https://hackerone.com/reports/16718, Open Redirect login account, resolved 16910, https://hackerone.com/reports/16910, Cross-site information assertion leak via Content Security Policy, resolved 16935, https://hackerone.com/reports/16935, e.mail.ru: SMS spam with custom content, resolved 16967, https://hackerone.com/reports/16967, my.mail.ru: HTTP Header Injection, resolved 17105, https://hackerone.com/reports/17105, Cache leads to Privacy leaks, resolved 17160, https://hackerone.com/reports/17160, Password Policy issue (Weak Protect), resolved 17225, https://hackerone.com/reports/17225, SQL injection, tile ID, resolved 17227, https://hackerone.com/reports/17227, SQL injection, time zoom script, tile ID, resolved 17235, https://hackerone.com/reports/17235, Album image XSS, resolved 17239, https://hackerone.com/reports/17239, Missing HSTS (Strict Transport Security), resolved 17241, https://hackerone.com/reports/17241, Cross-site scripting vulnerability detected, resolved 17252, https://hackerone.com/reports/17252, All Active user sessions should be destroyed when user change his password!, resolved 17256, https://hackerone.com/reports/17256, Language version disclosure in response header , resolved 17287, https://hackerone.com/reports/17287, email field doesn't filtered against XSS, resolved 17297, https://hackerone.com/reports/17297, CMS Information Disclosure, resolved 17299, https://hackerone.com/reports/17299, Cross site scripting in type parameter, resolved 17311, https://hackerone.com/reports/17311, Breach Attack Vulnerability, informative 17312, https://hackerone.com/reports/17312, HTML Form Without CSRF Protection Vulnerability, informative 17315, https://hackerone.com/reports/17315, Clickjacking at https://staging.uzbey.com/, informative 17321, https://hackerone.com/reports/17321, Email Flooding Vuln, resolved 17357, https://hackerone.com/reports/17357, tp-demo1.corp.mail.ru: SVN наружу торчит, resolved 17383, https://hackerone.com/reports/17383, Category- Broken Authentication and Session Management (leads to account compromise if some conditions are met), resolved 17390, https://hackerone.com/reports/17390, Flash Content-Type Sniffing Vulnerability , resolved 17474, https://hackerone.com/reports/17474, Broken Authentication and Session Management, resolved 17502, https://hackerone.com/reports/17502, Price Manipulation, resolved 17506, https://hackerone.com/reports/17506, Default /docs folder of PHPBB3 installation on gamesnet.yahoo.com, resolved 17512, https://hackerone.com/reports/17512, Account takeover, informative 17514, https://hackerone.com/reports/17514, Information Disclosure (phpinfo()), resolved 17540, https://hackerone.com/reports/17540, Reflected XSS in Pastebin-view, resolved 17638, https://hackerone.com/reports/17638, Mass invitation send, informative 17664, https://hackerone.com/reports/17664, Click-Jacking due to missing X-frame header, informative 17688, https://hackerone.com/reports/17688, LZ4 Core, resolved 17766, https://hackerone.com/reports/17766, Tap Jacking Attack on Button Tags, resolved 17785, https://hackerone.com/reports/17785, Denial of Service, resolved 18279, https://hackerone.com/reports/18279, Yahoo! Reflected XSS, resolved 18371, https://hackerone.com/reports/18371, Directory Traversal at http://staging.jsdelivr.net/, resolved 18372, https://hackerone.com/reports/18372, XSS, resolved 18382, https://hackerone.com/reports/18382, Using nmap revealing sensitive information , resolved 18398, https://hackerone.com/reports/18398, HSTS Policy not enabled on cdn.jsdelivr.net, informative 18503, https://hackerone.com/reports/18503, Top 10 2013-A2-Broken Authentication and Session Management - wordpress.com, informative 18691, https://hackerone.com/reports/18691, XSS in editor by any user, resolved 18698, https://hackerone.com/reports/18698, Resubmitted with POC #18685 Password reset CSRF, resolved 18805, https://hackerone.com/reports/18805, XSS 01 on staging.fct.li, resolved 18843, https://hackerone.com/reports/18843, use-after-free vulnerability in Flash Player, resolved 18846, https://hackerone.com/reports/18846, Email changing, informative 18992, https://hackerone.com/reports/18992, Possibility to attach any mobile number to any email, resolved 19210, https://hackerone.com/reports/19210, ClientId gives away platform (iOS/Android) from which a secret was posted., resolved 19334, https://hackerone.com/reports/19334, target.mail.ru: XSS, resolved 19336, https://hackerone.com/reports/19336, target.mail.ru: XSS через Referer, resolved 19363, https://hackerone.com/reports/19363, PHP PDOException and Full Path Disclosure, resolved 19451, https://hackerone.com/reports/19451, IFXSS (image filename XSS) by creating a new Photo Gallery, resolved 19532, https://hackerone.com/reports/19532, Missing "size check" on files to upload could make memory leaks., resolved 19640, https://hackerone.com/reports/19640, Session Hijacking attack (Different Scenario), informative 20049, https://hackerone.com/reports/20049, Cross-site Scripting in mailing (username), resolved 20071, https://hackerone.com/reports/20071, Missing HSTS header in https://public-api.wordpress.com, informative 20072, https://hackerone.com/reports/20072, Missing HSTS header in https://app.simplenote.com, informative 20081, https://hackerone.com/reports/20081, password sent over HTTP, resolved 20122, https://hackerone.com/reports/20122, No option to logout concurrent sessions, informative 20221, https://hackerone.com/reports/20221, Cross Site Scripting (Stored) , resolved 20279, https://hackerone.com/reports/20279, Verbose SQL error messages, resolved 20305, https://hackerone.com/reports/20305, USER Account is not being deleted after user "Delete Account" from DASHBOARD, resolved 20391, https://hackerone.com/reports/20391, m.agent.mail.ru: Подделываем j2me app-descriptor, resolved 20400, https://hackerone.com/reports/20400, files.mail.ru: HTTP Header Injection, resolved 20616, https://hackerone.com/reports/20616, e.mail.ru: File upload "Chapito" circus, resolved 20671, https://hackerone.com/reports/20671, integer overflow in 'buffer' type allows reading memory, resolved 20720, https://hackerone.com/reports/20720, cloud.mail.ru: File upload XSS using Content-Type header, resolved 20861, https://hackerone.com/reports/20861, moderate: mod_deflate denial of service, resolved 20873, https://hackerone.com/reports/20873, rsync hash collisions may allow an attacker to corrupt or modify files, resolved 21034, https://hackerone.com/reports/21034, Invoice Details activate JS that filled in , resolved 21064, https://hackerone.com/reports/21064, Back - Refresh - Attack To Obtain User Credentials, informative 21069, https://hackerone.com/reports/21069, Login CSRF, resolved 21083, https://hackerone.com/reports/21083, Account Hijacking (Only rare case scenario), informative 21110, https://hackerone.com/reports/21110, Clickjacking, resolved 21150, https://hackerone.com/reports/21150, Flash XSS on swfupload.swf showing at app.mavenlink.com, resolved 21172, https://hackerone.com/reports/21172, Cookies are not cleared from Server side on Logout, duplicate 21210, https://hackerone.com/reports/21210, privilege escalation, resolved 21248, https://hackerone.com/reports/21248, Content spoofing at Stripe Integrations, resolved 21603, https://hackerone.com/reports/21603, Bruteforce protection not enabled on the login page https://www.irccloud.com/, informative 21899, https://hackerone.com/reports/21899, caesary.yahoo.net Blind Sql Injection, resolved 22012, https://hackerone.com/reports/22012, Password reset link not validated., informative 22093, https://hackerone.com/reports/22093, Content Spoofing all Integrations in https://team.slack.com/services/new/, resolved 22142, https://hackerone.com/reports/22142, Open Redirect in WordPress Feed Statistics {Affected All Versions}, resolved 22203, https://hackerone.com/reports/22203, Broken authentication and invalidated email address leads to account takeover, informative 22858, https://hackerone.com/reports/22858, Password Reset Links Not Expiring, informative 23010, https://hackerone.com/reports/23010, XSS in 3rd party plugin (not affecting Uzbey's users), resolved 23014, https://hackerone.com/reports/23014, SQL Injection, resolved 23363, https://hackerone.com/reports/23363, Forgot Password Issue, resolved 23386, https://hackerone.com/reports/23386, Redirect while opening links in new tabs, resolved 23447, https://hackerone.com/reports/23447, Version Disclosure (NginX), informative 23579, https://hackerone.com/reports/23579, Broken Authentication and Session Management, resolved 23852, https://hackerone.com/reports/23852, money.mail.ru: Странное поведение SMS, resolved 23913, https://hackerone.com/reports/23913, User's DM won't deleted after logout from Twitter for iOS (com.atebits.xxx.application-state), resolved 23921, https://hackerone.com/reports/23921, broken authentication, resolved 24183, https://hackerone.com/reports/24183, Не уверен, что этому место на периметре: 94.100.180.95, 94.100.180.96, 94.100.180.97, 94.100.180.98, resolved 24684, https://hackerone.com/reports/24684, Potential XSS vulnerability to HTML minification, resolved 24984, https://hackerone.com/reports/24984, openssh-server Forced Command Handling Information Disclosure Vulnerability on blog.greenhouse.io, resolved 25128, https://hackerone.com/reports/25128, HTML form without CSRF protection at http://try.crashlytics.com/enterprise/, resolved 25160, https://hackerone.com/reports/25160, Open redirection on secure.phabricator.com, resolved 25191, https://hackerone.com/reports/25191, SMTP protection not used (please read carefully ), informative 25270, https://hackerone.com/reports/25270, User can request for password reset link without giving his website, eventhough he have it, informative 25275, https://hackerone.com/reports/25275, [greenhouse.io] CRLF Injection / Insecure nginx configuration, resolved 25281, https://hackerone.com/reports/25281, Change Any username and profile link in hackerone, resolved 25382, https://hackerone.com/reports/25382, Apache mod_negotiation filename bruteforcing, informative 25537, https://hackerone.com/reports/25537, external entity expansion in Apache POI , resolved 26181, https://hackerone.com/reports/26181, DNS load balancing not enabled, informative 26395, https://hackerone.com/reports/26395, Notification of previous signed out user leakage., informative 26482, https://hackerone.com/reports/26482, Stored Cross-Site Scripting Vulnerability in /admin.php?/cp/admin_system/general_configuration, resolved 26647, https://hackerone.com/reports/26647, CSRF protection bypass on any Django powered site via Google Analytics, resolved 26758, https://hackerone.com/reports/26758, Password Policy issue, informative 26763, https://hackerone.com/reports/26763, HTTP Strict Transport Policy not enabled on newly made accounts, resolved 26825, https://hackerone.com/reports/26825, Full path disclosure at ads.twitter.com, resolved 26935, https://hackerone.com/reports/26935, XSS via .eml file, resolved 26962, https://hackerone.com/reports/26962, open redirect in rfc6749, resolved 27166, https://hackerone.com/reports/27166, Missing Rate Limiting on https://twitter.com/account/complete, resolved 27404, https://hackerone.com/reports/27404, Delete Credit Cards from any Twitter Account in ads.twitter.com [New Vulnerability], resolved 27511, https://hackerone.com/reports/27511, ads.twitter.com xss, resolved 27564, https://hackerone.com/reports/27564, Content spoofing, informative 27594, https://hackerone.com/reports/27594, Clickjacking: X-Frame-Options header missing, resolved 27651, https://hackerone.com/reports/27651, Flash Local Sandbox Bypass, resolved 27846, https://hackerone.com/reports/27846, Stored xss, resolved 27987, https://hackerone.com/reports/27987, Window Opener Property Bug, resolved 28150, https://hackerone.com/reports/28150, Cross site scripting on ads.twitter.com, resolved 28445, https://hackerone.com/reports/28445, SPL ArrayObject/SPLObjectStorage Unserialization Type Confusion Vulnerabilities, resolved 28449, https://hackerone.com/reports/28449, Active Record SQL Injection Vulnerability Affecting PostgreSQL, resolved 28450, https://hackerone.com/reports/28450, Active Record SQL Injection Vulnerability Affecting PostgreSQL, resolved 28500, https://hackerone.com/reports/28500, iOS App can establish Facetime calls without user's permission, resolved 28632, https://hackerone.com/reports/28632, Email field filtering problem., resolved 28640, https://hackerone.com/reports/28640, Ericsson Erlang OTP Core Allocation Subsystem Integer Overflow (All Versions), resolved 28703, https://hackerone.com/reports/28703, Weak password policy, informative 28792, https://hackerone.com/reports/28792, Content Spoofing through URL, informative 28832, https://hackerone.com/reports/28832, touch.mail.ru XSS via message id, resolved 28865, https://hackerone.com/reports/28865, Redirect FILTER bypass in report/comment, resolved 29185, https://hackerone.com/reports/29185, "early preview" programs disclosure, informative 29206, https://hackerone.com/reports/29206, Twitter Flight SSL 2.0 deprecated protocol vulnerability., resolved 29234, https://hackerone.com/reports/29234, Credit Card Validation Issue, resolved 29328, https://hackerone.com/reports/29328, XSS platform.twitter.com, resolved 29331, https://hackerone.com/reports/29331, No email verification on username change, resolved 29360, https://hackerone.com/reports/29360, XSS platform.twitter.com | video-js metadata, resolved 29480, https://hackerone.com/reports/29480, Unvalidated Channel names causes IRC Command Injection, resolved 29491, https://hackerone.com/reports/29491, homograph attack. IDNs displayed in unicode in bug reports and on external link warning page, resolved 29835, https://hackerone.com/reports/29835, Profile Pic padding (Length-hiding) fails due to use of GZIP, resolved 29839, https://hackerone.com/reports/29839, GNU Bourne-Again Shell (Bash) 'Shellshock' Vulnerability, resolved 30019, https://hackerone.com/reports/30019, Stored XSS in concrete5 5.7.0.4., resolved 30238, https://hackerone.com/reports/30238, New Device confirmation tokens are not properly validated., resolved 30567, https://hackerone.com/reports/30567, Adobe Flash Player MP4 Use-After-Free Vulnerability, resolved 30575, https://hackerone.com/reports/30575, Missing Function Level Access Control in /cindex.php/widget/customize/, resolved 30787, https://hackerone.com/reports/30787, PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings., resolved 30852, https://hackerone.com/reports/30852, Relateiq SSLv3 deprecated protocol vulnerability., resolved 30975, https://hackerone.com/reports/30975, Improper Verification of email address while saving Account Settings, resolved 31023, https://hackerone.com/reports/31023, Sql injection And XSS, resolved 31082, https://hackerone.com/reports/31082, Unauthorized Tweeting on behalf of Account Owners, resolved 31166, https://hackerone.com/reports/31166, Weak Random Number Generator for Auth Tokens, resolved 31167, https://hackerone.com/reports/31167, Timing Attack Side-Channel on API Token Verification, resolved 31168, https://hackerone.com/reports/31168, Cryptographic Side Channel in OAuth Library, resolved 31171, https://hackerone.com/reports/31171, Weak random number generator used in concrete/authentication/concrete/controller.php, resolved 31187, https://hackerone.com/reports/31187, Reflected XSS on www.bookfresh.com/index.html?view=upload_form, resolved 31188, https://hackerone.com/reports/31188, Creating Unauthorized Audience Lists, informative 31255, https://hackerone.com/reports/31255, files likes of README.md is public, resolved 31383, https://hackerone.com/reports/31383, Ability to see common response titles of other teams (limited), resolved 31408, https://hackerone.com/reports/31408, Adobe Flash Player Out-of-Bound Read/Write Vulnerability, resolved 31415, https://hackerone.com/reports/31415, PoodleBleed, resolved 31418, https://hackerone.com/reports/31418, Авторизуюсь от имени любого пользователя parapa.mail.ru, resolved 31554, https://hackerone.com/reports/31554, Singup Page HTML Injection Vulnerability, resolved 31756, https://hackerone.com/reports/31756, Drupal 7 pre auth sql injection and remote code execution, resolved 32137, https://hackerone.com/reports/32137, Content Spoofing via reports, resolved 32519, https://hackerone.com/reports/32519, XSS in fabric.io, resolved 32570, https://hackerone.com/reports/32570, OpenSSL HeartBleed (CVE-2014-0160), resolved 32825, https://hackerone.com/reports/32825, URGENT - Subdomain Takeover on media.vine.co due to unclaimed domain pointing to AWS, resolved 32944, https://hackerone.com/reports/32944, MD5 used for Key-Auth signatures, informative 32990, https://hackerone.com/reports/32990, Enumeration/Guess of Private (Invited) Programs, resolved 33018, https://hackerone.com/reports/33018, a stored xss in slack integration https://onerror.slack.com/services/import, resolved 33091, https://hackerone.com/reports/33091, DOM Cross-Site Scripting ( XSS ), resolved 33153, https://hackerone.com/reports/33153, Test, resolved 33154, https://hackerone.com/reports/33154, Test, resolved 33331, https://hackerone.com/reports/33331, Flaw in valid password policy., informative 33358, https://hackerone.com/reports/33358, test, resolved 33432, https://hackerone.com/reports/33432, BROKEN AUTHENTICATION IN MOBILE VERIFICATION , informative 33935, https://hackerone.com/reports/33935, File Name Enumeration , resolved 33986, https://hackerone.com/reports/33986, Option Method Enabled on web server, informative 33987, https://hackerone.com/reports/33987, Options Method Enabled, informative 34084, https://hackerone.com/reports/34084, Bad extended ascii handling in HTTP 301 redirects of t.co, resolved 34112, https://hackerone.com/reports/34112, SMPT Protection not used, I can hijack your email server., resolved 34130, https://hackerone.com/reports/34130, Flash XSS на old.corp.mail.ru, resolved 34188, https://hackerone.com/reports/34188, Various Low level Vulnerabilities, resolved 34686, https://hackerone.com/reports/34686, Ошибка фильтрации, resolved 34725, https://hackerone.com/reports/34725, XSS via Fabrico Account Name, resolved 34799, https://hackerone.com/reports/34799, Нежелательная информация, resolved 34917, https://hackerone.com/reports/34917, Bypassed or command injection, informative 35036, https://hackerone.com/reports/35036, XSS in Tagregator plugin, not-applicable 35102, https://hackerone.com/reports/35102, Locale::parseLocale Double Free, resolved 35237, https://hackerone.com/reports/35237, Gain reputation by creating a duplicate of an existing report, resolved 35287, https://hackerone.com/reports/35287, getting emails of users/removing them from victims account [using typical attack], resolved 35363, https://hackerone.com/reports/35363, [static.qiwi.com] XSS proxy.html, resolved 35413, https://hackerone.com/reports/35413, [send.qiwi.ru] XSS at auth?login=, resolved 35532, https://hackerone.com/reports/35532, Code for registration of qiwi account is not coming even after a long interval of time for Indian mobile number, informative 35823, https://hackerone.com/reports/35823, File name/folder enumeration., resolved 36053, https://hackerone.com/reports/36053, Headers Missing, informative 36105, https://hackerone.com/reports/36105, CRLF Injection [ishop.qiwi.com], resolved 36112, https://hackerone.com/reports/36112, Content injection , informative 36211, https://hackerone.com/reports/36211, Logic Issue with Reputation: Boost Reputation Points, resolved 36264, https://hackerone.com/reports/36264, mod_proxy_fcgi buffer overflow, resolved 36279, https://hackerone.com/reports/36279, Adobe Flash Player MP4 Use-After-Free Vulnerability, resolved 36319, https://hackerone.com/reports/36319, [qiwi.com] /oauth/confirm.action XSS, resolved 36409, https://hackerone.com/reports/36409, Options Method Enabled, informative 36450, https://hackerone.com/reports/36450, [send.qiwi.ru] Soap-based XXE vulnerability /soapserver/ , resolved 36459, https://hackerone.com/reports/36459, Missing SPF header on revert.io, resolved 36586, https://hackerone.com/reports/36586, Metadata in hosted files is disclosing Usernames, Printers, paths, admin guides. emails, informative 36594, https://hackerone.com/reports/36594, New Device Confirmation, token is valid until not used. , resolved 36980, https://hackerone.com/reports/36980, Notifications can mark as read by CSRF, informative 36986, https://hackerone.com/reports/36986, [Stored XSS] vine.co - profile page, resolved 37108, https://hackerone.com/reports/37108, Homograph attack. , informative 37240, https://hackerone.com/reports/37240, Race condition in Flash workers may cause an exploitabl​e double free, resolved 37822, https://hackerone.com/reports/37822, Abuse of "Remember Me" functionality., informative 38007, https://hackerone.com/reports/38007, Subdomain Takeover using blog.greenhouse.io pointing to Hubspot, resolved 38012, https://hackerone.com/reports/38012, Stored xss in agent.qiwi.com, resolved 38157, https://hackerone.com/reports/38157, [qiwi.com] Open Redirect, resolved 38170, https://hackerone.com/reports/38170, Misc Python bugs (Memory Corruption & Use After Free), resolved 38189, https://hackerone.com/reports/38189, xss in /browse/contacts/, resolved 38232, https://hackerone.com/reports/38232, Breaking Bugs as team member, resolved 38343, https://hackerone.com/reports/38343, Issue with password change, resolved 38345, https://hackerone.com/reports/38345, [sms.qiwi.ru] XSS via Request-URI, resolved 38615, https://hackerone.com/reports/38615, [connect.mail.ru] Memory Disclosure / IE XSS, resolved 38778, https://hackerone.com/reports/38778, SQL injection in conc/index.php/ccm/system/search/users/submit, resolved 38890, https://hackerone.com/reports/38890, stored XSS in concrete5 5.7.2.1, resolved 38965, https://hackerone.com/reports/38965, Phabricator Diffusion application allows unauthorized users to delete mirrors, resolved 39139, https://hackerone.com/reports/39139, URL Crashing browser. {Tested on firefox, Chrome and Safari}, resolved 39181, https://hackerone.com/reports/39181, [vimeopro.com] CRLF Injection, resolved 39198, https://hackerone.com/reports/39198, [admin.c2fo.com] Open Redirect, resolved 39250, https://hackerone.com/reports/39250, Missing SPF for informatica.com, informative 39261, https://hackerone.com/reports/39261, [monitor.sjc.dropbox.com] CRLF Injection, resolved 39316, https://hackerone.com/reports/39316, [odnoklassniki.ru] XSS via Host, resolved 39428, https://hackerone.com/reports/39428, Phabricator Phame Blog Skins Local File Inclusion, resolved 39486, https://hackerone.com/reports/39486, No bruteforce protection leads to enumeration of emails in http://e.mail.ru/, resolved 39631, https://hackerone.com/reports/39631, Open redirection in fabric.io, resolved 39658, https://hackerone.com/reports/39658, Reflected File Download, resolved 41240, https://hackerone.com/reports/41240, POODLE Bug: 199.16.156.44, 199.16.156.108, mx4.twitter.com, resolved 41469, https://hackerone.com/reports/41469, Error stack trace, resolved 41758, https://hackerone.com/reports/41758, Stored XSS in api key of operator wallet, resolved 41856, https://hackerone.com/reports/41856, HTML/XSS rendered in Android App of Crashlytics through fabric.io, resolved 41939, https://hackerone.com/reports/41939, GET /surveys/2auth: XSS, resolved 41940, https://hackerone.com/reports/41940, /surveys/2auth: DOM-based XSS, resolved 42154, https://hackerone.com/reports/42154, Gain access to any user's email address, resolved 42161, https://hackerone.com/reports/42161, stored xss in transaction, resolved 42236, https://hackerone.com/reports/42236, URGENT - Subdomain Takeover on users.tweetdeck.com , the same issue of report #32825, resolved 42240, https://hackerone.com/reports/42240, chrome allows POST requests with custom headers using flash + 307 redirect, resolved 42248, https://hackerone.com/reports/42248, Stored XSS in adding fileset, resolved 42250, https://hackerone.com/reports/42250, No rate limiting on creating lists, informative 42393, https://hackerone.com/reports/42393, XSS on partners.uber.com, resolved 42403, https://hackerone.com/reports/42403, Account Deleted without any confirmation, informative 42537, https://hackerone.com/reports/42537, [careers.informatica.com] Cross Site Script Vulnerability on informatica, resolved 42582, https://hackerone.com/reports/42582, Vimeo.com - Reflected XSS Vulnerability, resolved 42584, https://hackerone.com/reports/42584, Vimeo.com - reflected xss vulnerability, resolved 42587, https://hackerone.com/reports/42587, Vimeo.com Insecure Direct Object References Reset Password, resolved 42702, https://hackerone.com/reports/42702, APIs for channels allow HTML entities that may cause XSS issue, resolved 42728, https://hackerone.com/reports/42728, Data-Tags and the New HTML Sanitizer Subverts CSRF protection, resolved 42780, https://hackerone.com/reports/42780, Web Server information disclosure., resolved 42961, https://hackerone.com/reports/42961, fabric.io - app member can make himself an admin, resolved 43065, https://hackerone.com/reports/43065, Fabric.io - an app admin can delete team members from other user apps, resolved 43070, https://hackerone.com/reports/43070, Misconfigured crossdomain.xml - vimeo.com, informative 43269, https://hackerone.com/reports/43269, WP User Enumeration is possible at https://blog.dropbox.com, informative 43280, https://hackerone.com/reports/43280, HTTPS is not enforced for objects stored by HackerOne on Amazon S3, resolved 43440, https://hackerone.com/reports/43440, Arbitrary file existence disclosure in Action Pack, resolved 43443, https://hackerone.com/reports/43443, PyUnicode_FromFormatV crasher, resolved 43602, https://hackerone.com/reports/43602, Buying ondemand videos that 0.1 and sometimes for free , resolved 43617, https://hackerone.com/reports/43617, Adding profile picture to anyone on Vimeo, resolved 43672, https://hackerone.com/reports/43672, player.vimeo.com - Reflected XSS Vulnerability, resolved 43723, https://hackerone.com/reports/43723, 3k.mail.ru: XSS, resolved 43752, https://hackerone.com/reports/43752, Раскрытие номера мобильного телефона при двухфакторной аутентификации, resolved 43758, https://hackerone.com/reports/43758, profile photo update bypass , resolved 43770, https://hackerone.com/reports/43770, Ability to Download Music Tracks Without Paying (Missing permission check on`/musicstore/download`), resolved 43807, https://hackerone.com/reports/43807, Securing "Reset password" pages from bots, resolved 43846, https://hackerone.com/reports/43846, No Limitation on Following allows user to follow people automatically!, resolved 43850, https://hackerone.com/reports/43850, abusing Thumbnails(https://vimeo.com/upload/select_thumb) to see a private video, resolved 43988, https://hackerone.com/reports/43988, twitter android app Fragment Injection, resolved 43998, https://hackerone.com/reports/43998, CRITICAL full source code/config disclosure for Cameo, resolved 44052, https://hackerone.com/reports/44052, Hadoop Node available to public, resolved 44056, https://hackerone.com/reports/44056, USER PRIVACY VIOLATED (PRIVATE DATA GETTING TRANSFER OVER INSECURE CHANNEL ) , informative 44146, https://hackerone.com/reports/44146, Make API calls on behalf of another user (CSRF protection bypass), resolved 44157, https://hackerone.com/reports/44157, Open Redirection Security Filter bypassed, resolved 44202, https://hackerone.com/reports/44202, Poodle bleed vulnerability in cloud sub domain, resolved 44217, https://hackerone.com/reports/44217, Application XSS filter function Bypass may allow Multiple stored XSS, resolved 44294, https://hackerone.com/reports/44294, Heartbleed: my.com (185.30.178.33) port 1433, resolved 44295, https://hackerone.com/reports/44295, http://217.69.136.200/?p=2&c=Fetcher%20cluster&h=fetcher1.mail.ru, resolved 44359, https://hackerone.com/reports/44359, Add text to the title of the page "Thanks", resolved 44371, https://hackerone.com/reports/44371, Path disclosure in platform0.twitter.com, informative 44425, https://hackerone.com/reports/44425, unvalid open authentication with facebook, resolved 44492, https://hackerone.com/reports/44492, Flaw in login with twitter to steal Oauth tokens, resolved 44512, https://hackerone.com/reports/44512, XSS on any site that includes the moogaloop flash player | deprecated embed code , resolved 44578, https://hackerone.com/reports/44578, URGENT - SUBDOMAIN TAKEOVER ON TWITTER ACQ., resolved 44652, https://hackerone.com/reports/44652, Insecure crossdomain.xml, resolved 44739, https://hackerone.com/reports/44739, Unvalidated Redirects and Stored XSS, informative 44798, https://hackerone.com/reports/44798, Vimeo Search - XSS Vulnerability [http://vimeo.com/search], resolved 44888, https://hackerone.com/reports/44888, Improper way of validating a program, resolved 45050, https://hackerone.com/reports/45050, [community.informatica.com] - CSRF in Private Messages allows to move user's messages to Trash, resolved 45084, https://hackerone.com/reports/45084, Full account takeover via Add a New Email to account without email verified and without password confirmation., informative 45233, https://hackerone.com/reports/45233, Stored XSS in Direct debit name, resolved 45243, https://hackerone.com/reports/45243, Number, username and name disclosure, resolved 45368, https://hackerone.com/reports/45368, ftp upload of video allows naming that is not sanitized as the manual naming, resolved 45428, https://hackerone.com/reports/45428, CSRF bypass, informative 45484, https://hackerone.com/reports/45484, XSS on Vimeo, resolved 45516, https://hackerone.com/reports/45516, [zaption.com] Open Redirect, resolved 45960, https://hackerone.com/reports/45960, CRITICAL vulnerability - Insecure Direct Object Reference - Unauthorized access to `Videos` of Channel whose privacy is set to `Private`., resolved 46019, https://hackerone.com/reports/46019, Explicit, dynamic render path: Dir. Trav + RCE, resolved 46072, https://hackerone.com/reports/46072, Vulnerability with the way \ escaped characters in style links are rendered, resolved 46109, https://hackerone.com/reports/46109, Brute force on "vimeo" cookie, informative 46113, https://hackerone.com/reports/46113, Can message users without the proper authorization, resolved 46312, https://hackerone.com/reports/46312, In markdown, parsing things like @danlec and #46072 after links is unsafe, resolved 46345, https://hackerone.com/reports/46345, Directory index and information disclosure, resolved 46366, https://hackerone.com/reports/46366, Error stack trace, resolved 46379, https://hackerone.com/reports/46379, Group Invite not properly authenticated, resolved 46397, https://hackerone.com/reports/46397, Insecure Direct Object Reference vulnerability, resolved 46429, https://hackerone.com/reports/46429, Team member invitations to sandboxed teams are not invalidated consistently, resolved 46485, https://hackerone.com/reports/46485, Problem with OAuth, resolved 46618, https://hackerone.com/reports/46618, Frictionless Transferring of Wallet Ownership, resolved 46736, https://hackerone.com/reports/46736, CSRF token leakage, informative 46747, https://hackerone.com/reports/46747, Team admin can change unauthorized team setting (require_at_for_mention), resolved 46750, https://hackerone.com/reports/46750, Team admin can change unauthorized team setting (allow_message_deletion), resolved 46818, https://hackerone.com/reports/46818, Twitter Card - Parent Window Redirection, resolved 46916, https://hackerone.com/reports/46916, Markdown parsing issue enables insertion of malicious tags and event handlers, resolved 46952, https://hackerone.com/reports/46952, Markdown code block sequence makes report unreadable, resolved 46954, https://hackerone.com/reports/46954, subdomain takeover 1511493148.cloud.vimeo.com, resolved 47012, https://hackerone.com/reports/47012, Adobe Flash Player Out-of-Bound Access Vulnerability, resolved 47227, https://hackerone.com/reports/47227, Race condition in workers may cause an exploitable double free by abusing bytearray.compress() , resolved 47232, https://hackerone.com/reports/47232, Use after free during the StageVideoAvailabilityEvent can result in arbitrary code execution, resolved 47234, https://hackerone.com/reports/47234, Use After Free in Flash MessageChannel.send can cause arbitrary code execution, resolved 47235, https://hackerone.com/reports/47235, XSS in Search Communities Function, resolved 47322, https://hackerone.com/reports/47322, XSS Vulnerability in cfire.mail.ru/screen/1/, resolved 47341, https://hackerone.com/reports/47341, Reflected xss in user name thru cookie, resolved 47343, https://hackerone.com/reports/47343, Stored xss in user name, informative 47349, https://hackerone.com/reports/47349, Stored xss in user name (2) affected another user., resolved 47357, https://hackerone.com/reports/47357, CSRF token from another valid user session accepted, informative 47358, https://hackerone.com/reports/47358, Username and sim id enum, informative 47362, https://hackerone.com/reports/47362, Enum phone numbers thru /en/sims/topup/add/, resolved 47384, https://hackerone.com/reports/47384, Approve topup method by sender of this method, resolved 47472, https://hackerone.com/reports/47472, CSP Bypass: Click handler for links with data-method="post" can cause authenticity_token to be sent off domain, resolved 47495, https://hackerone.com/reports/47495, Same Origin Policy bypass, resolved 47536, https://hackerone.com/reports/47536, [ishop.qiwi.com] XSS + Misconfiguration, resolved 47627, https://hackerone.com/reports/47627, Email Enumeration (POC), resolved 47779, https://hackerone.com/reports/47779, Heap overflow in H. Spencer’s regex library on 32 bit systems , resolved 47876, https://hackerone.com/reports/47876, Full Path Disclosure, resolved 47888, https://hackerone.com/reports/47888, Reporting user's profile by using another people's ID, resolved 47940, https://hackerone.com/reports/47940, Team admin can add billing contacts, resolved 48065, https://hackerone.com/reports/48065, open authentication bug, resolved 48100, https://hackerone.com/reports/48100, Bad Write in TTF font parsing (win32k.sys), resolved 48416, https://hackerone.com/reports/48416, Restrict any user from logging into his account., resolved 48516, https://hackerone.com/reports/48516, Redirect URL in /intent/ functionality is not properly escaped, resolved 49035, https://hackerone.com/reports/49035, HDFS NameNode Public disclosure: http://185.5.139.33:50070/dfshealth.jsp, resolved 49139, https://hackerone.com/reports/49139, scfbp.tng.mail.ru: Heartbleed, resolved 49170, https://hackerone.com/reports/49170, Information disclosure - emails disclosed in response > staging.seatme.us, resolved 49304, https://hackerone.com/reports/49304, Bypassing Email verification , informative 49356, https://hackerone.com/reports/49356, I Can Delete Any Airbnb Users Symbol!, resolved 49357, https://hackerone.com/reports/49357, Substantially weakened authenticity verification when using 'Remember me for a week', informative 49378, https://hackerone.com/reports/49378, Create N Accounts In Dropbox Irrespective Of Domain, informative 49408, https://hackerone.com/reports/49408, RCE через JDWP, resolved 49474, https://hackerone.com/reports/49474, Cross site Port Scanning bug in twitter developers console , informative 49499, https://hackerone.com/reports/49499, Generating Unlimited Free Travel Gift Invites | IDOR, informative 49513, https://hackerone.com/reports/49513, Vulnerability type xss uncovered in airbnb.es, resolved 49537, https://hackerone.com/reports/49537, SSL Issues, resolved 49561, https://hackerone.com/reports/49561, Vimeo + & Vimeo PRO Unautorised Tax bypass, resolved 49566, https://hackerone.com/reports/49566, Auto Approval of Invitation to join Team as a Team member, resolved 49652, https://hackerone.com/reports/49652, Improperly validated fields allows injection of arbitrary HTML via spoofed React objects, resolved 49663, https://hackerone.com/reports/49663, URGENT - Subdomain Takeover on status.vimeo.com due to unclaimed domain pointing to statuspage.io, resolved 49759, https://hackerone.com/reports/49759, Open Redirect leak of authenticity_token lead to full account take over., resolved 49806, https://hackerone.com/reports/49806, Twitter Ads Campaign information disclosure through admin without any authentication., resolved 49888, https://hackerone.com/reports/49888, Missing X-Frame-Options header, duplicate 49974, https://hackerone.com/reports/49974, The csrf token remains same after user logs in, resolved 50134, https://hackerone.com/reports/50134, XSS in original referrer after follow, resolved 50157, https://hackerone.com/reports/50157, Reflected Cross Site Scripting - 'puser' Parameter in login page, resolved 50170, https://hackerone.com/reports/50170, FREAK: Factoring RSA_EXPORT Keys to Impersonate TLS Servers, resolved 50358, https://hackerone.com/reports/50358, files.acrobat.com stored XSS via send file, resolved 50379, https://hackerone.com/reports/50379, Open redirect and reflected xss in http://youthvoices.adobe.com/community?return_url=[payload her], resolved 50389, https://hackerone.com/reports/50389, Adobe XSS, resolved 50481, https://hackerone.com/reports/50481, Self Xss on File Replace, resolved 50537, https://hackerone.com/reports/50537, Server Side Request Forgery in macro creation, informative 50552, https://hackerone.com/reports/50552, Stored XSS on Blog's page Tile, resolved 50554, https://hackerone.com/reports/50554, Stored XSS on Title of Page List in edit page list, resolved 50556, https://hackerone.com/reports/50556, Stored XSS on Search Title, resolved 50564, https://hackerone.com/reports/50564, Stored XSS in Contact Form, resolved 50626, https://hackerone.com/reports/50626, Stored XSS in Title of the topic List, resolved 50627, https://hackerone.com/reports/50627, Stored XSS in title of date navigation, resolved 50639, https://hackerone.com/reports/50639, Stored XSS in Feature tile , resolved 50642, https://hackerone.com/reports/50642, Stored Xss in Feature Paragraph, resolved 50644, https://hackerone.com/reports/50644, Stored XSS in Testimonial name, resolved 50645, https://hackerone.com/reports/50645, Stored XSS in Testimonial Position, resolved 50656, https://hackerone.com/reports/50656, Stored XSS in testimonial Company, resolved 50658, https://hackerone.com/reports/50658, Reflected File Download attack allows attacker to 'upload' executables to hackerone.com domain, resolved 50662, https://hackerone.com/reports/50662, Stored XSS In Company URL, resolved 50703, https://hackerone.com/reports/50703, CSRF in login form would led to account takeover, resolved 50752, https://hackerone.com/reports/50752, open redirect sends authenticity_token to any website or (ip address), resolved 50776, https://hackerone.com/reports/50776, A user can edit comments even after video comments are disabled, resolved 50779, https://hackerone.com/reports/50779, Stored XSS in Bio/Quote, resolved 50780, https://hackerone.com/reports/50780, Stored XSS in Message to Display When No Pages Listed., resolved 50782, https://hackerone.com/reports/50782, Stored XSS in Image Alt. Text, resolved 50786, https://hackerone.com/reports/50786, A user can add videos to other user's private groups, resolved 50829, https://hackerone.com/reports/50829, A user can post comments on other user's private videos, resolved 50884, https://hackerone.com/reports/50884, Bypass pin(4 digit passcode on your android app), resolved 50885, https://hackerone.com/reports/50885, CVE-2014-0224 openssl ccs vulnerability, resolved 50941, https://hackerone.com/reports/50941, A user can enhance their videos with paid tracks without buying the track, resolved 51060, https://hackerone.com/reports/51060, XSS in realty.mail.ru, resolved 51061, https://hackerone.com/reports/51061, XSS in ad.mail.ru, resolved 51140, https://hackerone.com/reports/51140, XSS in touch.sports.mail.ru, resolved 51166, https://hackerone.com/reports/51166, Email verification links still valid after changing it 2x, informative 51265, https://hackerone.com/reports/51265, Flash Cross Domain Policy Bypass by Using File Upload and Redirection - only in Chrome, resolved 51817, https://hackerone.com/reports/51817, Post in private groups after getting removed, resolved 52176, https://hackerone.com/reports/52176, Insecure Direct Object References in https://vimeo.com/forums, resolved 52181, https://hackerone.com/reports/52181, Insecure Direct Object References that allows to read any comment (even if it should be private), resolved 52532, https://hackerone.com/reports/52532, "learn more here", reward email - domain expired., resolved 52635, https://hackerone.com/reports/52635, UniFi v3.2.10 Cross-Site Request Forgeries / Referer-Check Bypass, resolved 52646, https://hackerone.com/reports/52646, Insecure direct object reference - have access to deleted DM's, resolved 52707, https://hackerone.com/reports/52707, Invite any user to your group without even following him, resolved 52708, https://hackerone.com/reports/52708, Share your channel to any user on vimeo without following him, resolved 52822, https://hackerone.com/reports/52822, XSS with Time-of-Day Format, resolved 52982, https://hackerone.com/reports/52982, [URGENT ISSUE] Add or Delete the videos in watch later list of any user ., resolved 53004, https://hackerone.com/reports/53004, Blacklist bypass on Callback URLs, resolved 53088, https://hackerone.com/reports/53088, SSRF vulnerability (access to metadata server on EC2 and OpenStack), resolved 53098, https://hackerone.com/reports/53098, XSS in twitter.com/safety/unsafe_link_warning, resolved 53531, https://hackerone.com/reports/53531, Logging a user into attacker's account using password reset link, resolved 53730, https://hackerone.com/reports/53730, Stored xss in editor , resolved 53858, https://hackerone.com/reports/53858, Insecure Direct Object Reference - access to other user/group DM's, resolved 54034, https://hackerone.com/reports/54034, Reflected Filename Download, resolved 54094, https://hackerone.com/reports/54094, HTTP MitM on Flash Player settings manager allows attacker to set sandbox settings, resolved 54321, https://hackerone.com/reports/54321, Xss in website's link, resolved 54610, https://hackerone.com/reports/54610, Logout any user of same team, resolved 54631, https://hackerone.com/reports/54631, Vulnerable to JavaScript injection. (WXS) (Javascript injection)!, resolved 54641, https://hackerone.com/reports/54641, Captcha Bypass in Snapchat's Geofilter Submission Process, resolved 54719, https://hackerone.com/reports/54719, e.mail.ru stored XSS in agent via sticker (smile), resolved 54733, https://hackerone.com/reports/54733, Sandboxed iframes don't show confirmation screen, resolved 54779, https://hackerone.com/reports/54779, Missing spf flags for myshopify.com, resolved 55009, https://hackerone.com/reports/55009, Frameset Proxy Problem, informative 55017, https://hackerone.com/reports/55017, Multiple Python integer overflows, resolved 55018, https://hackerone.com/reports/55018, Segmentation fault for invalid PSS parameters, resolved 55028, https://hackerone.com/reports/55028, Free called on unitialized pointer in exif.c, resolved 55029, https://hackerone.com/reports/55029, Use after free vulnerability in unserialize() with DateTimeZone, resolved 55030, https://hackerone.com/reports/55030, SoapClient's __call() type confusion through unserialize(), resolved 55033, https://hackerone.com/reports/55033, Use after free vulnerability in unserialize(), resolved 55064, https://hackerone.com/reports/55064, Bypass Setup by External Activity Invoke, resolved 55140, https://hackerone.com/reports/55140, Race Conditions in OAuth 2 API implementations, resolved 55431, https://hackerone.com/reports/55431, XML Parser Bug: XXE over which leads to RCE, resolved 55506, https://hackerone.com/reports/55506, Privacy Issue on protected tweets, informative 55525, https://hackerone.com/reports/55525, Open redirection in OAuth, resolved 55530, https://hackerone.com/reports/55530, Authentication Failed Mobile version, resolved 55546, https://hackerone.com/reports/55546, Open Redirect after login at http://ecommerce.shopify.com, resolved 55644, https://hackerone.com/reports/55644, Lack of SSL Pinning on POS Application ( iOS ), informative 55670, https://hackerone.com/reports/55670, Fabric.io: Ex-admin of an organization can delete team members, resolved 55716, https://hackerone.com/reports/55716, Force 500 Internal Server Error on any shop (for one user), resolved 55827, https://hackerone.com/reports/55827, iframes considered harmful, informative 55842, https://hackerone.com/reports/55842, [persistent cross-site scripting] customers can target admins, resolved 56002, https://hackerone.com/reports/56002, Shopify android client all API request's response leakage, including access_token, cookie, response header, response body content, resolved 56119, https://hackerone.com/reports/56119, Privecy Issue : view "Protected users" followers and following, informative 56177, https://hackerone.com/reports/56177, SMTP protection not used, resolved 56182, https://hackerone.com/reports/56182, May cause account take over (Via invitation page), informative 56385, https://hackerone.com/reports/56385, Double free vulnerability in Flash Player Settings Manager (CVE-2015-0346), resolved 56511, https://hackerone.com/reports/56511, IDOR expire other user sessions, resolved 56628, https://hackerone.com/reports/56628, Payment gateway status transferred to Shopify without authentication, resolved 56662, https://hackerone.com/reports/56662, XSS - URL Redirects, informative 56726, https://hackerone.com/reports/56726, Invitation issue, resolved 56742, https://hackerone.com/reports/56742, SPF whitelist of mandrill leads to email forgery, resolved 56760, https://hackerone.com/reports/56760, XSS on support.shopify.com, resolved 56779, https://hackerone.com/reports/56779, XSS on ecommerce.shopify.com, resolved 56793, https://hackerone.com/reports/56793, Missing DMARC record, informative 56800, https://hackerone.com/reports/56800, Multiple issues on Checkout Process, informative 56803, https://hackerone.com/reports/56803, XSS in version history of an HTML file in a shared folder, informative 56828, https://hackerone.com/reports/56828, SSRF vulnerablity in app webhooks, resolved 56936, https://hackerone.com/reports/56936, Notification request disclose private information about other myshopify accounts, resolved 57125, https://hackerone.com/reports/57125, comment out causes information disclosure, resolved 57263, https://hackerone.com/reports/57263, Rank Creation function not validating user inputs., informative 57356, https://hackerone.com/reports/57356, DOM based cookie bomb, resolved 57459, https://hackerone.com/reports/57459, XSS in experts.shopify.com, resolved 57505, https://hackerone.com/reports/57505, amazon aws s3 bucket content is public :- http://shopify.com.s3.amazonaws.com/, resolved 57603, https://hackerone.com/reports/57603, API: missing invalidation of OAuth2 Authorization Code during access revocation causes authorization bypass, resolved 57692, https://hackerone.com/reports/57692, Server responds with the server error logs on account creation, resolved 57736, https://hackerone.com/reports/57736, Missing spf flags for hackerone.com, resolved 57764, https://hackerone.com/reports/57764, ByPassing the email Validation Email on Sign up process in mobile apps, resolved 57914, https://hackerone.com/reports/57914, HTML injection in email sent by romit.io, resolved 57918, https://hackerone.com/reports/57918, Insecure Local Data Storage : Application stores data using a binary sqlite database, resolved 58612, https://hackerone.com/reports/58612, Homograph attack, resolved 58630, https://hackerone.com/reports/58630, Content Spoofing, resolved 58679, https://hackerone.com/reports/58679, SSL cookie without secure flag set, resolved 58831, https://hackerone.com/reports/58831, Flash XSS on img.mail.ru, resolved 58897, https://hackerone.com/reports/58897, SSRF issue in "URL target" allows [REDACTED], resolved 58914, https://hackerone.com/reports/58914, Remote code execution as root on [REDACTED], resolved 59015, https://hackerone.com/reports/59015, Stored XSS in the Shopify Discussion Forums, resolved 59179, https://hackerone.com/reports/59179, Race condition when redeeming coupon codes, resolved 59356, https://hackerone.com/reports/59356, XSS in dropbox main domain , resolved 59372, https://hackerone.com/reports/59372, Homograph Attack, resolved 59375, https://hackerone.com/reports/59375, Homograph attack, resolved 59469, https://hackerone.com/reports/59469, Fake URL + Additional vectors for homograph attack, resolved 59505, https://hackerone.com/reports/59505, Create and Update patients vulnerability, resolved 59508, https://hackerone.com/reports/59508, Accessing all appointments vulnerability, resolved 59659, https://hackerone.com/reports/59659, Reopen Disable Accounts/ Hidden Access After Disable, resolved 59660, https://hackerone.com/reports/59660, Multiple Cross Site Request Forgery Vulnerabilities in Concrete5 version 5.7.3.1, resolved 59661, https://hackerone.com/reports/59661, Multiple Reflected Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1, resolved 59662, https://hackerone.com/reports/59662, Multiple Stored Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1, resolved 59663, https://hackerone.com/reports/59663, Sendmail Remote Code Execution Vulnerability in Concrete5 version 5.7.3.1, resolved 59664, https://hackerone.com/reports/59664, SQL Injection Vulnerability in Concrete5 version 5.7.3.1, resolved 59665, https://hackerone.com/reports/59665, Local File Inclusion Vulnerability in Concrete5 version 5.7.3.1, resolved 59666, https://hackerone.com/reports/59666, Unsafe usage of Host HTTP header in Concrete5 version 5.7.3.1, informative 60016, https://hackerone.com/reports/60016, xss profile, resolved 60058, https://hackerone.com/reports/60058, teach.udemy.com log poison vulnerability through wordpress debug.log being publically available, resolved 60201, https://hackerone.com/reports/60201, XSS Vulnerability on all pages, resolved 60260, https://hackerone.com/reports/60260, Misconfigured SPF Record Flag, informative 60402, https://hackerone.com/reports/60402, Content Spoofing - External Link Warning Page, resolved 60420, https://hackerone.com/reports/60420, store-agent.mail.ru: stacked blind injection, resolved 60429, https://hackerone.com/reports/60429, Logical Issue (Boosting Reputation points), informative 60573, https://hackerone.com/reports/60573, http://fitter1.i.mail.ru/browser/ торчит Graphite в мир, resolved 61312, https://hackerone.com/reports/61312, Bypass of the SSRF protection (Slack commands, Phabricator integration), resolved 61367, https://hackerone.com/reports/61367, xss on autoserch, resolved 61371, https://hackerone.com/reports/61371, leak receipt of another user, resolved 62294, https://hackerone.com/reports/62294, Multiple XSS Vulnerabilities in Concrete5 5.7.3.1, resolved 62301, https://hackerone.com/reports/62301, Ability to add pishing links in discusion ," Bypassing uneductional Links add ", resolved 62400, https://hackerone.com/reports/62400, XSS on https://www.udemy.com/asset/export.html, resolved 62427, https://hackerone.com/reports/62427, XSS in myshopify.com Admin site in TAX Overrides, resolved 62531, https://hackerone.com/reports/62531, tt-mac.i.mail.ru: Quagga 0.99.23.1 (Router) : Default password and default enable password, resolved 62544, https://hackerone.com/reports/62544, http://tp-dev1.tp.smailru.net/, resolved 62778, https://hackerone.com/reports/62778, Multiple sub domain are vulnerable because of leaking full path , resolved 62827, https://hackerone.com/reports/62827, Email Notification should be get while changing Paypal Email, resolved 62861, https://hackerone.com/reports/62861, Bulk Discount App in myshopify.com exposes http://bulkdiscounts.shopifyapps.com vulnerable to XSS, resolved 63075, https://hackerone.com/reports/63075, https://voip.agent.mail.ru/phpinfo.php, resolved 63131, https://hackerone.com/reports/63131, Changeable model ids on vanilla update can lead to severely bad side-effects, informative 63158, https://hackerone.com/reports/63158, External URL page bypass, resolved 63324, https://hackerone.com/reports/63324, Flash Player information disclosure (etc.) CVE-2015-3044, PSIRT-3298, resolved 63537, https://hackerone.com/reports/63537, XSS in https://app.mavenlink.com/workspaces/, resolved 63729, https://hackerone.com/reports/63729, Logic error with notifications: user that has left team continues to receive notifications and can not 'clean' this area on account, resolved 63865, https://hackerone.com/reports/63865, Potential denial of service in hackerone.com//reward_settings, resolved 63888, https://hackerone.com/reports/63888, Cross site scripting, resolved 64164, https://hackerone.com/reports/64164, Privilege Escalation - A `MEMBER` with no ACCESS to `ORDERS` can still access the orders by using `Order Printer APP` , resolved 64529, https://hackerone.com/reports/64529, Page replacement and redirect loop, resolved 64561, https://hackerone.com/reports/64561, missing SPF for legalrobot.com , resolved 64626, https://hackerone.com/reports/64626, Not Completed Accounts Take Over (Urgent bug), resolved 64645, https://hackerone.com/reports/64645, Missing security headers, possible clickjacking, resolved 64666, https://hackerone.com/reports/64666, Bypass verification of email while creating account(No rate limiting enable for verification code), resolved 64731, https://hackerone.com/reports/64731, Able to intercept app Traffic after choosing up the Secured Connection using SSL (HTTPS), resolved 64754, https://hackerone.com/reports/64754, Просмотр лайков и репостов фотографии, которая находятся в приватном альбоме, resolved 64941, https://hackerone.com/reports/64941, Header Misconfiguration - PHP API, resolved 64946, https://hackerone.com/reports/64946, Registration bypass using OAuth logical bug, resolved 64963, https://hackerone.com/reports/64963, API: Bug in method auth.validatePhone, resolved 65084, https://hackerone.com/reports/65084, Big Bug with Vault which i have already reported: Case #606962, resolved 65167, https://hackerone.com/reports/65167, CSRF, resolved 65324, https://hackerone.com/reports/65324, XSS on added name album on videos., resolved 65330, https://hackerone.com/reports/65330, Не достаточная проверка логина скайп, resolved 65729, https://hackerone.com/reports/65729, Activities are not Protected and able to crash app using other app (Can Malware or third parry app)., resolved 65808, https://hackerone.com/reports/65808, No CSRF protection when creating new community points actions, and related stored XSS, resolved 65825, https://hackerone.com/reports/65825, OAuth authorization page vulnerable to clickjacking, resolved 65921, https://hackerone.com/reports/65921, help2.m.smailru.net: XSS, resolved 65966, https://hackerone.com/reports/65966, Уязвимость приватных записей пользователя (личных), resolved 66151, https://hackerone.com/reports/66151, Invitation is not properly cancelled while inviting to bug reports., resolved 66223, https://hackerone.com/reports/66223, Two-factor authentication (via SMS), informative 66257, https://hackerone.com/reports/66257, [s.mail.ru] CRLF Injection, resolved 66262, https://hackerone.com/reports/66262, mailto: link injection on https://hackerone.com/directory, resolved 66385, https://hackerone.com/reports/66385, No valid SPF record, resolved 66386, https://hackerone.com/reports/66386, [www.*.myshopify.com] CRLF Injection, resolved 66391, https://hackerone.com/reports/66391, [engineeringblog.yelp.com] CRLF Injection, not-applicable 66422, https://hackerone.com/reports/66422, [mrgs.mail.ru] Internet Explorer XSS via Request-URI, resolved 66423, https://hackerone.com/reports/66423, [tanks.mail.ru] Internet Explorer XSS via Request-URI, resolved 66724, https://hackerone.com/reports/66724, type confusion in Sass::ParserState::ParserState(Sass::ParserState const&), resolved 66845, https://hackerone.com/reports/66845, - Guessing registered users in legalrobot.com, resolved 66962, https://hackerone.com/reports/66962, Misusing of FPU Instruction Could Cause Security Vulnerabilities in Adobe Flash Player, resolved 66994, https://hackerone.com/reports/66994, Link vulnerability leads to phishing attacks, informative 67125, https://hackerone.com/reports/67125, XSS at importing Product List, resolved 67132, https://hackerone.com/reports/67132, XSS at Bulk editing products, resolved 67161, https://hackerone.com/reports/67161, Possible xWork classLoader RCE: shared.mail.ru, resolved 67220, https://hackerone.com/reports/67220, Expire User Sessions in Admin Site does not expire user session in Shopify Application in IOS, resolved 67317, https://hackerone.com/reports/67317, Уязвимость получения всех номеров телефонов вк (по совместительству логинов профилей), resolved 67386, https://hackerone.com/reports/67386, [my.mail.ru] CRLF Injection, resolved 67557, https://hackerone.com/reports/67557, Bypass access restrictions from API, resolved 67562, https://hackerone.com/reports/67562, Issue in the implementation of captcha and race condition, resolved 67660, https://hackerone.com/reports/67660, Verification code issues for Two-Step Authentication, resolved 67929, https://hackerone.com/reports/67929, Redirection Page throwing error instead of redirecting to site, resolved 71337, https://hackerone.com/reports/71337, Отвязываем Twitter от любого профиля вк ! + несколько багов по дизайну, resolved 71614, https://hackerone.com/reports/71614, XSS in Myshopify Admin Site in DISCOUNTS, resolved 72272, https://hackerone.com/reports/72272, Multiple endpoints are vulnerable to XML External Entity injection (XXE) , resolved 72331, https://hackerone.com/reports/72331, XSS at Bulk editing ProductVariants, resolved 72526, https://hackerone.com/reports/72526, Xss via Dropbox, resolved 72735, https://hackerone.com/reports/72735, Unauthenticated access to Content Management System - www1.pornhubpremium.com, resolved 72775, https://hackerone.com/reports/72775, Уязвимость Создание фотографий без ведома пользователей, resolved 72785, https://hackerone.com/reports/72785, CSV Injection with the CVS export feature, resolved 72793, https://hackerone.com/reports/72793, Prevent Shop Admin From Seeing his Installed Apps / Install Persistent Unremovable App, resolved 72976, https://hackerone.com/reports/72976, Body injection in mailto link while commenting shop blog, resolved 73234, https://hackerone.com/reports/73234, out of bounds read crashes php-cgi, resolved 73235, https://hackerone.com/reports/73235, Use After Free Vulnerability in unserialize(), resolved 73236, https://hackerone.com/reports/73236, X509_to_X509_REQ NULL pointer deref, resolved 73237, https://hackerone.com/reports/73237, Buffer Over flow when parsing tar/zip/phar in phar_set_inode, resolved 73238, https://hackerone.com/reports/73238, Buffer Over-read in unserialize when parsing Phar, resolved 73239, https://hackerone.com/reports/73239, ZIP Integer Overflow leads to writing past heap boundary, resolved 73240, https://hackerone.com/reports/73240, Integer overflow in ftp_genlist() resulting in heap overflow, resolved 73241, https://hackerone.com/reports/73241, Malformed ECParameters causes infinite loop, resolved 73242, https://hackerone.com/reports/73242, libcurl: URL request injection, resolved 73244, https://hackerone.com/reports/73244, Use after free vulnerability in unserialize() with DateInterval, resolved 73245, https://hackerone.com/reports/73245, Type Confusion Vulnerability in SoapClient, resolved 73246, https://hackerone.com/reports/73246, Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER, resolved 73247, https://hackerone.com/reports/73247, php_stream_url_wrap_http_ex() type-confusion vulnerability, resolved 73248, https://hackerone.com/reports/73248, Tokenizer crash when processing undecodable source code, resolved 73249, https://hackerone.com/reports/73249, Multiple use after free bugs in element module, resolved 73250, https://hackerone.com/reports/73250, Multiple use after free bugs in heapq module, resolved 73251, https://hackerone.com/reports/73251, Multiple use after free bugs in json encoding, resolved 73252, https://hackerone.com/reports/73252, Use after free in get_filter, resolved 73253, https://hackerone.com/reports/73253, Multiple type confusions in unicode error handlers, resolved 73255, https://hackerone.com/reports/73255, str_repeat() sign mismatch based memory corruption, resolved 73256, https://hackerone.com/reports/73256, PHP yaml_parse/yaml_parse_file/yaml_parse_url Double Free, resolved 73257, https://hackerone.com/reports/73257, PHP yaml_parse/yaml_parse_file/yaml_parse_url Unsafe Deserialization, resolved 73258, https://hackerone.com/reports/73258, Python: imageop Unsafe Arithmetic, resolved 73259, https://hackerone.com/reports/73259, Integer overflow in _pickle.c, resolved 73260, https://hackerone.com/reports/73260, Integer overflow in _json_encode_unicode leads to crash, resolved 73276, https://hackerone.com/reports/73276, Internet-based attacker can run Flash apps in local sandboxes by using special URL schemes (PSIRT-3299, CVE-2015-3079), resolved 73429, https://hackerone.com/reports/73429, pngcrush_measure_idat() off-by-one error (CVE-2015-2158), resolved 73480, https://hackerone.com/reports/73480, Arbritrary file Upload on AirMax, resolved 73491, https://hackerone.com/reports/73491, Buffer Overflow in PHP of the AirMax Products, resolved 73566, https://hackerone.com/reports/73566, Reflected XSS in chat, resolved 73808, https://hackerone.com/reports/73808, Extremely high Course rating values could be set in order to make really high Average rating of the course. Negative values could be set to., resolved 74004, https://hackerone.com/reports/74004, Other Buffer Overflow in PHP of the AirMax Products, resolved 74025, https://hackerone.com/reports/74025, Yet another Buffer Overflow in PHP of the AirMax Products, resolved 74147, https://hackerone.com/reports/74147, Potential for financial loss, negative Values for "Buy fee" and "Sell Fee", resolved 74514, https://hackerone.com/reports/74514, Own downloading link isn't properly checked in the email template, informative 74515, https://hackerone.com/reports/74515, Error stack trace enabled, resolved 74518, https://hackerone.com/reports/74518, The email updates issues, resolved 74595, https://hackerone.com/reports/74595, The product/status method CSRF, resolved 74933, https://hackerone.com/reports/74933, Disclosure of map information, resolved 75357, https://hackerone.com/reports/75357, Session Cookie without HttpOnly and secure flag set, resolved 75702, https://hackerone.com/reports/75702, No rate limit which leads to "Users information Disclosure" including verfification documents etc., resolved 75727, https://hackerone.com/reports/75727, Stored Cross site scripting In developer.zendesk.com, resolved 75936, https://hackerone.com/reports/75936, Security Missconfiguration in Autologin , informative 76303, https://hackerone.com/reports/76303, weak ssl cipher suites, resolved 76307, https://hackerone.com/reports/76307, Self XSS Protection not used , I can trick users to insert JavaScript, resolved 76738, https://hackerone.com/reports/76738, Open redirect filter bypass, resolved 76784, https://hackerone.com/reports/76784, Cheating at gallery rating, resolved 77058, https://hackerone.com/reports/77058, NO SPF RECORDS , resolved 77060, https://hackerone.com/reports/77060, SMTP protection not used, resolved 77065, https://hackerone.com/reports/77065, Stealing CSRF Tokens, resolved 77067, https://hackerone.com/reports/77067, No rate limiting for sensitive actions (like "forgot password") enables user enumeration, resolved 77076, https://hackerone.com/reports/77076, GA code not verified on the server side allows sending Verification Documents on behalf of another user, resolved 77081, https://hackerone.com/reports/77081, Content Sniffing not disabled, resolved 77231, https://hackerone.com/reports/77231, Weak Cryptographic Hash, resolved 77319, https://hackerone.com/reports/77319, Full path disclosure at https://keybase.io/_/api/1.0/invitation_request.json, resolved 77679, https://hackerone.com/reports/77679, http://217.20.144.201 privilege escalation in apache tomcat SessionEample-script, resolved 77802, https://hackerone.com/reports/77802, TCP Source Port Pass Firewall, resolved 77817, https://hackerone.com/reports/77817, SSRF/XSPA в форме загрузки видео по URL, resolved 77904, https://hackerone.com/reports/77904, cross siite scripting in the blog , resolved 78003, https://hackerone.com/reports/78003, Cross site scripting On api Calculator API requests, resolved 78052, https://hackerone.com/reports/78052, xss in group, resolved 78158, https://hackerone.com/reports/78158, Wrong Handling of Content-Type allows Flash injection and Rosseta flash patch bypass, resolved 78219, https://hackerone.com/reports/78219, Покупка песни дешевле, чем она стоит., resolved 78253, https://hackerone.com/reports/78253, Покупка=>скачка песен, которые не предназначены для продажи, resolved 78260, https://hackerone.com/reports/78260, Stored XSS в имени песни (2) на платёжном гейте., resolved 78412, https://hackerone.com/reports/78412, Cross site scripting, resolved 78436, https://hackerone.com/reports/78436, (URGENT!) Покупка OK дешевле, чем он стоит, resolved 78516, https://hackerone.com/reports/78516, Доступ к чужим приватным фотографиям (3) через обложку видео, resolved 78685, https://hackerone.com/reports/78685, Email spoofing configuration missing, informative 78765, https://hackerone.com/reports/78765, information disclosure, resolved 78781, https://hackerone.com/reports/78781, Critical : Access to group videos where videos are restricted for all users(Broken authentication ), resolved 79046, https://hackerone.com/reports/79046, Доступ к чужим групповым беседам., resolved 79185, https://hackerone.com/reports/79185, Content spoofing through Referel header, resolved 79348, https://hackerone.com/reports/79348, OSX slack:// protocol handler javascript injection, resolved 79393, https://hackerone.com/reports/79393, Открытый доступ к корпоративным данным., resolved 79552, https://hackerone.com/reports/79552, [gratipay.com] CRLF Injection, resolved 80298, https://hackerone.com/reports/80298, Внедрение произвольного javascript-сценария в функционале просмотра изображений мобильной версии сайта, resolved 80512, https://hackerone.com/reports/80512, Runtime manipulation iOS app breaking the PIN, informative 80597, https://hackerone.com/reports/80597, Number of invited researchers disclosed as part of JSON search response, resolved 80694, https://hackerone.com/reports/80694, Reflective Xss Vulnerability , resolved 80883, https://hackerone.com/reports/80883, Authentication errors in server side validaton of E-MAIL, informative 80936, https://hackerone.com/reports/80936, Private Program and bounty details disclosed as part of JSON search response, resolved 80990, https://hackerone.com/reports/80990, JetBrains .idea project directory, resolved 81083, https://hackerone.com/reports/81083, Internal bounty and swag details disclosed as part of JSON response, resolved 81212, https://hackerone.com/reports/81212, Potential XSS on sanitize/Rails::Html::WhiteListSanitizer, resolved 81396, https://hackerone.com/reports/81396, [Rails42] We can inject HTML tags when server is using strip_tags method, resolved 81441, https://hackerone.com/reports/81441, XSS https://delivery.shopifyapps.com/ (Digital Downloads App in myshopify.com), resolved 81701, https://hackerone.com/reports/81701, Possible SQL injection on "Jump to twitter", resolved 82725, https://hackerone.com/reports/82725, Stored XSS in comments, resolved 82929, https://hackerone.com/reports/82929, Cross Site Scripting – Album Page, resolved 83178, https://hackerone.com/reports/83178, owncloud.com: DOM Based XSS, resolved 83239, https://hackerone.com/reports/83239, owncloud.com: Allowed an attacker to force a user to change profile details. (XCSRF), resolved 83251, https://hackerone.com/reports/83251, owncloud.com: Content Sniffing not disabled, resolved 83373, https://hackerone.com/reports/83373, owncloud.com: Cross Site Tracing, resolved 83374, https://hackerone.com/reports/83374, apps.owncloud.com: XSS via referrer, resolved 83381, https://hackerone.com/reports/83381, apps.owncloud.com: Multiple reflected XSS by insecure URL generation (IE only), resolved 83565, https://hackerone.com/reports/83565, Content spoofing в http://my.mail.ru/cgi-bin/app/paymentm, resolved 83566, https://hackerone.com/reports/83566, [reflected xss, pornhub.com] /blog, any, resolved 83576, https://hackerone.com/reports/83576, [start.icq.com] Reflected XSS via Cookies, resolved 83585, https://hackerone.com/reports/83585, [riot.mail.ru] Reflected XSS in debug-mode, resolved 83604, https://hackerone.com/reports/83604, Html injection on khanacademy, resolved 83667, https://hackerone.com/reports/83667, apps.owncloud.com: Session Cookie in URL can be captured by hackers, resolved 83710, https://hackerone.com/reports/83710, apps.owncloud.com: SSL Session cookie without secure flag set, resolved 83801, https://hackerone.com/reports/83801, apps.owncloud.com: Path Disclosure, resolved 83803, https://hackerone.com/reports/83803, apps.owncloud.com: SSL Server Allows Anonymous Authentication Vulnerability (SMTP), resolved 83837, https://hackerone.com/reports/83837, demo.owncloud.org: Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability, resolved 83855, https://hackerone.com/reports/83855, s2.owncloud.com: Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability, resolved 83856, https://hackerone.com/reports/83856, s2.owncloud.com: SSL Session cookie without secure flag set, resolved 83962, https://hackerone.com/reports/83962, DoS Attack in Controller Lookup Code, resolved 83971, https://hackerone.com/reports/83971, test1.owncloud.com: Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability, resolved 84078, https://hackerone.com/reports/84078, *.owncloud.com / *.owncloud.org: Using not strong enough SSL ciphers, resolved 84085, https://hackerone.com/reports/84085, daily.owncloud.com: Information disclosure, resolved 84105, https://hackerone.com/reports/84105, demo.owncloud.org: HTTP compression is enabled potentially leading to BREACH attack, resolved 84287, https://hackerone.com/reports/84287, DKIM records not present, Email Hijacking is possible, resolved 84371, https://hackerone.com/reports/84371, apps.owncloud.com: Stored XSS in profile page, resolved 84372, https://hackerone.com/reports/84372, owncloud.com: Account Compromise Through CSRF, resolved 84374, https://hackerone.com/reports/84374, apps.owncloud.com: Malicious file upload leads to remote code execution, resolved 84395, https://hackerone.com/reports/84395, CSRF in apps.owncloud.com, resolved 84453, https://hackerone.com/reports/84453, Lack of HSTS on https://apps.owncloud.com, resolved 84581, https://hackerone.com/reports/84581, owncloud.com: Outdated plugins contains public exploits , resolved 84601, https://hackerone.com/reports/84601, XSS and cache poisoning via upload.twitter.com on ton.twitter.com, resolved 84709, https://hackerone.com/reports/84709, [API ISSUE] agents can Create agents even after they are disabled ! , resolved 84740, https://hackerone.com/reports/84740, Stored XSS On Statement, resolved 84797, https://hackerone.com/reports/84797, Config, resolved 85011, https://hackerone.com/reports/85011, Dashboard panel embedded onto itself causes a denial of service, resolved 85201, https://hackerone.com/reports/85201, Full Path Disclosure , resolved 85291, https://hackerone.com/reports/85291, XSS https://www.shopify.com/signup, resolved 85421, https://hackerone.com/reports/85421, XSS at af.attachmail.ru, resolved 85488, https://hackerone.com/reports/85488, Stored XSS on player.vimeo.com, resolved 85532, https://hackerone.com/reports/85532, apps.owncloud.com: Edit Question didn't check ACLs, resolved 85541, https://hackerone.com/reports/85541, apps.owncloud.com: Mixed Active Scripting Issue , resolved 85559, https://hackerone.com/reports/85559, Password appears in user name field, informative 85565, https://hackerone.com/reports/85565, apps.owncloud.com: CSRF change privacy settings, resolved 85577, https://hackerone.com/reports/85577, apps.owncloud.com: Potential XSS, resolved 85615, https://hackerone.com/reports/85615, Reflected XSS on vimeo.com/musicstore, resolved 85720, https://hackerone.com/reports/85720, IDOR on remoing Share, resolved 86022, https://hackerone.com/reports/86022, Multiple so called 'type juggling' attacks. Most notably PhabricatorUser::validateCSRFToken() is 'bypassable' in certain cases., resolved 86067, https://hackerone.com/reports/86067, Weak HSTS age in support hackerone site, resolved 86504, https://hackerone.com/reports/86504, [CRITICAL] Login To Any Account Linked With Google+ With Email Only, resolved 87027, https://hackerone.com/reports/87027, [keybase.io] Open Redirect, resolved 87168, https://hackerone.com/reports/87168, www.shopify.com XSS on blog pages via sharing buttons, resolved 87505, https://hackerone.com/reports/87505, Full Path Disclosure , resolved 87531, https://hackerone.com/reports/87531, Mail spaming, resolved 87561, https://hackerone.com/reports/87561, OAUTH pemission set as true= lead to authorize malicious application, resolved 87577, https://hackerone.com/reports/87577, Stored XSS on vimeo.com and player.vimeo.com, resolved 87588, https://hackerone.com/reports/87588, XSS Vulnerability, resolved 87752, https://hackerone.com/reports/87752, gallery_plus: Content Spoofing , resolved 87804, https://hackerone.com/reports/87804, [rabota.mail.ru] Open Redirect, resolved 87806, https://hackerone.com/reports/87806, [support.my.com] Internet Explorer XSS, resolved 87835, https://hackerone.com/reports/87835, Webview Vulnerablity [OwnCloudAndroid Application] , resolved 87854, https://hackerone.com/reports/87854, XSS on vimeo.com/home after other user follows you, resolved 88088, https://hackerone.com/reports/88088, XSS on mobile version of vimeo.com where the button "Follow" appears, resolved 88105, https://hackerone.com/reports/88105, XSS on vimeo.com | "Search within these results" feature (requires user interaction), resolved 88395, https://hackerone.com/reports/88395, Information leakage through Graphviz blocks, resolved 88508, https://hackerone.com/reports/88508, XSS when using captions/subtitles on video player based on Flash (requires user interaction), resolved 88719, https://hackerone.com/reports/88719, Multiple DOMXSS on Amplify Web Player, resolved 88881, https://hackerone.com/reports/88881, XSS: https://light.mail.ru/compose, https://m.mail.ru/compose/[id]/reply при ответе на специальным образом сформированное письмо, resolved 88904, https://hackerone.com/reports/88904, Apache Range Header Denial of Service Attack (Confirmed PoC), resolved 89081, https://hackerone.com/reports/89081, Vulnerability :- "XSS vulnerability", resolved 89097, https://hackerone.com/reports/89097, owncloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service), resolved 89178, https://hackerone.com/reports/89178, No rate limit or captcha to identify humans, resolved 89505, https://hackerone.com/reports/89505, Self-XSS in posts by formatting text as code, resolved 89624, https://hackerone.com/reports/89624, Cross-site Scripting https://www.zendesk.com/product/pricing/, resolved 90083, https://hackerone.com/reports/90083, Reflected XSS на https://aw.mail.ru/news/, resolved 90131, https://hackerone.com/reports/90131, CSV Excel Macro Injection Vulnerability in export customer tickets, resolved 90165, https://hackerone.com/reports/90165, CSRF в получении резервных токенов+framing , приводящие к компроментации 2fa, resolved 90172, https://hackerone.com/reports/90172, Tweetdeck (twitter owned app) not revoked, resolved 90274, https://hackerone.com/reports/90274, CSV Excel Macro Injection Vulnerability in export chat logs, resolved 90308, https://hackerone.com/reports/90308, User email enumuration using Gmail, resolved 90321, https://hackerone.com/reports/90321, Apache documentation, resolved 90367, https://hackerone.com/reports/90367, Minor Bug: Public un-compiled CSS with original sass, versioning, source map, comments, etc., resolved 90415, https://hackerone.com/reports/90415, CSV Excel Macro Injection in Export Response, resolved 90457, https://hackerone.com/reports/90457, Nested attributes reject_if proc can be circumvented by providing "_destroy" parameter, resolved 90601, https://hackerone.com/reports/90601, [s3.owncloud.com] Web Server HTTP Trace/Track Method Support , resolved 90643, https://hackerone.com/reports/90643, No email verification during registration, informative 90671, https://hackerone.com/reports/90671, Privilege escalation vulnerability, resolved 90688, https://hackerone.com/reports/90688, create staff member without owner access, resolved 90691, https://hackerone.com/reports/90691, [ling.go.mail.ru] Server-Status opened for all users, resolved 90753, https://hackerone.com/reports/90753, Content Spoofing , resolved 90778, https://hackerone.com/reports/90778, implement a cross-domain policy for Adobe products, not-applicable 90805, https://hackerone.com/reports/90805, change bank account numbers, resolved 90912, https://hackerone.com/reports/90912, Inadequate input validation on API endpoint leading to self denial of service and increased system load., resolved 90980, https://hackerone.com/reports/90980, owncloud.com: WP Super Cache plugin is outdated, resolved 91332, https://hackerone.com/reports/91332, Open Url redirection on login with facebook, informative 91343, https://hackerone.com/reports/91343, Information disclosure (No rate limting in forgot password & other login), resolved 91350, https://hackerone.com/reports/91350, "Sign me out everywhere" does not work for desktop sessions, resolved 91366, https://hackerone.com/reports/91366, Content Sniffing not enabled, resolved 91421, https://hackerone.com/reports/91421, Reflected Flash XSS using swfupload.swf with an epileptic reloading to bypass the button-event, resolved 91599, https://hackerone.com/reports/91599, WooCommerce: Support Ticket indirect object reference, resolved 91604, https://hackerone.com/reports/91604, Crossdomain.xml settings on api.imgur.com too open, resolved 91816, https://hackerone.com/reports/91816, Server Side Request Forgery In Video to GIF Functionality, informative 92113, https://hackerone.com/reports/92113, Уязвимость дает возможность смотреть кто лайкал приватным фото или видео , resolved 92251, https://hackerone.com/reports/92251, Issue with Password reset functionality, resolved 92271, https://hackerone.com/reports/92271, Недочет в поиске по хештегам, resolved 92344, https://hackerone.com/reports/92344, customers password hash leak!!!!, resolved 92353, https://hackerone.com/reports/92353, CSV Injection in polldaddy.com, resolved 92453, https://hackerone.com/reports/92453, unauthorized access to all customers first and last name , resolved 92472, https://hackerone.com/reports/92472, Tokens from services like Facebook can be stolen, resolved 92481, https://hackerone.com/reports/92481, Accessing Payments page and adding payment methods with limited access accounts, resolved 92607, https://hackerone.com/reports/92607, Content spoofing on invitations page , resolved 92633, https://hackerone.com/reports/92633, The POS Firmware is leaking the root Password which can be used for unauthorized access to the device., informative 92644, https://hackerone.com/reports/92644, apps.owncloud.com: Referer protection Bypassed, resolved 92716, https://hackerone.com/reports/92716, HackerOne Private Programs users disclosure and de-anonymous-ize, informative 92740, https://hackerone.com/reports/92740, SPF records not found, resolved 92915, https://hackerone.com/reports/92915, xss , informative 93004, https://hackerone.com/reports/93004, unauthorized access to all collections name, resolved 93020, https://hackerone.com/reports/93020, Способ узнать имя человека и ВУЗ удаленной страницы, resolved 93154, https://hackerone.com/reports/93154, Csrf near report abuse meme , resolved 93157, https://hackerone.com/reports/93157, SPF Protection not used, I can hijack your email server, informative 93294, https://hackerone.com/reports/93294, First & Last Name Disclosure of any Shopify Store Admin, resolved 93394, https://hackerone.com/reports/93394, Unauthenticated access to details of hidden products in any shop via title emuneration, resolved 93546, https://hackerone.com/reports/93546, pngcrush double-free/segfault could result in DoS (CVE-2015-7700), resolved 93550, https://hackerone.com/reports/93550, Reflected XSS via. search, resolved 93616, https://hackerone.com/reports/93616, get users information without full access, resolved 93680, https://hackerone.com/reports/93680, Missing authorization check on dashboard overviews, resolved 93691, https://hackerone.com/reports/93691, Arbitrary write on s3://shopify-delivery-app-storage/files, resolved 93807, https://hackerone.com/reports/93807, XSS by image file name, resolved 94230, https://hackerone.com/reports/94230, Cross-site Scripting in all Zopim, resolved 94502, https://hackerone.com/reports/94502, Some S3 Buckets are world readable (and one is world writeable), resolved 94517, https://hackerone.com/reports/94517, Reflective Xss on news.mail.ru and admin.news.mail.ru, resolved 94568, https://hackerone.com/reports/94568, http_basic_authenticate_with is suseptible to timing attacks., resolved 94584, https://hackerone.com/reports/94584, Sql-inj in https://maximum.com/ajax/people, resolved 94610, https://hackerone.com/reports/94610, Version Disclosure (NginX), resolved 94637, https://hackerone.com/reports/94637, Host Header Injection/Redirection, resolved 94642, https://hackerone.com/reports/94642, SMS Invite Form Abuse, resolved 94909, https://hackerone.com/reports/94909, XSS risk reduction with X-XSS-Protection: 1; mode=block header, resolved 94925, https://hackerone.com/reports/94925, Balance Manipulation - BUG, informative 95089, https://hackerone.com/reports/95089, Reflected XSS in cart at hardware.shopify.com, resolved 95146, https://hackerone.com/reports/95146, Reflected XSS., resolved 95231, https://hackerone.com/reports/95231, XSS in the "Poll" Feature on Twitter.com, resolved 95243, https://hackerone.com/reports/95243, Following a User Actually Follows Another User, resolved 95441, https://hackerone.com/reports/95441, Unauthorized access to any Store Admin's First & Last name, resolved 95552, https://hackerone.com/reports/95552, IDOR- Activate Mopub on different organizations- steal api token- Fabric.io, resolved 95564, https://hackerone.com/reports/95564, Persistent XSS in image title, resolved 95599, https://hackerone.com/reports/95599, Cross Site Scripting, resolved 95640, https://hackerone.com/reports/95640, Reflected XSS and/or malicious redirection via JWPlayer 6 configuration modification, informative 95804, https://hackerone.com/reports/95804, [api.allodsteam.com] Authentication Data, resolved 95841, https://hackerone.com/reports/95841, [allods.mail.ru] Reflected XSS, resolved 95981, https://hackerone.com/reports/95981, Http Response Splitting - Validate link, resolved 96007, https://hackerone.com/reports/96007, Domain takoever - https://sellocdn.com, resolved 96218, https://hackerone.com/reports/96218, Uses unsafe-inline without nonce , resolved 96229, https://hackerone.com/reports/96229, XSS on player.vimeo.com without user interaction and vimeo.com with user interaction, resolved 96294, https://hackerone.com/reports/96294, DDOS using xmlrpc.php, resolved 96337, https://hackerone.com/reports/96337, Stored XSS in Slack (weird, trial and error), resolved 96381, https://hackerone.com/reports/96381, Reflected XSS., resolved 96467, https://hackerone.com/reports/96467, Persistent XSS in https://p.imgur.com/albumview.gif and http://p.imgur.com/imageview.gif / post statistics, resolved 96470, https://hackerone.com/reports/96470, Missing of csrf protection , resolved 96474, https://hackerone.com/reports/96474, [it.mail.ru] Open Redirect, resolved 96662, https://hackerone.com/reports/96662, crossdomain.xml too permissive on eu1.badoo.com, us1.badoo.com, etc., resolved 96724, https://hackerone.com/reports/96724, [wos.my.com] Reflected XSS, resolved 96847, https://hackerone.com/reports/96847, Un-handled exception leads to Information Disclosure, resolved 96855, https://hackerone.com/reports/96855, Staff members with no permission to access domains can access them., resolved 96908, https://hackerone.com/reports/96908, An administrator without the 'Settings' permission is able to see payment gateways, resolved 97150, https://hackerone.com/reports/97150, [aw.my.com] Reflected XSS, resolved 97152, https://hackerone.com/reports/97152, [games.my.com] Reflected XSS, resolved 97153, https://hackerone.com/reports/97153, [sf.my.com] Reflected XSS, resolved 97161, https://hackerone.com/reports/97161, Can see private tweets via keyword searches on tweetdeck, resolved 97268, https://hackerone.com/reports/97268, [evo2.my.com] Reflected XSS, resolved 97292, https://hackerone.com/reports/97292, HTTP header injection in info.hackerone.com allows setting cookies for hackerone.com, resolved 97295, https://hackerone.com/reports/97295, Multiple critical vulnerabilities in Odnoklassniki Android application, resolved 97312, https://hackerone.com/reports/97312, [mg.my.com] Reflected XSS, resolved 97317, https://hackerone.com/reports/97317, [allods.my.com] Full SQL Disclosure, resolved 97319, https://hackerone.com/reports/97319, [allods.my.com] Full Path Disclosure, resolved 97332, https://hackerone.com/reports/97332, [evo.my.com] Reflected XSS, resolved 97333, https://hackerone.com/reports/97333, [lucky-fields.my.com] Reflected XSS, resolved 97334, https://hackerone.com/reports/97334, [support.my.com] Reflected XSS, resolved 97395, https://hackerone.com/reports/97395, Potential SSRF in sales.mail.ru, resolved 97430, https://hackerone.com/reports/97430, [allods.my.com] Reflected XSS, resolved 97431, https://hackerone.com/reports/97431, [id.my.com] Reflected XSS, resolved 97432, https://hackerone.com/reports/97432, [furry.aw.my.com] Reflected XSS, resolved 97445, https://hackerone.com/reports/97445, [legal.my.com] Reflected XSS, resolved 97452, https://hackerone.com/reports/97452, Staff members with no permission can access to the files, uploaded by the administrator, resolved 97501, https://hackerone.com/reports/97501, SVG parser loads external resources on image upload, resolved 97510, https://hackerone.com/reports/97510, Following a User After Favoriting Actually Follows Another User (related to #95243), resolved 97609, https://hackerone.com/reports/97609, User Enumeration : Due to rate limiting on registration, informative 97646, https://hackerone.com/reports/97646, [account.my.com] Reflected XSS, resolved 97657, https://hackerone.com/reports/97657, File upload XSS (Java applet) on http://slackatwork.com/, resolved 97672, https://hackerone.com/reports/97672, File Upload XSS in image uploading of App in mopub, resolved 97683, https://hackerone.com/reports/97683, Reflected Self-XSS in Slack, resolved 97938, https://hackerone.com/reports/97938, XSS m.imgur.com, resolved 98012, https://hackerone.com/reports/98012, Stored XSS on https://www.algolia.com/realtime-search-demo/*, resolved 98281, https://hackerone.com/reports/98281, XSS Reflected in test.qiwi.ru, resolved 98432, https://hackerone.com/reports/98432, Urgent : Disclosure of all the apps with hash ID in mopub through API request (Authentication bypass) , resolved 98512, https://hackerone.com/reports/98512, [maps.me] Reflected XSS, resolved 98559, https://hackerone.com/reports/98559, RCE in ci.owncloud.com / ci.owncloud.org, resolved 98819, https://hackerone.com/reports/98819, S3 Buckets open to the world thanks to 'Authenticated Users' ACL , resolved 99054, https://hackerone.com/reports/99054, [opensource.mail.ru] Debug Mode, resolved 99157, https://hackerone.com/reports/99157, RC4 cipher suites detected on status.slack.com, resolved 99262, https://hackerone.com/reports/99262, [otus.p.mail.ru] Full Path Disclosure, resolved 99268, https://hackerone.com/reports/99268, [otus.p.mail.ru] CRLF Injection, resolved 99273, https://hackerone.com/reports/99273, [gitmm.corp.mail.ru] Auth Bypass, Information Disclosure, resolved 99279, https://hackerone.com/reports/99279, XML External Entity (XXE) in qiwi.com + waf bypass, resolved 99321, https://hackerone.com/reports/99321, [CSRF] Activate PayPal Express Checkout, resolved 99368, https://hackerone.com/reports/99368, an xss issue, resolved 99374, https://hackerone.com/reports/99374, deleted staff member can add his amazon marketplace web services account to the store., resolved 99424, https://hackerone.com/reports/99424, Mass Assignment Vulnerability in partners.uber.com, resolved 99435, https://hackerone.com/reports/99435, Open redirect helps to steal Facebook access_token, resolved 99516, https://hackerone.com/reports/99516, open redirect in .zendesk.com, resolved 99594, https://hackerone.com/reports/99594, Reflected XSS on www.boozt.com, resolved 99600, https://hackerone.com/reports/99600, Urgent : Unauthorised Access to Media content of all Direct messages and protected tweets(Indirect object reference), resolved 99647, https://hackerone.com/reports/99647, CSRF Add Album On onpatient.com , resolved 99686, https://hackerone.com/reports/99686, [w1.dwar.ru] Core Dump, resolved 99687, https://hackerone.com/reports/99687, profile cover can also load external URL's , resolved 99708, https://hackerone.com/reports/99708, Limited CSRF bypass., resolved 99857, https://hackerone.com/reports/99857, Request Accepts without X-CSRFToken [ Header - Cookie ], resolved 99863, https://hackerone.com/reports/99863, From full-access account to Account Owner, resolved 100186, https://hackerone.com/reports/100186, Transactions visible on Unconfirmed devices, resolved 100200, https://hackerone.com/reports/100200, Open Redirect in meeting.qiwi.com, resolved 100509, https://hackerone.com/reports/100509, Pre-generation of 2FA secret/backup codes seems like an unnecessary risk, resolved 100550, https://hackerone.com/reports/100550, [xss, pornhub.com] /user/[username], multiple parameters, resolved 100552, https://hackerone.com/reports/100552, Cross Site Scripting - On Mouse Over, Blog page, resolved 100565, https://hackerone.com/reports/100565, Executing scripts on slack-files.com using SVG, resolved 100755, https://hackerone.com/reports/100755, Reflected XSS on hi-tech.mail.ru, resolved 100820, https://hackerone.com/reports/100820, Add tweet to collection CSRF , resolved 100829, https://hackerone.com/reports/100829, Stored-XSS in https://www.coinbase.com/, resolved 100849, https://hackerone.com/reports/100849, URGENT : NICHE.co Account Take Over Vulnerability, resolved 100916, https://hackerone.com/reports/100916, Imgur dev environments facing the Internet, resolved 100926, https://hackerone.com/reports/100926, Access to internal CMS containing private Data, resolved 100931, https://hackerone.com/reports/100931, xss in link items (mopub.com), resolved 100938, https://hackerone.com/reports/100938, An administrator without any permission is able to get order notifications using his APNS Token., resolved 100956, https://hackerone.com/reports/100956, Cookie securing your "Opening soon" store is not secured against XSS, resolved 101063, https://hackerone.com/reports/101063, Drivers can change profile picture, resolved 101104, https://hackerone.com/reports/101104, Subdomain Expired, resolved 101108, https://hackerone.com/reports/101108, Reflected Cross-Site Scripting on French subdomain, resolved 101145, https://hackerone.com/reports/101145, Remove anyone's pic gravtar, resolved 101324, https://hackerone.com/reports/101324, RC4 cipher suites detected, resolved 101330, https://hackerone.com/reports/101330, SSL certificate invalid date, resolved 101331, https://hackerone.com/reports/101331, RC4 cipher suites detected, resolved 101450, https://hackerone.com/reports/101450, XSS in creating tweets, resolved 101909, https://hackerone.com/reports/101909, account.ubnt.com CSRF, resolved 101977, https://hackerone.com/reports/101977, Login to any user account using other facebook app access token , resolved 101983, https://hackerone.com/reports/101983, Cookie bug, resolved 102194, https://hackerone.com/reports/102194, [CRITICAL] CSRF leading to account take over, resolved 102234, https://hackerone.com/reports/102234, Same-Origin Policy bypass on main domain - ok.ru, resolved 102236, https://hackerone.com/reports/102236, Same-Origin Policy Bypass #2 , resolved 102327, https://hackerone.com/reports/102327, content injection, resolved 102376, https://hackerone.com/reports/102376, Обход защиты от csrf-ок в m.ok.ru, resolved 102755, https://hackerone.com/reports/102755, Stored XSS in name selection, resolved 103178, https://hackerone.com/reports/103178, Attack User Privacy Settings - X-Frame-Options missing on m.imgur.com/user/username/settings, resolved 103182, https://hackerone.com/reports/103182, [babel.mail.ru] Admin Page Found, resolved 103351, https://hackerone.com/reports/103351, [CSRF] Install premium themes , resolved 103432, https://hackerone.com/reports/103432, URGENT - Subdomain Takeover in support.urbandictionary.com pointing to Zendesk, resolved 103546, https://hackerone.com/reports/103546, manipulate the Practical HTTP Host header , resolved 103651, https://hackerone.com/reports/103651, Stored XSS in Draft Articles. , resolved 103772, https://hackerone.com/reports/103772, Open Redirect at *.myshopify.com/account/login?checkout_url=, resolved 103787, https://hackerone.com/reports/103787, CSRF possible when SOP Bypass/UXSS is available , resolved 103990, https://hackerone.com/reports/103990, Null pointer dereference in phar_get_fp_offset(), resolved 103991, https://hackerone.com/reports/103991, mod_lua: Crash in websockets PING handling, resolved 103992, https://hackerone.com/reports/103992, Integer overflow in _Unpickler_Read, resolved 103993, https://hackerone.com/reports/103993, Request Hijacking Vulnerability In RubyGems 2.4.6 And Earlier, resolved 103994, https://hackerone.com/reports/103994, Python 3.3 - 3.5 product_setstate() Out-of-bounds Read, resolved 103995, https://hackerone.com/reports/103995, Use After Free Vulnerability in unserialize() with SplDoublyLinkedList, resolved 103996, https://hackerone.com/reports/103996, Use After Free Vulnerability in unserialize() with SplObjectStorage, resolved 103997, https://hackerone.com/reports/103997, Use After Free Vulnerability in unserialize(), resolved 103998, https://hackerone.com/reports/103998, Use After Free Vulnerability in session deserializer, resolved 103999, https://hackerone.com/reports/103999, Use after free vulnerability in unserialize() with GMP, resolved 104000, https://hackerone.com/reports/104000, Python xmlparse_setattro() Type Confusion, resolved 104001, https://hackerone.com/reports/104001, time_strftime() Buffer Over-read, resolved 104002, https://hackerone.com/reports/104002, Python scan_eol() Buffer Over-read, resolved 104003, https://hackerone.com/reports/104003, Python deque.index() uninitialized memory, resolved 104004, https://hackerone.com/reports/104004, Mem out-of-bounds write (segfault) in ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER, resolved 104005, https://hackerone.com/reports/104005, null pointer deref (segfault) in zend_eval_const_expr, resolved 104006, https://hackerone.com/reports/104006, Null pointer deref (segfault) in spl_autoload via ob_start, resolved 104007, https://hackerone.com/reports/104007, Buffer over-read in exif_read_data with TIFF IFD tag, resolved 104008, https://hackerone.com/reports/104008, Uninitialized pointer in phar_make_dirstream, resolved 104009, https://hackerone.com/reports/104009, zend_throw_or_error() format string vulnerability, resolved 104010, https://hackerone.com/reports/104010, SOAP serialize_function_call() type confusion / RCE, resolved 104011, https://hackerone.com/reports/104011, AddressSanitizer reports a global buffer overflow in mkgmtime() function, resolved 104012, https://hackerone.com/reports/104012, Integer overflow in unserialize() (32-bits only), resolved 104013, https://hackerone.com/reports/104013, heap buffer overflow in enchant_broker_request_dict(), resolved 104014, https://hackerone.com/reports/104014, libcurl duphandle read out of bounds, resolved 104015, https://hackerone.com/reports/104015, curl_setopt_array() type confusion, resolved 104016, https://hackerone.com/reports/104016, Dangling pointer in the unserialization of ArrayObject items, resolved 104017, https://hackerone.com/reports/104017, Arbitrary code execution in str_ireplace function, resolved 104018, https://hackerone.com/reports/104018, Multiple Use After Free Vulnerabilites in unserialize(), resolved 104019, https://hackerone.com/reports/104019, Files extracted from archive may be placed outside of destination directory, resolved 104020, https://hackerone.com/reports/104020, audioop.lin2adpcm Buffer Over-read, resolved 104021, https://hackerone.com/reports/104021, audioop.adpcm2lin Buffer Over-read, resolved 104022, https://hackerone.com/reports/104022, hotshot pack_string Heap Buffer Overflow, resolved 104023, https://hackerone.com/reports/104023, bytearray.find Buffer Over-read, resolved 104024, https://hackerone.com/reports/104024, array.fromstring Use After Free, resolved 104025, https://hackerone.com/reports/104025, use after free in load_newobj_ex, resolved 104026, https://hackerone.com/reports/104026, invalid pointer free() in phar_tar_process_metadata(), resolved 104027, https://hackerone.com/reports/104027, Memory Corruption in phar_parse_tarfile when entry filename starts with null, resolved 104028, https://hackerone.com/reports/104028, Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow), resolved 104032, https://hackerone.com/reports/104032, PyFloat_FromString & PyNumber_Long Buffer Over-reads, resolved 104033, https://hackerone.com/reports/104033, tokenizer crash when processing undecodable source code, resolved 104087, https://hackerone.com/reports/104087, Trick make all fixed open redirect links vulnerable again, resolved 104359, https://hackerone.com/reports/104359, shopifyapps.com XSS on sales channels via currency formatting, resolved 104465, https://hackerone.com/reports/104465, git-fastclone allows arbitrary command execution through usage of ext remote URLs in submodules, resolved 104488, https://hackerone.com/reports/104488, [rubm.qiwi.com] Yui charts.swf XSS, resolved 104543, https://hackerone.com/reports/104543, HTML injection in apps user review , resolved 104559, https://hackerone.com/reports/104559, XSS on codex.wordpress.org, resolved 104620, https://hackerone.com/reports/104620, XXE in OAuth2 Applications gallery profile App logo, informative 104896, https://hackerone.com/reports/104896, [status.zopim.com] Open Redirect, resolved 104917, https://hackerone.com/reports/104917, Cross-Site Scripting Reflected On Main Domain, resolved 104931, https://hackerone.com/reports/104931, CSRF in Connecting Pinterest Account, resolved 105149, https://hackerone.com/reports/105149, directory listing in https://demo.owncloud.org/doc/, resolved 105190, https://hackerone.com/reports/105190, Unsafe usage of Ruby string interpolation enabling command injection in git-fastclone, resolved 105419, https://hackerone.com/reports/105419, Cookie-Based Injection, resolved 105434, https://hackerone.com/reports/105434, [rev-app.informatica.com] - XXE, resolved 105463, https://hackerone.com/reports/105463, risk of having secure=false in a crossdomain.xml, resolved 105486, https://hackerone.com/reports/105486, PornIQ Reflected Cross-Site Scripting, resolved 105655, https://hackerone.com/reports/105655, [crossdomain.xml] Dangerous Flash Cross-Domain Policy, resolved 105657, https://hackerone.com/reports/105657, libphutil: removing bytes from a PhutilRope does not work as intended, resolved 105659, https://hackerone.com/reports/105659, many xss in widgets.shopifyapps.com, resolved 105688, https://hackerone.com/reports/105688, DOM Based XSS in Checkout, resolved 105753, https://hackerone.com/reports/105753, [app.informaticaondemand.com] XXE, resolved 105787, https://hackerone.com/reports/105787, XXE in upload file feature, resolved 105953, https://hackerone.com/reports/105953, Parameter pollution in social sharing buttons, resolved 105977, https://hackerone.com/reports/105977, DLL Hijacking Vulnerability in GlassWireSetup.exe, resolved 105980, https://hackerone.com/reports/105980, XXE at host vpn.owncloud.com, resolved 106024, https://hackerone.com/reports/106024, owncloud.com: Parameter pollution in social sharing buttons, resolved 106084, https://hackerone.com/reports/106084, Team Member███ associated with a Custom Group Created with 'Program Managment' only permissions can Comments on Bug Reports , resolved 106179, https://hackerone.com/reports/106179, Уязвимость дает возможность видеть записи , которые предлагаются пабликам + еще, resolved 106293, https://hackerone.com/reports/106293, Reflective XSS on wholesale.shopify.com, resolved 106305, https://hackerone.com/reports/106305, Improve signals in reputation, resolved 106315, https://hackerone.com/reports/106315, Potential for Double Spend via Sign Message Utility, informative 106348, https://hackerone.com/reports/106348, text injection can be used in phishing 404 page should not include attacker text, resolved 106350, https://hackerone.com/reports/106350, text injection can be used in phishing 404 page should not include attacker text, resolved 106360, https://hackerone.com/reports/106360, Race condition allowing user to review app multiple times, resolved 106362, https://hackerone.com/reports/106362, Clickjacking : https://partners.cloudflare.com/, resolved 106384, https://hackerone.com/reports/106384, Application error message, resolved 106427, https://hackerone.com/reports/106427, HTTP-Response-Splitting on v.shopify.com, resolved 106548, https://hackerone.com/reports/106548, Format string vulnerability in zend_throw_or_error(), resolved 106636, https://hackerone.com/reports/106636, Strored Cross Site Scripting, resolved 106678, https://hackerone.com/reports/106678, [now.informatica.com] Reflective XSS, resolved 106779, https://hackerone.com/reports/106779, Stored XSS in comments, resolved 106797, https://hackerone.com/reports/106797, [marketplace.informatica.com] - XXE, resolved 106802, https://hackerone.com/reports/106802, [marketplace.informatica.com] - XXE, resolved 106806, https://hackerone.com/reports/106806, Добавление в меню сообщества без ведома пользователя (нажатия пользователем), resolved 106865, https://hackerone.com/reports/106865, [rev-app.informatica.com] - XXE via SAML, resolved 106897, https://hackerone.com/reports/106897, Stored XSS in /admin/orders , resolved 106982, https://hackerone.com/reports/106982, XSS in imgur mobile, resolved 107036, https://hackerone.com/reports/107036, XSS in imgur mobile 3, resolved 107213, https://hackerone.com/reports/107213, GlassWireSetup.exe subject to EXE planting attack, resolved 107296, https://hackerone.com/reports/107296, Possible Timing Side-Channel in XMLRPC Verification, resolved 107336, https://hackerone.com/reports/107336, Team Member(s) associated with a Group have Read-only permission (Post internal comments) can post comment to all the participants , resolved 107358, https://hackerone.com/reports/107358, reflected in xss, resolved 107849, https://hackerone.com/reports/107849, [https://test1.owncloud.com/owncloud6/] Guessable password used for admin user, resolved 107877, https://hackerone.com/reports/107877, API: Bug in method auth.signup , дающий возможность бесконечно звонить , resolved 107960, https://hackerone.com/reports/107960, Reflected File Download in community.ubnt.com/restapi/, resolved 108113, https://hackerone.com/reports/108113, Bypassing callback_url validation on Digits, resolved 108288, https://hackerone.com/reports/108288, otrs.owncloud.com: Reflected Cross-Site Scripting, resolved 108645, https://hackerone.com/reports/108645, Harden resend throttling, resolved 108681, https://hackerone.com/reports/108681, Use After Free Vulnerability in WDDX Packet Deserialization, resolved 108682, https://hackerone.com/reports/108682, Type Confusion Vulnerability in PHP_to_XMLRPC_worker(), resolved 108683, https://hackerone.com/reports/108683, Session WDDX Packet Deserialization Type Confusion Vulnerability, resolved 108692, https://hackerone.com/reports/108692, Mixed Active Scripting Issue on stats.owncloud.org, resolved 108723, https://hackerone.com/reports/108723, Validation bypass for Active Record and Active Model, resolved 108928, https://hackerone.com/reports/108928, Signals get affected once reports closed as self , resolved 109054, https://hackerone.com/reports/109054, HTTP trace method is enabled, resolved 109116, https://hackerone.com/reports/109116, Directory Listing on grtp.co, informative 109161, https://hackerone.com/reports/109161, protect against tabnabbing in statement, resolved 109175, https://hackerone.com/reports/109175, Use After Free in sortWithSortKeys(), resolved 109352, https://hackerone.com/reports/109352, XSS in GM , resolved 109395, https://hackerone.com/reports/109395, gmmovinparts.com SQLi via forgot_password.jsp, resolved 109420, https://hackerone.com/reports/109420, Requesting unknown file type returns Ruby object w/ address, resolved 109461, https://hackerone.com/reports/109461, refelected Xss on https://gmid.gm.com/gmid/jsp/GMIDInitialLogin.jsp, resolved 109485, https://hackerone.com/reports/109485, Race Condition in Article "Helpful" Indicator, resolved 109699, https://hackerone.com/reports/109699, Subdomain Takeover in http://assets.goubiquiti.com/, resolved 109810, https://hackerone.com/reports/109810, The 'Create a New Account' action is vulnerable to CSRF, not-applicable 109815, https://hackerone.com/reports/109815, Direct URL access to completed reports, resolved 109832, https://hackerone.com/reports/109832, HTML injection via 'underlying' parameter, duplicate 109839, https://hackerone.com/reports/109839, CSRF in Udemy.com , informative 109843, https://hackerone.com/reports/109843, Uninitialized pointer in phar_make_dirstream(), resolved 109959, https://hackerone.com/reports/109959, Extended policy checks are buggy, resolved 110293, https://hackerone.com/reports/110293, Insufficient OAuth callback validation which leads to Periscope account takeover, resolved 110352, https://hackerone.com/reports/110352, Perl 5.22 VDir::MapPathA/W Out-of-bounds Reads and Buffer Over-reads, resolved 110417, https://hackerone.com/reports/110417, Heap corruption in tar/zip/phar parser, resolved 110467, https://hackerone.com/reports/110467, Bypassing Digits bridge origin validation, resolved 110655, https://hackerone.com/reports/110655, Information Exposure Through Directory Listing, resolved 110720, https://hackerone.com/reports/110720, Arbitary Memory Read via gdImageRotateInterpolated Array Index Out of Bounds, resolved 110722, https://hackerone.com/reports/110722, Heap BufferOver Flow in escapeshellargs and escapeshellcmd functions, resolved 110801, https://hackerone.com/reports/110801, Internal GET SSRF via CSRF with Press This scan feature, resolved 111003, https://hackerone.com/reports/111003, [cfire.mail.ru] Time Based SQL Injection 2, resolved 111078, https://hackerone.com/reports/111078, Sub Domain Take over, resolved 111094, https://hackerone.com/reports/111094, Content Spoofing OR Text Injection in https://withinsecurity.com, resolved 111131, https://hackerone.com/reports/111131, XSS, duplicate 111192, https://hackerone.com/reports/111192, CSV Injection via the CSV export feature, resolved 111216, https://hackerone.com/reports/111216, Twitter Disconnect CSRF, resolved 111218, https://hackerone.com/reports/111218, Attach Pinterest account - no State/CSRF parameter in Oauth Call back, resolved 111262, https://hackerone.com/reports/111262, The csrf token remains same after user logs in, resolved 111269, https://hackerone.com/reports/111269, [ssrf] libav vulnerable during conversion of uploaded videos, resolved 111365, https://hackerone.com/reports/111365, XSS at www.woothemes.com, resolved 111386, https://hackerone.com/reports/111386, Legacy API exposes private video titles, resolved 111417, https://hackerone.com/reports/111417, Checking whether user liked the media or not even when you are blocked , resolved 111475, https://hackerone.com/reports/111475, www.shopify.com XSS via third-party script, resolved 111500, https://hackerone.com/reports/111500, XSS at wordpress.com, resolved 111514, https://hackerone.com/reports/111514, [3k.mail.ru] Content Spoofing, resolved 111643, https://hackerone.com/reports/111643, Full access to Amazon S3 bucket containing AWS CloudTrail logs, resolved 111752, https://hackerone.com/reports/111752, Big Bug in SSL : breach compression attack (CVE-2013-3587) affect imgur.com, resolved 111763, https://hackerone.com/reports/111763, XSS vulnerability in "/coach/roster/" ( create your first class) , resolved 111860, https://hackerone.com/reports/111860, Error Page Text Injection #106350, resolved 111915, https://hackerone.com/reports/111915, [CRITICAL] HTML injection issue leading to account take over, resolved 111999, https://hackerone.com/reports/111999, Full Path Disclosure on gmchat.gm.com, resolved 112001, https://hackerone.com/reports/112001, XSS on gmchat.gm.com, resolved 112025, https://hackerone.com/reports/112025, Stored XSS, informative 112057, https://hackerone.com/reports/112057, Heapoverflow in zipimporter module, resolved 112116, https://hackerone.com/reports/112116, XXE in the Connector Designer, resolved 112156, https://hackerone.com/reports/112156, SSRF in the Connector Designer (REST and Elastic Search), resolved 112166, https://hackerone.com/reports/112166, The JDBC driver used by the Vertica connector allows to create files on the backends, resolved 112224, https://hackerone.com/reports/112224, Logical Vulnerability : REDIRECTING on pw.mail.ru by Parameter Spoofing, resolved 112304, https://hackerone.com/reports/112304, owncloud.help: Text Injection, resolved 112306, https://hackerone.com/reports/112306, Full takeover of some binary.com sub domains, resolved 112372, https://hackerone.com/reports/112372, XSS during presentation, resolved 112386, https://hackerone.com/reports/112386, smartlist_add, smartlist_insert (may) cause heap corruption as a result of inadequate checks in smartlist_ensure_capacity, resolved 112496, https://hackerone.com/reports/112496, Session Issue Maybe Can lead to huge loss [CRITICAL], resolved 112632, https://hackerone.com/reports/112632, [tor] libevent dns remote stack overread vulnerability, resolved 112687, https://hackerone.com/reports/112687, grtp.co is vulnerable to http-vuln-cve2011-3192, informative 112723, https://hackerone.com/reports/112723, PHP-FPM fpm_log.c memory leak and buffer overflow, resolved 112784, https://hackerone.com/reports/112784, libevent (stack) buffer overflow in evutil_parse_sockaddr_port, resolved 112855, https://hackerone.com/reports/112855, EIP control using type confusion in json encoding, resolved 112858, https://hackerone.com/reports/112858, UAF in xmlparser_setevents (1), resolved 112860, https://hackerone.com/reports/112860, UAF in xmlparser_setevents (2), resolved 112863, https://hackerone.com/reports/112863, Trivial age-old heap overflow in 32-bit PHP, resolved 112869, https://hackerone.com/reports/112869, [s2.jugger.ru] Content Spoofing, resolved 112871, https://hackerone.com/reports/112871, [tanks.mail.ru] Content Spoofing, resolved 112935, https://hackerone.com/reports/112935, Unintended HTML inclusion as a result of https://hackerone.com/reports/110578, resolved 112955, https://hackerone.com/reports/112955, WordPress Failure Notice page will generate arbitrary hyperlinks, resolved 113120, https://hackerone.com/reports/113120, An integer overflow bug in php_implode() could lead heap overflow, make PHP to crash, resolved 113122, https://hackerone.com/reports/113122, An integer overflow bug in php_str_to_str_ex() led arbitrary code execution., resolved 113211, https://hackerone.com/reports/113211, No Any Kind of Protection on Delete account, resolved 113268, https://hackerone.com/reports/113268, Integer overflow in wordwrap, resolved 113332, https://hackerone.com/reports/113332, [api.login.icq.net] Open Redirect, resolved 113336, https://hackerone.com/reports/113336, [api.login.icq.net] Reflected XSS, resolved 113339, https://hackerone.com/reports/113339, Cross-domain AJAX request, informative 113370, https://hackerone.com/reports/113370, [warofdragons.com] Content Spoofing, resolved 113424, https://hackerone.com/reports/113424, [tor] control connection pre-auth DoS (infinite loop) with --enable-bufferevents, resolved 113798, https://hackerone.com/reports/113798, Null pointer deref with ob_start with compact, resolved 113799, https://hackerone.com/reports/113799, Null pointer deref with ob_start with get_defined_vars, resolved 113831, https://hackerone.com/reports/113831, Regarding [CVE-2016-0752] Possible Information Leak Vulnerability in Action View, resolved 113857, https://hackerone.com/reports/113857, CSRF AT SELECTING ZAMATO HANDLE, resolved 113865, https://hackerone.com/reports/113865, CSRF AT INVITING PEOPLE THOUGH PHONE NUMBER, resolved 113869, https://hackerone.com/reports/113869, Subdomain Takeover , resolved 113928, https://hackerone.com/reports/113928, Remote code execution using render :inline, resolved 114024, https://hackerone.com/reports/114024, Stack overflow when decompressing tar archives, resolved 114078, https://hackerone.com/reports/114078, Use-after-free vulnerability in SPL(ArrayObject, unserialize), resolved 114079, https://hackerone.com/reports/114079, Use-after-free vulnerability in SPL(SplObjectStorage, unserialize), resolved 114086, https://hackerone.com/reports/114086, [parapa.mail.ru] SQL Injection reapet, resolved 114125, https://hackerone.com/reports/114125, Remote Server Restart Lead to Denial of Server by only one Request., resolved 114127, https://hackerone.com/reports/114127, Twitter Disconnect CSRF, resolved 114134, https://hackerone.com/reports/114134, Subdomain takeover in http://support.scan.me pointing to Zendesk (a Snapchat acquisition), resolved 114151, https://hackerone.com/reports/114151, Cross Site Scripting - type Patameter, resolved 114169, https://hackerone.com/reports/114169, Bypassing Digits web authentication's host validation with HPP, resolved 114172, https://hackerone.com/reports/114172, Out-of-Bound Read in phar_parse_zipfile(), resolved 114198, https://hackerone.com/reports/114198, [touch.lady.mail.ru] CRLF Injection , resolved 114339, https://hackerone.com/reports/114339, Type Confusion in WDDX Packet Deserialization, resolved 114389, https://hackerone.com/reports/114389, Remote File Upload Vulnerability in business-blog.zomato.com, resolved 114414, https://hackerone.com/reports/114414, openssl_seal() uninitialized memory usage, resolved 114430, https://hackerone.com/reports/114430, CSRF on https://shopify.com/plus, resolved 114476, https://hackerone.com/reports/114476, Внедрение внешних сущностей в функционале импорта пользователей YouTrack, resolved 114631, https://hackerone.com/reports/114631, Several XSS affecting Zomato.com and developers.zomato.com, resolved 114698, https://hackerone.com/reports/114698, Remote Server Restart Lead to Denial of Service by only one Request., resolved 114796, https://hackerone.com/reports/114796, No validation on account names, resolved 114797, https://hackerone.com/reports/114797, A Log in page does not properly validate the authenticity token at the server side, resolved 114799, https://hackerone.com/reports/114799, A Signup page does not properly validate the authenticity token at the server side., resolved 114807, https://hackerone.com/reports/114807, Unsafe HTML in reset password email and Account verification in email is missing in Sign up, resolved 114870, https://hackerone.com/reports/114870, Basic Authorization over HTTP, resolved 114879, https://hackerone.com/reports/114879, Persistent input validation mail encoding vulnerability in the "just followed you" email notification., resolved 115007, https://hackerone.com/reports/115007, Race conditions can be used to bypass invitation limit, resolved 115036, https://hackerone.com/reports/115036, Weak Password Policy, resolved 115158, https://hackerone.com/reports/115158, CSRF in twitterflightschool.com ( CAN POST ON TIMELINE WITHOUT USER PERMISSION), resolved 115205, https://hackerone.com/reports/115205, Putting link inside link in markdown, resolved 115209, https://hackerone.com/reports/115209, Unauthorized file (invoice) download, duplicate 115219, https://hackerone.com/reports/115219, Information Disclosure in Error Page, informative 115230, https://hackerone.com/reports/115230, Content spoofing due to the improper behavior of the not-found meesage, resolved 115232, https://hackerone.com/reports/115232, Email spoofing, duplicate 115245, https://hackerone.com/reports/115245, Email Authentication bypass Vulnerability, duplicate 115246, https://hackerone.com/reports/115246, DNSsec not configured, informative 115248, https://hackerone.com/reports/115248, XSS and CSRF in Zomato Contact form, resolved 115250, https://hackerone.com/reports/115250, Missing SPF records for paragonie.com, duplicate 115271, https://hackerone.com/reports/115271, SSL certificate public key less than 2048 bit, not-applicable 115275, https://hackerone.com/reports/115275, SPF DNS Record , resolved 115284, https://hackerone.com/reports/115284, prevent content spoofing on /search, resolved 115294, https://hackerone.com/reports/115294, Missing SPF, duplicate 115296, https://hackerone.com/reports/115296, Your Application Have Cacheable SSL Pages, informative 115304, https://hackerone.com/reports/115304, Blind SQL INJ, not-applicable 115315, https://hackerone.com/reports/115315, Missing SPF for paragonie.com, duplicate 115323, https://hackerone.com/reports/115323, CSRF AT SUBSCRIBE TO LIST , not-applicable 115337, https://hackerone.com/reports/115337, Full Path Disclosure, resolved 115390, https://hackerone.com/reports/115390, Missing SPF for paragonie.com, duplicate 115402, https://hackerone.com/reports/115402, XSS via modified Zomato widget (res_search_widget.php), resolved 115422, https://hackerone.com/reports/115422, Full Path Disclosure in password lock, informative 115438, https://hackerone.com/reports/115438, Cross-Site Scripting Vulnerability in urbandictionary.com, resolved 115452, https://hackerone.com/reports/115452, Email Spoof, spam 115560, https://hackerone.com/reports/115560, Two XSS vulns in widget parameters (all_collections.php and o2.php), resolved 115628, https://hackerone.com/reports/115628, SUBDOMAIN TAKEOVER(FIXED), resolved 115686, https://hackerone.com/reports/115686, [tor] pre-emptive defenses, potential vulnerabilities, resolved 115702, https://hackerone.com/reports/115702, [tor] libevent dns OOB read, resolved 115748, https://hackerone.com/reports/115748, SSRF in https://imgur.com/vidgif/url, resolved 115817, https://hackerone.com/reports/115817, WordPress User Enumeration - blog.newrelic.com, informative 115844, https://hackerone.com/reports/115844, Rate limiting on password reset links , resolved 115845, https://hackerone.com/reports/115845, Rate limiting on Email confirmation link, resolved 115857, https://hackerone.com/reports/115857, SSRF and local file read in video to gif converter, resolved 115860, https://hackerone.com/reports/115860, [login.newrelic.com] XSS via return_to, resolved 115922, https://hackerone.com/reports/115922, [download.newrelic.com] Access to private directories, resolved 115978, https://hackerone.com/reports/115978, SSRF / Local file enumeration / DoS due to improper handling of certain file formats by ffmpeg, resolved 116006, https://hackerone.com/reports/116006, XSS on hardware.shopify.com, resolved 116057, https://hackerone.com/reports/116057, file full path discloser., informative 116135, https://hackerone.com/reports/116135, Reflected Cross Site Script in www.gmcar.gm.com, resolved 116179, https://hackerone.com/reports/116179, Unauthorized Access, resolved 116189, https://hackerone.com/reports/116189, Null byte injection , resolved 116243, https://hackerone.com/reports/116243, Potential Subdomain Takeover - http://storefront.newrelic.com/, resolved 116254, https://hackerone.com/reports/116254, owncloud.com: Persistent XSS In Account Profile, resolved 116286, https://hackerone.com/reports/116286, Type confusion in partial.setstate, partial_repr, partial_call leads to memory corruption, reliable control flow hijack, resolved 116315, https://hackerone.com/reports/116315, open redirection at login, resolved 116352, https://hackerone.com/reports/116352, nginx SPDY heap buffer overflow for https://grtp.co/, informative 116360, https://hackerone.com/reports/116360, The POODLE attack (SSLv3 supported) for https://grtp.co/, resolved 116372, https://hackerone.com/reports/116372, Use-After-Free / Double-Free in WDDX Deserialize, resolved 116382, https://hackerone.com/reports/116382, Content Spoof in webcaps.ecomm.gm.com, resolved 116419, https://hackerone.com/reports/116419, an xss issue in https://hunter22.slack.com/help/requests/793043, resolved 116432, https://hackerone.com/reports/116432, E-mail Spoof in media.gm.com, resolved 116504, https://hackerone.com/reports/116504, Auth bypass on directory.corp.ubnt.com, resolved 116512, https://hackerone.com/reports/116512, Markdown parsing issue enables insertion of malicious tags, informative 116575, https://hackerone.com/reports/116575, Remote Code Execution (upload), resolved 116609, https://hackerone.com/reports/116609, SPF Issue , resolved 116618, https://hackerone.com/reports/116618, proxy port 7000 and shell port 514 not filtered, informative 116621, https://hackerone.com/reports/116621, server calendar and server status available to public, informative 116692, https://hackerone.com/reports/116692, PHP version disclosed on blog.algolia.com, resolved 116764, https://hackerone.com/reports/116764, vk.com/login.php , resolved 116773, https://hackerone.com/reports/116773, Type Confusion Vulnerability - SOAP / make_http_soap_request(), resolved 116774, https://hackerone.com/reports/116774, UDP port 5060 (SIP) Open, informative 116798, https://hackerone.com/reports/116798, Private Program Disclosure in /:handle/settings/allow_report_submission.json endpoint, resolved 116805, https://hackerone.com/reports/116805, SSL Issue on legalrobot.com, resolved 116927, https://hackerone.com/reports/116927, Spf , spam 116937, https://hackerone.com/reports/116937, Chat History CSV Export Excel Injection Vulnerability, resolved 116951, https://hackerone.com/reports/116951, Increase number of bugs by sending duplicate of your own valid report, resolved 116973, https://hackerone.com/reports/116973, No Valid SPF Records., resolved 117068, https://hackerone.com/reports/117068, XSS @ love.uber.com, resolved 117073, https://hackerone.com/reports/117073, [informatica.com] Blind SQL Injection, resolved 117097, https://hackerone.com/reports/117097, Email Forgery through Mandrillapp SPF, resolved 117142, https://hackerone.com/reports/117142, limit HTTP methods on other domains, resolved 117149, https://hackerone.com/reports/117149, SPF/DKIM/DMARC for grtp.co, resolved 117158, https://hackerone.com/reports/117158, SSRF на element.mail.ru, resolved 117159, https://hackerone.com/reports/117159, SPF/DKIM/DMARC for aspen.io, resolved 117168, https://hackerone.com/reports/117168, Stored XSS на street-combats.mail.ru, resolved 117187, https://hackerone.com/reports/117187, Prevent content spoofing on /~username/emails/verify.html, resolved 117195, https://hackerone.com/reports/117195, Login csrf., not-applicable 117325, https://hackerone.com/reports/117325, DMARC is misconfigured for grtp.co, resolved 117330, https://hackerone.com/reports/117330, stop serving grtp.co over HTTP, resolved 117385, https://hackerone.com/reports/117385, PHP and Web Server version disclosed on leasewebnoc.com, resolved 117449, https://hackerone.com/reports/117449, XSS in Draft Orders in Timeline i SHOPIFY Admin Site!, resolved 117458, https://hackerone.com/reports/117458, strengthen Diffie-Hellman (DH) key exchange parameters in grtp.co, resolved 117480, https://hackerone.com/reports/117480, Stored XSS via Angular Expression injection on developer.zendesk.com, resolved 117573, https://hackerone.com/reports/117573, Directory Listening, resolved 117593, https://hackerone.com/reports/117593, Apache version disclosed on developer.leaseweb.com, resolved 117651, https://hackerone.com/reports/117651, Multiple Heap Overflow due to integer overflows | xml/filter_url/addcslashes, resolved 117739, https://hackerone.com/reports/117739, limit number of images in statement, resolved 117818, https://hackerone.com/reports/117818, MISSING SPF RECORDS & MISSING DKIM POLICY, informative 117862, https://hackerone.com/reports/117862, Admin panel access restrictions bypass [poll.mail.ru/admin/], resolved 117902, https://hackerone.com/reports/117902, Дорк, resolved 118024, https://hackerone.com/reports/118024, Markdown based stored XSS (IE only), resolved 118033, https://hackerone.com/reports/118033, X-Content-Type Header Missing For aspen.io, informative 118103, https://hackerone.com/reports/118103, Injection via CSV Export feature in Admin Orders, resolved 118418, https://hackerone.com/reports/118418, Утечка информации через JSONP (XXSI), resolved 118582, https://hackerone.com/reports/118582, CSV Injection at the CSV export feature, resolved 118631, https://hackerone.com/reports/118631, XSSI (Cross Site Script Inclusion), resolved 118663, https://hackerone.com/reports/118663, Denial of Service any Report, resolved 118684, https://hackerone.com/reports/118684, Abusing HOF rankings in limited circumstances, informative 118688, https://hackerone.com/reports/118688, File name and folder enumeration., resolved 118718, https://hackerone.com/reports/118718, User with Read-Only permissions can manually public disclosure the report , resolved 118731, https://hackerone.com/reports/118731, User with Read-Only permissions can edit the SwagAwarded Activities on Bug Reports, resolved 118737, https://hackerone.com/reports/118737, Login CSRF using Google OAuth, resolved 118925, https://hackerone.com/reports/118925, API Key added for one Indices works for all other indices too., resolved 118948, https://hackerone.com/reports/118948, Password reset link is not Expiring, resolved 118950, https://hackerone.com/reports/118950, Stored XSS , resolved 118965, https://hackerone.com/reports/118965, Distinguish EP+Private vs Private programs in HackerOne, resolved 119022, https://hackerone.com/reports/119022, Tweet Deck XSS- Persistent- Group DM name, resolved 119033, https://hackerone.com/reports/119033, Sender policy framework (SPF) records evaluation return (Too many DNS lookups) error, resolved 119090, https://hackerone.com/reports/119090, Reflected XSS on Signup Page, resolved 119129, https://hackerone.com/reports/119129, Misconfiguration in 2 factor allows sensitive data expose, resolved 119148, https://hackerone.com/reports/119148, CSRF - Regenerate all admin api keys, resolved 119166, https://hackerone.com/reports/119166, Able to view others' gifts on /gift/share URL, giftId is predictable, and easy to manipulate, resolved 119220, https://hackerone.com/reports/119220, Sub-Domain Takeover, resolved 119221, https://hackerone.com/reports/119221, User with Read-Only permissions can edit the Internal comment Activities on Bug Reports After Revoke the team access permissions, resolved 119236, https://hackerone.com/reports/119236, Open Redirection on Uber.com, resolved 119250, https://hackerone.com/reports/119250, xss in the all widgets of shopifyapps.com, resolved 119262, https://hackerone.com/reports/119262, Authentication Data are not Clearing , resolved 119354, https://hackerone.com/reports/119354, Race Conditions Exist When Accepting Invitations, resolved 119427, https://hackerone.com/reports/119427, By pass admin panel [seminars.mail.ru], resolved 119432, https://hackerone.com/reports/119432, By pass admin panel [conference.mail.ru], resolved 119453, https://hackerone.com/reports/119453, www.veris.in DOM based XSS, resolved 119454, https://hackerone.com/reports/119454, Password(s) can be found via login process., resolved 119471, https://hackerone.com/reports/119471, DOMXSS in Tweetdeck, resolved 119494, https://hackerone.com/reports/119494, Full Path Disclosure In EasyDB, informative 119605, https://hackerone.com/reports/119605, An adversary can overwhelm the resources by automating Forgot password/Sign Up requests, not-applicable 119652, https://hackerone.com/reports/119652, Adobe Flash Player ASnative(101,10) Memory Corruption Vulnerability, resolved 119653, https://hackerone.com/reports/119653, Adobe Flash Player ASnative(900,1).call(MovieClip) Use-After-Free Vulnerability, resolved 119655, https://hackerone.com/reports/119655, Adobe Flash Player ASnative(900,1).call(TextField) Use-After-Free Vulnerability, resolved 119657, https://hackerone.com/reports/119657, Adobe Flash Player Race Condition Vulnerability, resolved 119666, https://hackerone.com/reports/119666, Server version is disclosure in http://leasewebnoc.com/, resolved 119794, https://hackerone.com/reports/119794, Password modification without knowing actual password & httpOnly bypass, informative 119808, https://hackerone.com/reports/119808, DROWN Attack, resolved 119828, https://hackerone.com/reports/119828, Found clickjacking vulnerability, resolved 119860, https://hackerone.com/reports/119860, HTTP Track/Trace Method Enabled, resolved 119871, https://hackerone.com/reports/119871, Unprotected Memcache Installation running, resolved 119918, https://hackerone.com/reports/119918, Public Facing Barracuda Login, resolved 119989, https://hackerone.com/reports/119989, b2i_PVK_bio heap corruption, resolved 120026, https://hackerone.com/reports/120026, don't serve hidden files from Nginx, resolved 120115, https://hackerone.com/reports/120115, Critical - Insecure Direct Object Reference - Deleting any member of any organization remotely, resolved 120121, https://hackerone.com/reports/120121, Critical IDOR - Delete any group of any organization remotely, resolved 120123, https://hackerone.com/reports/120123, Critical IDOR - Delete any venue of any organization remotely, resolved 120126, https://hackerone.com/reports/120126, Critical IDOR - Delete any rule of any organization remotely, resolved 120143, https://hackerone.com/reports/120143, Missing Server Side Validation of CSRF Middleware Token in Change Password Request, resolved 120216, https://hackerone.com/reports/120216, SSRF/XSPA [parapa.mail.ru], resolved 120219, https://hackerone.com/reports/120219, SSRF issue, resolved 120288, https://hackerone.com/reports/120288, Critical IDOR - Delete any terminal/gatekeeper of any organization remotely, resolved 120289, https://hackerone.com/reports/120289, Critical IDOR - Get anyone's Terminal Data remotely, resolved 120291, https://hackerone.com/reports/120291, Critical IDOR - Set anyone's Terminal Data remotely, resolved 120293, https://hackerone.com/reports/120293, Critical IDOR - Get Authentication Details of any Terminal/Gatekeeper, resolved 120298, https://hackerone.com/reports/120298, SSRF/XSPA [parapa.mail.ru] 2, resolved 120305, https://hackerone.com/reports/120305, Critical IDOR - Get venue data of any organization remotely, resolved 120312, https://hackerone.com/reports/120312, Critical IDOR - Can select any Parent while creating new Venue, resolved 120314, https://hackerone.com/reports/120314, Critical IDOR - Get Rules of any organization remotely, resolved 120318, https://hackerone.com/reports/120318, Critical IDOR - Make Rule for Any Group & Any Venue remotely, resolved 120324, https://hackerone.com/reports/120324, Multiple Stored XSS, resolved 120622, https://hackerone.com/reports/120622, Reflected Cross Site Script in imtportal.gm.com, duplicate 120656, https://hackerone.com/reports/120656, Reflected Cross Site Script in m.chevrolet.com.wpsegment5.gm.com, resolved 120683, https://hackerone.com/reports/120683, XSS Vulnerability in developer.gm.com, resolved 120941, https://hackerone.com/reports/120941, NexTable: Credentials exposure, resolved 121100, https://hackerone.com/reports/121100, Content Spoof in opel.es.wpsegment2.gm.com, resolved 121275, https://hackerone.com/reports/121275, Multiple Stored XSS on Sanbox.veris.in through Veris Frontdesk Android App, resolved 121382, https://hackerone.com/reports/121382, doc.owncloud.org has missing PHP handler, resolved 121417, https://hackerone.com/reports/121417, Inaccurate Payment receipt , informative 121461, https://hackerone.com/reports/121461, Subdomain takeover due to unclaimed Amazon S3 bucket on a2.bime.io, resolved 121469, https://hackerone.com/reports/121469, Broken Authentication on Badoo, resolved 121696, https://hackerone.com/reports/121696, Bypass two-factor authentication, resolved 121705, https://hackerone.com/reports/121705, Vulnerability : XSS Vulnerability , resolved 121827, https://hackerone.com/reports/121827, Account Takeover, resolved 121863, https://hackerone.com/reports/121863, Buffer overflow in HTTP url parsing functions, resolved 121903, https://hackerone.com/reports/121903, Additonal stored XSS in Add note/Expected payment Date, resolved 121919, https://hackerone.com/reports/121919, Private, embeddable videos leaks data through Facebook & Open Graph, resolved 121940, https://hackerone.com/reports/121940, Shell Injection via Web Management Console (dl-fw.cgi), resolved 121941, https://hackerone.com/reports/121941, Unauthenticated Cross-Site Scripting in Web Management Console, resolved 122054, https://hackerone.com/reports/122054, Open-redirect on login.xero.com , resolved 122254, https://hackerone.com/reports/122254, Adobe Flash Player TextField Use-After-Free Vulnerability, resolved 122256, https://hackerone.com/reports/122256, Adobe Flash Player Uninitialised Memory Corruption, resolved 122469, https://hackerone.com/reports/122469, stored xss issue in folder name on go.xero.com/Docs/Folders, resolved 122475, https://hackerone.com/reports/122475, Local file read in image editor, resolved 122697, https://hackerone.com/reports/122697, Server Side Browsing - localhost open port enumeration, resolved 122849, https://hackerone.com/reports/122849, Stored XSS in https://checkout.shopify.com/, resolved 122898, https://hackerone.com/reports/122898, Default.aspx exposing full path and other info on wip.origin-community.xero.com, resolved 122932, https://hackerone.com/reports/122932, bgplay.mail.ru, resolved 123005, https://hackerone.com/reports/123005, Persistent XSS on Reservation / Booking Page, resolved 123074, https://hackerone.com/reports/123074, https://rpm.newrelic.com/.htaccess file is world readable, resolved 123078, https://hackerone.com/reports/123078, https://rpm.newrelic.com/login vulnerable to host header attack, resolved 123089, https://hackerone.com/reports/123089, Vulnerable Link Leaks the User Names, resolved 123091, https://hackerone.com/reports/123091, No Rate Limitation on Promo Code, resolved 123092, https://hackerone.com/reports/123092, CSRF - Delete all empty application policy, resolved 123093, https://hackerone.com/reports/123093, Reflected XSS на games.mail.ru, resolved 123095, https://hackerone.com/reports/123095, CSRF- delete all empty server policy, resolved 123119, https://hackerone.com/reports/123119, Use after free with assign by ref to overloaded objects, resolved 123120, https://hackerone.com/reports/123120, Emails and alert policies can be altered by malicious users., resolved 123125, https://hackerone.com/reports/123125, XSS on hardware.shopify.com, resolved 123126, https://hackerone.com/reports/123126, newrelic.com vulnerable to clickjacking !, informative 123127, https://hackerone.com/reports/123127, no email confirmation on signup, informative 123170, https://hackerone.com/reports/123170, Email Address Leak, duplicate 123172, https://hackerone.com/reports/123172, Open redirection on login, resolved 123183, https://hackerone.com/reports/123183, All the active session should destroy when user change his password, informative 123194, https://hackerone.com/reports/123194, Server and PHP version Disclosed in Response Header, resolved 123278, https://hackerone.com/reports/123278, Possible XSS, informative 123380, https://hackerone.com/reports/123380, Creating multiple user with the same link which is sent to email after registeration, resolved 123384, https://hackerone.com/reports/123384, Обход basic авторизации [qpt.mail.ru], resolved 123420, https://hackerone.com/reports/123420, Mediation link can be accepted by other users, resolved 123435, https://hackerone.com/reports/123435, Normal user can set "Job title" of other users by Direct Object Reference, resolved 123496, https://hackerone.com/reports/123496, User enumeration via error message, resolved 123501, https://hackerone.com/reports/123501, Insecure Direct Member Disclosure, resolved 123513, https://hackerone.com/reports/123513, Host Header Injection / Cache Poisoning, duplicate 123518, https://hackerone.com/reports/123518, Security Vulnerability - SMTP protection not used, resolved 123572, https://hackerone.com/reports/123572, Unauthorized Team members viewing, informative 123615, https://hackerone.com/reports/123615, SECURITY: Referencing previous Reports attachment_IDs on new Reports via Draft_Sync DELETES Attachments, resolved 123625, https://hackerone.com/reports/123625, [marketplace.informatica.com] Open Redirect, resolved 123649, https://hackerone.com/reports/123649, Synthetics Xss, resolved 123660, https://hackerone.com/reports/123660, Possible SQL injection can cause denial of service attack, duplicate 123712, https://hackerone.com/reports/123712, Insecure Direct 'org-invite-log' References, resolved 123713, https://hackerone.com/reports/123713, Insecure Direct 'org-visitor-log' References, resolved 123731, https://hackerone.com/reports/123731, Complete or Edit Another User's Profile, resolved 123742, https://hackerone.com/reports/123742, suppress version in Server header on gratipay.com or grtp.co, resolved 123743, https://hackerone.com/reports/123743, Sending emails (via HackerOne) impersonating other users, resolved 123748, https://hackerone.com/reports/123748, Not Using Secure Flag Option on Cookies Could Lead to a Man in the Middle Session Highjacking, resolved 123782, https://hackerone.com/reports/123782, Vulnerable to clickjacking, informative 123849, https://hackerone.com/reports/123849, Cookie Does Not Contain The "secure" Attribute, resolved 123897, https://hackerone.com/reports/123897, auto-logout after 20 minutes, informative 123900, https://hackerone.com/reports/123900, csrf_token cookie don't have the flag "HttpOnly", informative 123902, https://hackerone.com/reports/123902, Complete Profile URL is not Random and not expiring , resolved 123905, https://hackerone.com/reports/123905, Stored XSS in Access Rules, resolved 123915, https://hackerone.com/reports/123915, Insecure transition from HTTP to HTTPS in form post, informative 124097, https://hackerone.com/reports/124097, Wordpress Pingback DDoS Attacks in domain: veris.in, resolved 124151, https://hackerone.com/reports/124151, Authentication Bypassing and Sensitive Information Disclosure on Verify Email Address in Registration Flow, resolved 124173, https://hackerone.com/reports/124173, Captcha Bypass enable login bruteforce, resolved 124223, https://hackerone.com/reports/124223, CSV Injection via the CSV export feature, resolved 124277, https://hackerone.com/reports/124277, XSS via React element spoofing, resolved 124429, https://hackerone.com/reports/124429, Stored XSS via "Free Shipping" option (Discounts), resolved 124564, https://hackerone.com/reports/124564, Missing rate limit on private videos password, resolved 124578, https://hackerone.com/reports/124578, Angular Expression Injection in the my.gmc.com Search Page, resolved 124611, https://hackerone.com/reports/124611, Disclosure of private programs that have an "external" page on HackerOne, resolved 124620, https://hackerone.com/reports/124620, External links should use rel="noopener" or use the redirect service, resolved 124724, https://hackerone.com/reports/124724, Stored XSS through Angular Expression Sandbox Escape, resolved 124737, https://hackerone.com/reports/124737, Multiple Heap Overflows in php_raw_url_encode/php_url_encode, resolved 124845, https://hackerone.com/reports/124845, Bypassed password authentication before enabling OTP verification, resolved 124929, https://hackerone.com/reports/124929, External programs revealing info, resolved 124975, https://hackerone.com/reports/124975, Cross-site Scripting (XSS) autocomplete generation in https://www.uber.com/, informative 124976, https://hackerone.com/reports/124976, Hijacking user session by forcing the use of invalid HTTPs Certificate on images.gratipay.com, resolved 125003, https://hackerone.com/reports/125003, Open Redirect in riders.uber.com, resolved 125027, https://hackerone.com/reports/125027, Reflected XSS on developer.uber.com via Angular template injection, resolved 125059, https://hackerone.com/reports/125059, Self-XSS Vulnerability on Password Reset Form, duplicate 125068, https://hackerone.com/reports/125068, LIsting of http://archive.uber.com/pypi/simple/, informative 125118, https://hackerone.com/reports/125118, Lack of CNAME/A Record Trimming Pointing Uber Domains to Insecure Non-Uber AWS Instances/Sites, resolved 125179, https://hackerone.com/reports/125179, XSS on love.uber.com, duplicate 125181, https://hackerone.com/reports/125181, SQLi in love.uber.com, resolved 125197, https://hackerone.com/reports/125197, Full path disclosure on track.uber.com, resolved 125218, https://hackerone.com/reports/125218, Bypassing Uber Partner's 3 Cancel Limit , resolved 125246, https://hackerone.com/reports/125246, Listing of email addresses of whitelisted business users visible at business.uber.com, resolved 125250, https://hackerone.com/reports/125250, Avoiding Surge Pricing, resolved 125397, https://hackerone.com/reports/125397, Null pointer deref (segfault) in stream_context_get_default, resolved 125400, https://hackerone.com/reports/125400, Too many included lookups, informative 125488, https://hackerone.com/reports/125488, Estimation of a Lower Bound on Number of Uber Drivers via Enumeration, resolved 125498, https://hackerone.com/reports/125498, Dom Based Xss, resolved 125503, https://hackerone.com/reports/125503, Stored Cross Site Scripting [SELF] in partners.uber.com, informative 125505, https://hackerone.com/reports/125505, Possibility to brute force invite codes in riders.uber.com, resolved 125587, https://hackerone.com/reports/125587, Hogging up all the resources on hackerone.com, resolved 125594, https://hackerone.com/reports/125594, CSRF on eng.uber.com may lead to server-side compromise, resolved 125624, https://hackerone.com/reports/125624, Brute Force Amplification Attack, informative 125634, https://hackerone.com/reports/125634, Session retention is present which reveals the customer info, duplicate 125707, https://hackerone.com/reports/125707, Possibility to enumerate and bruteforce promotion codes in Uber iOS App, resolved 125762, https://hackerone.com/reports/125762, Reflected XSS on Zomato API, resolved 125849, https://hackerone.com/reports/125849, XSS found on Snapchat website, resolved 125932, https://hackerone.com/reports/125932, SQL injection in Wordpress Plugin Huge IT Video Gallery at https://drive.uber.com/frmarketplace/, resolved 125980, https://hackerone.com/reports/125980, uber.com may RCE by Flask Jinja2 Template Injection, resolved 125984, https://hackerone.com/reports/125984, CRLF Injection in developer.uber.com, duplicate 126010, https://hackerone.com/reports/126010, prevent content spoofing on /~username/emails/verify.html, duplicate 126070, https://hackerone.com/reports/126070, Open redirect on rush.uber.com, business.uber.com, and help.uber.com, resolved 126099, https://hackerone.com/reports/126099, Stored XSS in drive.uber.com WordPress admin panel, resolved 126203, https://hackerone.com/reports/126203, CBC "cut and paste" attack may cause Open Redirect(even XSS), resolved 126235, https://hackerone.com/reports/126235, text injection in get.uber.com/check-otp, informative 126260, https://hackerone.com/reports/126260, Privilege escalation to allow non activated users to login and use uber partner ios app, not-applicable 126364, https://hackerone.com/reports/126364, Uber password reset link EMAIL FLOOD, duplicate 126374, https://hackerone.com/reports/126374, Uploading Plain Text to uber-documents.s3.amazonaws.com Through the Driver Document Upload Page, informative 126376, https://hackerone.com/reports/126376, Email leak in transcations in Android app, resolved 126377, https://hackerone.com/reports/126377, Changing Driver Passwords With Only an Authenticated Session (no password, no email), informative 126416, https://hackerone.com/reports/126416, Integer Overflow in php_raw_url_encode, resolved 126522, https://hackerone.com/reports/126522, Incorrect param parsing in Digits web authentication, resolved 126536, https://hackerone.com/reports/126536, SMS Flood with Update Profile , duplicate 126539, https://hackerone.com/reports/126539, XSS on https://app.shopify.com/, resolved 126569, https://hackerone.com/reports/126569, Disclosure of ip addresses in local network of uber, informative 126598, https://hackerone.com/reports/126598, Overreads/overcopies in torsocks, resolved 126652, https://hackerone.com/reports/126652, potential remote code execution with phar archive , resolved 126784, https://hackerone.com/reports/126784, Sending payments via QR code does not require confirmation, resolved 126797, https://hackerone.com/reports/126797, Use-after-free during XML transformations (MFSA-2016-27), informative 126826, https://hackerone.com/reports/126826, Pixel flood attack in https://riders.uber.com/profile, informative 126835, https://hackerone.com/reports/126835, It is possible to re-rate a driver after a very long time , informative 126861, https://hackerone.com/reports/126861, Insecure Direct Object Reference on badoo.com, informative 127025, https://hackerone.com/reports/127025, Brute Forcing rider-view Endpoint Allows for Counting Number of Active Uber Drivers, informative 127026, https://hackerone.com/reports/127026, User enumeration possible from log-in timing difference, resolved 127028, https://hackerone.com/reports/127028, Old CAPTCHA offers no protection, informative 127032, https://hackerone.com/reports/127032, CSV Injection in sub_accounts.csv, resolved 127085, https://hackerone.com/reports/127085, Use Partner/Driver App Without Being Activated, duplicate 127087, https://hackerone.com/reports/127087, Possible to View Driver Waybill via Driver UUID, resolved 127154, https://hackerone.com/reports/127154, XSS using javascript:alert(8007), resolved 127158, https://hackerone.com/reports/127158, Possibility to get private email using UUID, resolved 127161, https://hackerone.com/reports/127161, Information regarding trips from other users, resolved 127163, https://hackerone.com/reports/127163, XSS in https://www.coursera.org/courses/, resolved 127175, https://hackerone.com/reports/127175, HackerOne Important Emails Notification are sent in clear-text, resolved 127202, https://hackerone.com/reports/127202, Mobile Authentication Endpoint Credentials Brute-Force Vulnerability, resolved 127203, https://hackerone.com/reports/127203, rpm.newrelic.com - monitor creation to other accounts, resolved 127212, https://hackerone.com/reports/127212, php_snmp_error() Format String Vulnerability, resolved 127235, https://hackerone.com/reports/127235, New hacktivity view discloses report IDs of non-public reports, resolved 127242, https://hackerone.com/reports/127242, Negative size parameter (-1) in memcpy mbfl_strcut , resolved 127259, https://hackerone.com/reports/127259, Reflected XSS in owncloud.com, resolved 127645, https://hackerone.com/reports/127645, Session Impersonation in riders.uber.com, informative 127703, https://hackerone.com/reports/127703, [CRITICAL] Full account takeover using CSRF, resolved 127741, https://hackerone.com/reports/127741, Open redirection bypass, resolved 127766, https://hackerone.com/reports/127766, Password disclosure during signup process, resolved 127844, https://hackerone.com/reports/127844, Web Authentication Endpoint Credentials Brute-Force Vulnerability, resolved 127914, https://hackerone.com/reports/127914, Deleted name still present via mouseover functionality for user accounts, resolved 127918, https://hackerone.com/reports/127918, Easy spam with USE My PHONE Feature, resolved 127948, https://hackerone.com/reports/127948, Stored XSS on newsroom.uber.com admin panel / Stream WordPress plugin, resolved 127995, https://hackerone.com/reports/127995, Limit email address length, resolved 128035, https://hackerone.com/reports/128035, An adversary can harvest email address for spamming., informative 128041, https://hackerone.com/reports/128041, Getting Error Message and in use python version 2.7 is exposed., informative 128114, https://hackerone.com/reports/128114, Administrator access to a Django Administration Panel on *.sc-corp.net via bruteforced credentials, resolved 128121, https://hackerone.com/reports/128121, fix bug in username restriction, resolved 128493, https://hackerone.com/reports/128493, doc.owncloud.org: X-XSS-Protection not enabled, resolved 128645, https://hackerone.com/reports/128645, Clickjacking on authenticated pages which is inscope for New Relic, informative 128675, https://hackerone.com/reports/128675, Множественные уязвимости приложения Mail.Ru Почта (Android), duplicate 128685, https://hackerone.com/reports/128685, SSRF on testing endpoint, resolved 128723, https://hackerone.com/reports/128723, Enumerating userIDs with phone numbers, duplicate 128764, https://hackerone.com/reports/128764, text injection in website title, informative 128853, https://hackerone.com/reports/128853, Information disclosure at lite.uber.com, informative 128856, https://hackerone.com/reports/128856, Send email asynchronously, resolved 128895, https://hackerone.com/reports/128895, User credentials are not strong on vault.uber.com, duplicate 128910, https://hackerone.com/reports/128910, prevent %2f spoofed URLs in profile statement, informative 129002, https://hackerone.com/reports/129002, The PdfServlet-functionality used by the "Tee vakuutustodistus" allows injection of custom PDF-content via CSRF-attack, resolved 129027, https://hackerone.com/reports/129027, Disclosure of ways to the site root, informative 129091, https://hackerone.com/reports/129091, CPU utilization 99% on visiting wordpress site url & open redirect found, resolved 129138, https://hackerone.com/reports/129138, APT repository is signed using weak digest (SHA-1), resolved 129209, https://hackerone.com/reports/129209, After removing app from facebook app session not expiring., duplicate 129342, https://hackerone.com/reports/129342, Stored XSS in member book, resolved 129381, https://hackerone.com/reports/129381, niche s3 buckets are readable/writeable/deleteable by authorized AWS users, resolved 129436, https://hackerone.com/reports/129436, xss in DM group name in twitter, resolved 129551, https://hackerone.com/reports/129551, Cross site scripting in apps.owncloud.com, resolved 129582, https://hackerone.com/reports/129582, Reflected XSS POST method at partners.uber.com, resolved 129641, https://hackerone.com/reports/129641, UniFi Video Server - Arbitrary file upload as SYSTEM, resolved 129650, https://hackerone.com/reports/129650, Clickjacking: X-Frame-Options header missing, resolved 129698, https://hackerone.com/reports/129698, UniFi Video Server - Broken access control on system configuration, resolved 129712, https://hackerone.com/reports/129712, reopen #128853 (Information disclosure at lite.uber.com), not-applicable 129736, https://hackerone.com/reports/129736, Persistent XSS on public project page, resolved 129771, https://hackerone.com/reports/129771, Python 2.7 strop.replace Integer Overflow, resolved 129773, https://hackerone.com/reports/129773, Previous attachments can be referenced when creating a new report, resolved 129808, https://hackerone.com/reports/129808, No Rate Limiting while sending the feedback under Dropbox Help Centre, informative 129830, https://hackerone.com/reports/129830, Login Via FB Leads To Create A New Account Instead Of Loging In, resolved 129862, https://hackerone.com/reports/129862, Stored XSS on [your_zendesk].zendesk.com in Facebook Channel, resolved 129869, https://hackerone.com/reports/129869, beta version reveals paths, environment variables and partially files contents, resolved 129873, https://hackerone.com/reports/129873, Bypassing Digits origin validation which leads to account takeover, resolved 129918, https://hackerone.com/reports/129918, Authentication bypass leads to sensitive data exposure (token+secret), resolved 129942, https://hackerone.com/reports/129942, Insecure Payment System Integration, resolved 129992, https://hackerone.com/reports/129992, Missing Certificate Authority Authorization rule, resolved 130133, https://hackerone.com/reports/130133, Access to some Slack workspace metadata and settings available to unauthorized parties, resolved 130136, https://hackerone.com/reports/130136, developer.uber.com/404 and developer.uber.com/docs/404 are susceptible to iframes, informative 130338, https://hackerone.com/reports/130338, CSV Injection with the CSV export feature, resolved 130440, https://hackerone.com/reports/130440, Requested and received edit access to Google form, resolved 130453, https://hackerone.com/reports/130453, Badoo and Hotornot User Disclosure, not-applicable 130460, https://hackerone.com/reports/130460, BYASSING OTP Verification, resolved 130521, https://hackerone.com/reports/130521, Unsubscribe any user from receiving email, informative 130591, https://hackerone.com/reports/130591, Stored XSS thru SVG upload, resolved 130661, https://hackerone.com/reports/130661, XXE issue, resolved 130739, https://hackerone.com/reports/130739, Sensitive information contained with New Relic APM iOS application, resolved 130889, https://hackerone.com/reports/130889, Reflected XSS in scores.ubnt.com, resolved 130914, https://hackerone.com/reports/130914, Error page Text Injection., duplicate 130951, https://hackerone.com/reports/130951, doc.owncloud.org: XSS via Referrer, informative 131028, https://hackerone.com/reports/131028, Malicious File Upload, resolved 131038, https://hackerone.com/reports/131038, Stored XSS in Financial Account executing in Bank tab, resolved 131047, https://hackerone.com/reports/131047, Possible Blind SQL injection | Language choice in presentation, informative 131052, https://hackerone.com/reports/131052, XSS in uber oauth, informative 131053, https://hackerone.com/reports/131053, Submit a non valid syntax email, informative 131065, https://hackerone.com/reports/131065, bring grtp.co up to A grade on SSLLabs, resolved 131082, https://hackerone.com/reports/131082, Open Redirector via (apps/files_pdfviewer) for un-authenticated users., resolved 131108, https://hackerone.com/reports/131108, Akismet Several CSRF vulnerabilities, resolved 131123, https://hackerone.com/reports/131123, XSS via password recovering, informative 131192, https://hackerone.com/reports/131192, User's legal name could be changed despite front end controls being disabled, resolved 131202, https://hackerone.com/reports/131202, [Critical] - Steal OAuth Tokens, resolved 131397, https://hackerone.com/reports/131397, Reflected XSS on partners.cloudflare.com, resolved 131450, https://hackerone.com/reports/131450, Stored XSS in developer.uber.com, resolved 131452, https://hackerone.com/reports/131452, PHP 5.4.45 is Outdated and Full of Preformance Interupting Arbitrary Code Execution Bugs, not-applicable 131468, https://hackerone.com/reports/131468, AWS S3 bucket writable for authenticated aws user, resolved 131523, https://hackerone.com/reports/131523, AWS S3 bucket writable for authenticated aws user, resolved 131552, https://hackerone.com/reports/131552, Login Open Redirect, resolved 131560, https://hackerone.com/reports/131560, CrashPlan Backup is Vulnerable Allowing to a DoS Attack Against Uber's Backups to ```backup.uber.com```, duplicate 131722, https://hackerone.com/reports/131722, Missing SPF for hackerone.com, duplicate 131728, https://hackerone.com/reports/131728, Open Redirect vulnerability in moneybird.com, resolved 132049, https://hackerone.com/reports/132049, [HIGH RISK] CSRF could potentially delete a zendesk subdomain., resolved 132104, https://hackerone.com/reports/132104, Stored XSS on team.slack.com using new Markdown editor of posts inside the Editing mode and using javascript-URIs, resolved 132251, https://hackerone.com/reports/132251, Open redirection , resolved 132602, https://hackerone.com/reports/132602, Stored XSS at Udemy, resolved 132658, https://hackerone.com/reports/132658, Stored Cross-Site Scripting via Angular Template Injection, resolved 132777, https://hackerone.com/reports/132777, Labels created in private projects are leaked, resolved 132835, https://hackerone.com/reports/132835, Cache-Control Misconfiguration Leads to Sensitive Information Leakage, resolved 133360, https://hackerone.com/reports/133360, No DMARC Record in legalrobot-uat.com, not-applicable 133375, https://hackerone.com/reports/133375, Information Disclosure on lite.uber.com, informative 133680, https://hackerone.com/reports/133680, AWS S3 Bucket hotornot-images permissions allow for listing and removing files, not-applicable 133717, https://hackerone.com/reports/133717, GFM renderer leaks external issue tracker URL of private project, resolved 133744, https://hackerone.com/reports/133744, XSS in Asset name, resolved 133753, https://hackerone.com/reports/133753, Content Spoofing In Moneybird, resolved 133847, https://hackerone.com/reports/133847, ProBlog 2.6.6 CSRF Exploit, resolved 133963, https://hackerone.com/reports/133963, XSS on www.wordpress.com, resolved 134004, https://hackerone.com/reports/134004, Reflected XSS and something more Store XSS too, resolved 134032, https://hackerone.com/reports/134032, newrelic.com rails directory traversal vuln, resolved 134061, https://hackerone.com/reports/134061, Reflected XSS via Livefyre Media Wall in newsroom.uber.com, resolved 134124, https://hackerone.com/reports/134124, Stored self-XSS at m.uber.com, resolved 134145, https://hackerone.com/reports/134145, SSL Certificate on qiwi.com will expire soon., informative 134206, https://hackerone.com/reports/134206, Defect-Security | Driver-Broken Authentication | Able to update the Subscription Setting anonymously, informative 134216, https://hackerone.com/reports/134216, doc.owncloud.com: PHP info page disclosure , resolved 134292, https://hackerone.com/reports/134292, Attacker can delete (and read) private project webhooks, resolved 134299, https://hackerone.com/reports/134299, Attacker can post notes on private MR, snippets, and issues, resolved 134300, https://hackerone.com/reports/134300, Confidential issues leaked in public projects when attached to milestone, resolved 134305, https://hackerone.com/reports/134305, Private snippets in public / internal projects leaked though GitLab API, resolved 134321, https://hackerone.com/reports/134321, RCE on facebooksearch.algolia.com, resolved 134406, https://hackerone.com/reports/134406, Source Code Disclosure on out of scope domain viestinta.lahitapiola.fi, informative 134434, https://hackerone.com/reports/134434, XSS In /zuora/ functionality, resolved 134521, https://hackerone.com/reports/134521, Uber for Business Allows Administrators to Change Uber Driver Ratings Due to Failure to Authenticate `fast-rating` Endpoint , informative 134546, https://hackerone.com/reports/134546, WordPress Flash XSS in *flashmediaelement.swf*, resolved 134738, https://hackerone.com/reports/134738, WordPress SOME bug in plupload.flash.swf leading to RCE, resolved 134757, https://hackerone.com/reports/134757, staff memeber can install apps even if have limitied access , resolved 134760, https://hackerone.com/reports/134760, SSL/TLS BEAST ATTACK VULNERABILITY , resolved 134878, https://hackerone.com/reports/134878, XSS с помощью специально сформированного файла., resolved 134894, https://hackerone.com/reports/134894, The Anti-CSRF Library fails to restrict token to a particular IP address when being behind a reverse-proxy/WAF, informative 135027, https://hackerone.com/reports/135027, Potential double free in EVP_DigestInit_ex, resolved 135072, https://hackerone.com/reports/135072, RCE in profile picture upload, resolved 135152, https://hackerone.com/reports/135152, Integer overflow in ZipArchive::getFrom*, resolved 135154, https://hackerone.com/reports/135154, Blind Stored XSS Against Lahitapiola Employees - Session and Information leakage, resolved 135192, https://hackerone.com/reports/135192, HTTP status code manipluation & java stack trace , resolved 135252, https://hackerone.com/reports/135252, Possibly big authorization problem in Lähitapiola´s varainhoito, resolved 135283, https://hackerone.com/reports/135283, Email Authentication Bypass, not-applicable 135288, https://hackerone.com/reports/135288, Multiple vulnerabilities in a WordPress plugin at drive.uber.com, resolved 135291, https://hackerone.com/reports/135291, Out-of-bounds reads in zif_grapheme_stripos with negative offset, resolved 135293, https://hackerone.com/reports/135293, bcpowmod accepts negative scale and corrupts _one_ definition, resolved 135294, https://hackerone.com/reports/135294, xml_parse_into_struct segmentation fault, resolved 135316, https://hackerone.com/reports/135316, Cross-Site Scripting Vulnerability in dovecot.fi, not-applicable 135620, https://hackerone.com/reports/135620, Showing Up Source Code, informative 135756, https://hackerone.com/reports/135756, View all deleted comments and rating of any app ., resolved 135782, https://hackerone.com/reports/135782, information disclose , resolved 135797, https://hackerone.com/reports/135797, Session Fixation, resolved 135891, https://hackerone.com/reports/135891, Missing authentication on Notification setting ., informative 135937, https://hackerone.com/reports/135937, SSRF when importing a project from a git repo by URL, resolved 135989, https://hackerone.com/reports/135989, Employees with Any Permissions Can Create App with Full Permissions and Perform any API Action, resolved 136169, https://hackerone.com/reports/136169, OneLogin authentication bypass on WordPress sites, resolved 136333, https://hackerone.com/reports/136333, Persistent XSS on public wiki pages, resolved 136396, https://hackerone.com/reports/136396, STORED XSS FOUND, resolved 136454, https://hackerone.com/reports/136454, User credentials leak and arbitrary local file read/leak due to same-origin-policy violation, resolved 136481, https://hackerone.com/reports/136481, CSRF on Vimeo via cross site flashing leading to info disclosure and private videos go public, resolved 136531, https://hackerone.com/reports/136531, Compromising Atlassian Confluence (team.uberinternal.com) via WordPress (newsroom.uber.com), resolved 136582, https://hackerone.com/reports/136582, OAuth 2 Authorization Bypass via CSRF and Cross Site Flashing, resolved 136600, https://hackerone.com/reports/136600, Reflected XSS in Backend search, resolved 136720, https://hackerone.com/reports/136720, don't leak server version of grtp.co in error pages, resolved 136850, https://hackerone.com/reports/136850, Images and Subtitles Leakage from private videos, resolved 136885, https://hackerone.com/reports/136885, [CRITICAL] -- Complete Account Takeover, resolved 136891, https://hackerone.com/reports/136891, Source code disclosure on https://107.23.69.180, resolved 137008, https://hackerone.com/reports/137008, Csrf on creating course, informative 137023, https://hackerone.com/reports/137023, XSS in Subtitles of Vimeo Flash Player and Hubnut , duplicate 137093, https://hackerone.com/reports/137093, AXFR на plexus.m.smailru.net работает, resolved 137119, https://hackerone.com/reports/137119, [XSS] sandbox.veris.in, resolved 137126, https://hackerone.com/reports/137126, Xss in m.ok.ru, resolved 137127, https://hackerone.com/reports/137127, [Stored XSS] sandbox.veris.in , resolved 137152, https://hackerone.com/reports/137152, Clickjacking in love.uber.com, informative 137181, https://hackerone.com/reports/137181, Host Header Poisoning in thisdata.com, resolved 137229, https://hackerone.com/reports/137229, Dropbox apps Server side request forgery, informative 137230, https://hackerone.com/reports/137230, nginx server vulnerable, resolved 137404, https://hackerone.com/reports/137404, List of a ton of internal twitter servers available on GitHub, informative 137480, https://hackerone.com/reports/137480, New Relic - Session Hijacking, informative 137502, https://hackerone.com/reports/137502, All Vimeo Private videos disclosure via Authorization Bypass, resolved 137503, https://hackerone.com/reports/137503, Inadequate access controls in "Vote" functionality???, resolved 137631, https://hackerone.com/reports/137631, SMTP command injection, resolved 137723, https://hackerone.com/reports/137723, vulnerabilitie, not-applicable 137756, https://hackerone.com/reports/137756, Cache poisoning for okhttp , informative 137845, https://hackerone.com/reports/137845, Stored XSS on 'Badges' page, resolved 137850, https://hackerone.com/reports/137850, CSV Macro injection in Video Manager (CEMI), resolved 137905, https://hackerone.com/reports/137905, Reflected XSS on business-blog.zomato.com - Part I, resolved 137906, https://hackerone.com/reports/137906, Reflected XSS on business-blog.zomato.com - Part 2, resolved 137938, https://hackerone.com/reports/137938, Reflected XSS in domain www.veris.in, resolved 137954, https://hackerone.com/reports/137954, [IDOR] post to anyone even if their stream is restricted to friends only, resolved 137956, https://hackerone.com/reports/137956, SQL Injection, resolved 137964, https://hackerone.com/reports/137964, Wordpress flashmediaelement.swf XSS on stopthehacker.com , resolved 138025, https://hackerone.com/reports/138025, Heap corruption via memarea.c, resolved 138045, https://hackerone.com/reports/138045, XSS ReflectedGET /*embed_player*?, resolved 138046, https://hackerone.com/reports/138046, XSS Reflected incategories*p, resolved 138101, https://hackerone.com/reports/138101, Weak user aunthentication on mobile application - I just broken userKey secret password, resolved 138226, https://hackerone.com/reports/138226, Same-Origin Method Execution bug in plupload.flash.swf on /insights, resolved 138244, https://hackerone.com/reports/138244, Missing access control exposing detailed information on all users, resolved 138262, https://hackerone.com/reports/138262, Reflected Cross-Site Scripting in www.zomato.com/php/instagram_tag_relay, resolved 138270, https://hackerone.com/reports/138270, Instagram OAuth2 Implementation Leaks Access Token; Allows for Cross-Site Script Inclusion (XSSI), resolved 138315, https://hackerone.com/reports/138315, Abusing and Hacking the SMTP Server secure.lahitapiola.fi, resolved 138319, https://hackerone.com/reports/138319, [xss, pornhub.com] /, multiple parameters, resolved 138332, https://hackerone.com/reports/138332, [torg.mail.ru] CRLF Injection, resolved 138516, https://hackerone.com/reports/138516, Adobe Flash Player ContentFactory class Memory Corruption Vulnerability, resolved 138517, https://hackerone.com/reports/138517, Adobe Flash Player Metadata class Memory Corruption Vulnerability, resolved 138518, https://hackerone.com/reports/138518, Adobe Flash Player OpportunityGenerator class Memory Corruption Vulnerability, resolved 138558, https://hackerone.com/reports/138558, DIrectory Listing Found, not-applicable 138622, https://hackerone.com/reports/138622, Self-XSS on partners.uber.com, informative 138659, https://hackerone.com/reports/138659, don't expose path of Python , informative 138703, https://hackerone.com/reports/138703, View storyboard of private video @ ht.pornhub.com, resolved 138721, https://hackerone.com/reports/138721, SSRF & XSS (W3 Total Cache), resolved 138786, https://hackerone.com/reports/138786, Text injection can be used in phishing 404 page and should not include attacker text, resolved 138824, https://hackerone.com/reports/138824, Remote Code Execution in NovaStor NovaBACKUP DataCenter backup software (Hiback), resolved 138852, https://hackerone.com/reports/138852, [idor] Profile Admin can pin any other user's post on his stream wall, resolved 138863, https://hackerone.com/reports/138863, Missing rate limit on password, resolved 138869, https://hackerone.com/reports/138869, OneLogin authentication bypass on WordPress sites via XMLRPC, resolved 138881, https://hackerone.com/reports/138881, Phone Number Enumeration, informative 139099, https://hackerone.com/reports/139099, Lack of account link warning enables dropbox hijacking, resolved 139178, https://hackerone.com/reports/139178, Improper Session Management, resolved 139245, https://hackerone.com/reports/139245, WordPress core stored XSS via attachment file name, resolved 139319, https://hackerone.com/reports/139319, Missing proper error message., informative 139321, https://hackerone.com/reports/139321, Unsafe Query Generation (CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155) mitigation bypass, resolved 139402, https://hackerone.com/reports/139402, [kb.informatica.com] Unauthenticated emails and HTML injection in email messages, resolved 139502, https://hackerone.com/reports/139502, Privilege Escalation In Moniter, resolved 139547, https://hackerone.com/reports/139547, Apache version disclosure, not-applicable 139591, https://hackerone.com/reports/139591, Outdated Apache Server in www.dovecot.fi is vulnerable to various attack., informative 139626, https://hackerone.com/reports/139626, Passphrase credential lock bypass, resolved 139875, https://hackerone.com/reports/139875, DOM based XSS on, informative 139879, https://hackerone.com/reports/139879, Adobe Flash Player Regular Expression UAF Remote Code Execution Vulnerability, resolved 139940, https://hackerone.com/reports/139940, Exploiting Secure Shell (SSH) on mobilelt.lahitapiola.fi, resolved 139965, https://hackerone.com/reports/139965, No authentication required to add an email address., informative 139970, https://hackerone.com/reports/139970, JIRA account misconfig causes internal info leak, resolved 139981, https://hackerone.com/reports/139981, XSS onmouseover , resolved 140275, https://hackerone.com/reports/140275, No CSRF validation on Account Monitors in Synthetics Block, resolved 140333, https://hackerone.com/reports/140333, Session takeover, informative 140377, https://hackerone.com/reports/140377, don't store CSRF tokens in cookies, informative 140392, https://hackerone.com/reports/140392, CJ vulnerability in subdomain, resolved 140432, https://hackerone.com/reports/140432, configure a redirect URI for Facebook OAuth, resolved 140548, https://hackerone.com/reports/140548, [upload-X.my.mail.ru] /uploadphoto Insecure Direct Object References, resolved 140616, https://hackerone.com/reports/140616, www.starbucks.co.uk Reflected XSS via utm_source parameter, resolved 140705, https://hackerone.com/reports/140705, [my.mail.ru] HTML injection в письмах от myadmin@corp.mail.ru, resolved 140720, https://hackerone.com/reports/140720, Denial of service in report view., informative 140742, https://hackerone.com/reports/140742, Cookie not secure, not-applicable 140791, https://hackerone.com/reports/140791, XSS in people.uber.com, duplicate 140793, https://hackerone.com/reports/140793, UniFi Video v3.2.2 (Windows) Local Privileges Escalation due to weak default install directory ACLs, resolved 140865, https://hackerone.com/reports/140865, Integer Overflow in php_html_entities(), resolved 140899, https://hackerone.com/reports/140899, [tidaltrek.mail.ru] SQL Injection, resolved 141065, https://hackerone.com/reports/141065, Security Issue : CSRF Token Design Flaw, resolved 141090, https://hackerone.com/reports/141090, Parameter Manipulation allowed for viewing of other user’s teavana.com orders, resolved 141114, https://hackerone.com/reports/141114, Stored XSS in Filters, resolved 141115, https://hackerone.com/reports/141115, SSL/TLS BEAST ATTACK, informative 141120, https://hackerone.com/reports/141120, Parameter Manipulation allowed for editing the shipping address for other user’s teavana.com subscriptions., resolved 141125, https://hackerone.com/reports/141125, Ngnix Server version disclosure, resolved 141174, https://hackerone.com/reports/141174, node.drchrono.com - Information Disclosure and Windows Host Exposed, resolved 141197, https://hackerone.com/reports/141197, get_icu_value_internal out-of-bounds read, resolved 141198, https://hackerone.com/reports/141198, Template stored XSS, resolved 141202, https://hackerone.com/reports/141202, imagescale out-of-bounds read, resolved 141212, https://hackerone.com/reports/141212, Integer underflow / arbitrary null write in fread/gzread, resolved 141239, https://hackerone.com/reports/141239, Module ngx_http_auth_basic_module is broken and allowing all password after specific length, not-applicable 141240, https://hackerone.com/reports/141240, Angular injection in the profile name of onpatient, resolved 141244, https://hackerone.com/reports/141244, XSS in zendesk.com/product/, resolved 141329, https://hackerone.com/reports/141329, Code source discloure & ability to get database information "SQL injection" in [townwars.mail.ru], resolved 141339, https://hackerone.com/reports/141339, Uber is Flooding my Mobile with SMS Daily like a cron JOB, not-applicable 141344, https://hackerone.com/reports/141344, [CRITICAL] CSRF leading to account take over , resolved 141355, https://hackerone.com/reports/141355, Open Redirect in unifi.ubnt.com [Controller Finder], resolved 141463, https://hackerone.com/reports/141463, Stored XSS via AngularJS Injection, resolved 141493, https://hackerone.com/reports/141493, Reflected XSS by way of jQuery function, resolved 141541, https://hackerone.com/reports/141541, User with no permissions can access full wdcalendar feed, resolved 141629, https://hackerone.com/reports/141629, Able to remove the admin access of my program, resolved 141676, https://hackerone.com/reports/141676, Bime Unable to load Data Sources, not-applicable 141682, https://hackerone.com/reports/141682, SSRF on synthetics.newrelic.com permitting access to sensitive data, resolved 141700, https://hackerone.com/reports/141700, Bypass GlassWire's monitoring of Hosts file, resolved 141728, https://hackerone.com/reports/141728, XSS in Blog , duplicate 141734, https://hackerone.com/reports/141734, Bypassing Password Reset , resolved 141839, https://hackerone.com/reports/141839, Multiple vulnerabilities related to PCRE functions (already fixed), resolved 141868, https://hackerone.com/reports/141868, Private Photo Disclosure - /user/stream_photo_attach?load=album&id= endpoint, resolved 141956, https://hackerone.com/reports/141956, [phpobject in cookie] Remote shell/command execution, resolved 142078, https://hackerone.com/reports/142078, IE search XSS, resolved 142084, https://hackerone.com/reports/142084, Stored XSS in unifi.ubnt.com, resolved 142096, https://hackerone.com/reports/142096, [Screenhero] Subdomain takeover, resolved 142101, https://hackerone.com/reports/142101, User with no permissions can create, edit, delete favorite prescriptions /erx/, resolved 142135, https://hackerone.com/reports/142135, XSS в upload.php, resolved 142221, https://hackerone.com/reports/142221, Bypass OTP verification when placing Order, resolved 142352, https://hackerone.com/reports/142352, (Pornhub & Youporn & Brazzers ANDROID APP) : Upload Malicious APK / Overrite Existing APK / Android BackOffice Access , resolved 142479, https://hackerone.com/reports/142479, [tidaltrek.mail.ru] SQL Injection, resolved 142540, https://hackerone.com/reports/142540, Cross-Site Scripting Stored On Rich Media, resolved 142549, https://hackerone.com/reports/142549, Information Disclosure through .DS_Store in ██████████, resolved 142562, https://hackerone.com/reports/142562, [RCE] Unserialize to XXE - file disclosure on ams.upload.pornhub.com, resolved 142569, https://hackerone.com/reports/142569, Infinite Upvoting/Downvoting: Lockout Bypass, Plus: Exposed API Documentation, resolved 142609, https://hackerone.com/reports/142609, DOM XSS bypassing in Regional Office -selector, resolved 142773, https://hackerone.com/reports/142773, 16 instances where return value of OpenSSL i2d_RSAPublicKey is discarded -- might lead to use of uninitialized memory, resolved 142893, https://hackerone.com/reports/142893, [STORED XSS] in debtor reports of ,,invoices'', resolved 142940, https://hackerone.com/reports/142940, Bug Report , resolved 142946, https://hackerone.com/reports/142946, xss vulnerability in http://ubermovement.com/community/daniel, resolved 143022, https://hackerone.com/reports/143022, Heap corruption via Python 2.7.11 IOBase readline(), resolved 143064, https://hackerone.com/reports/143064, Information Disclosure, resolved 143076, https://hackerone.com/reports/143076, Header Injection , informative 143139, https://hackerone.com/reports/143139, upgrade Aspen on inside.gratipay.com to pick up CR injection fix, resolved 143220, https://hackerone.com/reports/143220, XSS on www.mapbox.com/authorize, resolved 143234, https://hackerone.com/reports/143234, Integer Overflow in _gd2GetHeader() resulting in heap overflow, resolved 143240, https://hackerone.com/reports/143240, XSS on www.mapbox.com/authorize/ because of open redirect at /core/oauth/auth, resolved 143265, https://hackerone.com/reports/143265, Unvalidated redirect on user profile website, informative 143280, https://hackerone.com/reports/143280, Mail.ru for Android Content Provider Vulnerability, resolved 143291, https://hackerone.com/reports/143291, Password Reset Does Not Confirm the Existence of an Email Address, informative 143294, https://hackerone.com/reports/143294, XSS on zomato.com, resolved 143321, https://hackerone.com/reports/143321, Unauthenticated CSRF(User can input any value for CSRF Token), informative 143323, https://hackerone.com/reports/143323, [uk.informatica.com] XSS on uk.informatica..com, resolved 143438, https://hackerone.com/reports/143438, Potentially Sensitive Information on GitHub, resolved 143482, https://hackerone.com/reports/143482, Authentication Bypass on Icinga monitoring server, resolved 143541, https://hackerone.com/reports/143541, Transaction Pending Via Ip Change , informative 143575, https://hackerone.com/reports/143575, Full path disclosure, informative 143669, https://hackerone.com/reports/143669, Получение оригинала скрытого изображения, resolved 143672, https://hackerone.com/reports/143672, Email Enumeration Vulnerability, informative 143717, https://hackerone.com/reports/143717, Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical), resolved 143903, https://hackerone.com/reports/143903, File upload over private IM channel, resolved 143935, https://hackerone.com/reports/143935, [sms-be-vip.twitter.com] vulnerable to Jetleak, resolved 143966, https://hackerone.com/reports/143966, Insufficient shell characters filtering leads to (potentially remote) code execution (CVE-2016-3714), resolved 143975, https://hackerone.com/reports/143975, Homograph attack in escalate report, resolved 144000, https://hackerone.com/reports/144000, Authorization Bypass in Delivery Chat Logs, resolved 144084, https://hackerone.com/reports/144084, Content spoofing due to the improper behavior of the not-found message , resolved 144104, https://hackerone.com/reports/144104, Text injection on error page., informative 144129, https://hackerone.com/reports/144129, Old titles are not hidden in reports with limited disclosure, resolved 144147, https://hackerone.com/reports/144147, Newsroom.uber HTML form without CSRF protection, informative 144359, https://hackerone.com/reports/144359, Time Based SQL injection in url parameter, informative 144385, https://hackerone.com/reports/144385, SMTP server allows anonymous relay from internal addresses to internal addresses, duplicate 144482, https://hackerone.com/reports/144482, StringIO strio_getline() can divulge arbitrary memory, resolved 144484, https://hackerone.com/reports/144484, Heap corruption in DateTime.strftime() on 32 bit for certain format strings, informative 144485, https://hackerone.com/reports/144485, Heap corruption in string.c tr_trans() due to undersized buffer, informative 144525, https://hackerone.com/reports/144525, Open redirection bypass ., resolved 144526, https://hackerone.com/reports/144526, EXTREMELY URGENT: Missing control of bitcoin amount when selling bitcoin allows a user to withdraw any amount of money, unrestricted., resolved 144674, https://hackerone.com/reports/144674, [townwars.mail.ru] Time-Based SQL Injection, resolved 144782, https://hackerone.com/reports/144782, CVE-2016-0772 - python: smtplib StartTLS stripping attack, resolved 144803, https://hackerone.com/reports/144803, Email Address Enumeration, informative 145086, https://hackerone.com/reports/145086, Stored XSS in SupportFlow Ticket Subject, resolved 145091, https://hackerone.com/reports/145091, Stored XSS from ticket messages in admin table in SupportFlow, resolved 145128, https://hackerone.com/reports/145128, [account-global.ubnt.com] CRLF Injection, resolved 145150, https://hackerone.com/reports/145150, Bulk UUID enumeration via invite codes, resolved 145206, https://hackerone.com/reports/145206, set Pragma header, not-applicable 145207, https://hackerone.com/reports/145207, set Expires header, not-applicable 145224, https://hackerone.com/reports/145224, Subdomain takeover on partners.ubnt.com due to non-used CloudFront DNS entry, resolved 145246, https://hackerone.com/reports/145246, Stored Cross site scripting, duplicate 145260, https://hackerone.com/reports/145260, Full path disclosure vulnerability on paragonie.com, informative 145265, https://hackerone.com/reports/145265, Adobe Flash Player ShimContentFactory class Memory Corruption Vulnerability, resolved 145266, https://hackerone.com/reports/145266, Adobe Flash Player ShimContentFactory.retrieveResolvers Memory Corruption Vulnerability, resolved 145267, https://hackerone.com/reports/145267, Adobe Flash Player ShimContentResolver.configure Memory Corruption Vulnerability, resolved 145269, https://hackerone.com/reports/145269, Adobe Flash Player ShimOpportunityGenerator class Memory Corruption Vulnerability, resolved 145271, https://hackerone.com/reports/145271, Adobe Flash Player ShimContentResolver(resolverType=0) class Memory Corruption Vulnerability, resolved 145272, https://hackerone.com/reports/145272, Adobe Flash Player ShimContentResolver(resolverType=1) class Memory Corruption Vulnerability, resolved 145278, https://hackerone.com/reports/145278, xss in https://www.uber.com, resolved 145289, https://hackerone.com/reports/145289, Self-XSS in Partners Profile, duplicate 145300, https://hackerone.com/reports/145300, Session Management, not-applicable 145306, https://hackerone.com/reports/145306, Registeration Link "Jacking&Redirecting", resolved 145343, https://hackerone.com/reports/145343, Possible RCE, informative 145344, https://hackerone.com/reports/145344, nextcloud.com: Content Injection Custom 404 Error, resolved 145374, https://hackerone.com/reports/145374, Content Spoofing, resolved 145375, https://hackerone.com/reports/145375, stats.nextcloud.com: Content Injection, resolved 145392, https://hackerone.com/reports/145392, Response Header injection using redirect_uri together with PHP that utilizes Header Folding according to RFC1945 and Internet Explorer 11, resolved 145396, https://hackerone.com/reports/145396, Enumeration of subscribed users and unauthenticated email unsubscriptions on https://newsletter.nextcloud.com/?p=unsubscribe, resolved 145402, https://hackerone.com/reports/145402, No permission set on Activities [Android App], informative 145409, https://hackerone.com/reports/145409, help.nextcloud.com: Known DoS condition (null pointer deref) in Nginx running, resolved 145430, https://hackerone.com/reports/145430, help.nextcloud.com: Session Management Issue, informative 145452, https://hackerone.com/reports/145452, Share owner has no possibility to list all existing derived shares, resolved 145458, https://hackerone.com/reports/145458, nextcloud.com: Mail Bombing ( No Rate Limiting On Sending Emails On Contact us Page), resolved 145462, https://hackerone.com/reports/145462, No rate limiting on password protected shared file link, duplicate 145467, https://hackerone.com/reports/145467, Downloading password protected / restricted videos, resolved 145488, https://hackerone.com/reports/145488, failure to invalidate session on password change, informative 145495, https://hackerone.com/reports/145495, nextcloud.com: Directory listening for 'wp-includes' forders, resolved 145517, https://hackerone.com/reports/145517, Vulnerable Javascript library, informative 145524, https://hackerone.com/reports/145524, Server side request forgery (SSRF) on nextcloud implementation., informative 145552, https://hackerone.com/reports/145552, Directory Listing On download.nextcloud.com & Practical Attacks on PGP (Pretty Good Privacy) , informative 145583, https://hackerone.com/reports/145583, Lost Password CSRF, informative 145603, https://hackerone.com/reports/145603, https://newsletter.nextcloud.com Directory listening and Information Disclosure, resolved 145604, https://hackerone.com/reports/145604, Avatar image upload and bypass real image verification , informative 145612, https://hackerone.com/reports/145612, No captcha on newsletter.nextcloudcom leaves vulnerable to email spammers, resolved 145621, https://hackerone.com/reports/145621, Unauthenticated Access to some old file thumbnails , informative 145686, https://hackerone.com/reports/145686, CSS, informative 145722, https://hackerone.com/reports/145722, Bruteforce attack is possible on newsletter.nextcloud.com, informative 145727, https://hackerone.com/reports/145727, Bruteforcing help.nextcloud.com, informative 145730, https://hackerone.com/reports/145730, newsletter.nextcloud.com: Bypass firewall protection, resolved 145734, https://hackerone.com/reports/145734, help.nextcloud Email Address/Username enumeration, informative 145745, https://hackerone.com/reports/145745, Business/Functional logic bypass: Remove admins from admin group., informative 145849, https://hackerone.com/reports/145849, Content Injection 404 page, resolved 145850, https://hackerone.com/reports/145850, Content Spoofing/Text Injection - docs.nextcloud.org, resolved 145853, https://hackerone.com/reports/145853, Content injection in subdomain, resolved 145854, https://hackerone.com/reports/145854, Content Injection in subdomain, resolved 145893, https://hackerone.com/reports/145893, Error Message on 404 page, informative 145896, https://hackerone.com/reports/145896, Password reset link remains valid after email change, resolved 146067, https://hackerone.com/reports/146067, Read-only share recipient can restore old versions of file, resolved 146093, https://hackerone.com/reports/146093, WordPress Vulnerabilities: User Enumeration, Vulnerable Akismet Plugin, XML-RPC Interface available, informative 146106, https://hackerone.com/reports/146106, Email ID Disclosure., informative 146129, https://hackerone.com/reports/146129, Authentication Bypass in Updating Personal Information, informative 146133, https://hackerone.com/reports/146133, Authentication Issue, resolved 146179, https://hackerone.com/reports/146179, REG: Content provider information leakage, informative 146180, https://hackerone.com/reports/146180, Integer Overflow in SplFileObject::fread, resolved 146182, https://hackerone.com/reports/146182, Integer Overflow/Heap Overflow in json_encode()/json_decode(), resolved 146183, https://hackerone.com/reports/146183, Integer Overflow in nl2br(), resolved 146184, https://hackerone.com/reports/146184, Integer Overflow in addcslashes()/addslashes(), resolved 146185, https://hackerone.com/reports/146185, Integer Overflow in Length of String-typed ZVAL, resolved 146200, https://hackerone.com/reports/146200, _php_mb_regex_ereg_replace_exec - double free, resolved 146202, https://hackerone.com/reports/146202, Invalid free in phar_extract_file(), resolved 146233, https://hackerone.com/reports/146233, Use After Free Vulnerability in PHP's GC algorithm and unserialize, resolved 146235, https://hackerone.com/reports/146235, ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize, resolved 146255, https://hackerone.com/reports/146255, Double Free Corruption in wddx.c (extension), resolved 146314, https://hackerone.com/reports/146314, Deny access to download.nextcloud.com + folders, informative 146318, https://hackerone.com/reports/146318, Html injection in monitor name textbox, resolved 146327, https://hackerone.com/reports/146327, Server version disclosure: team.uberinternal.com, informative 146336, https://hackerone.com/reports/146336, XSS vulnerable parameter in a location hash, resolved 146360, https://hackerone.com/reports/146360, Heap Overflow Due To Integer Overflow, resolved 146416, https://hackerone.com/reports/146416, Ruby:HTTP Header injection in 'net/http', informative 146424, https://hackerone.com/reports/146424, No Rate Limiting on stats.nextcloud.com login, informative 146436, https://hackerone.com/reports/146436, [product360.informatica.com] Unauthenticated Apache Tomcat 8 Installation, resolved 146593, https://hackerone.com/reports/146593, RCE Possible Via Video Manager Export using @ character in Video Title, informative 146735, https://hackerone.com/reports/146735, Command Injection, Information , informative 146847, https://hackerone.com/reports/146847, faspex.uber.com uses an invalid SSL certificate, informative 146875, https://hackerone.com/reports/146875, http://newrelic.com SSRF/XSPA, informative 146910, https://hackerone.com/reports/146910, RC4 cipher suites detected, resolved 146911, https://hackerone.com/reports/146911, The POODLE attack (SSLv3 supported), resolved 146936, https://hackerone.com/reports/146936, CVE-2015-8874 Stack overflow with imagefilltoborder, resolved 146939, https://hackerone.com/reports/146939, DOM XSS в /activation.php?act=activate_mobile, resolved 146940, https://hackerone.com/reports/146940, pass2_no_dither out-of-bounds access, resolved 146944, https://hackerone.com/reports/146944, NULL Pointer Dereference at _gdScaleVert, resolved 146948, https://hackerone.com/reports/146948, Clickjacking login page of http://book.zomato.com/, informative 147125, https://hackerone.com/reports/147125, Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow, resolved 147155, https://hackerone.com/reports/147155, Can make any number of dropbox accounts with one email, not-applicable 147161, https://hackerone.com/reports/147161, [oneclickdrsfdc-test.informatica.com] Tomcat Example Scripts Exposed Unauthenticated, resolved 147182, https://hackerone.com/reports/147182, No email verification required when we change email from settings, resolved 147188, https://hackerone.com/reports/147188, Stored number of clicks in the Deposits button, resolved 147196, https://hackerone.com/reports/147196, [careers.informatica.com] Reflected Cross Site Scripting to XSS Shell Possible, resolved 147204, https://hackerone.com/reports/147204, Bypass logout , resolved 147220, https://hackerone.com/reports/147220, Urgent Fix Balance Limit bypass , resolved 147237, https://hackerone.com/reports/147237, Betting more than max amount, resolved 147260, https://hackerone.com/reports/147260, Weak HSTS age, resolved 147310, https://hackerone.com/reports/147310, ntpd: read_mru_list() does inadequate incoming packet checks, resolved 147369, https://hackerone.com/reports/147369, User can start call in a channel of an unpaid account, resolved 147388, https://hackerone.com/reports/147388, Session doesn't expired after login, resolved 147570, https://hackerone.com/reports/147570, Local File Inclusion path bypass, resolved 147577, https://hackerone.com/reports/147577, Application error message, resolved 147656, https://hackerone.com/reports/147656, Logging out any user, resolved 147776, https://hackerone.com/reports/147776, Change contents of the careers iframe in https://corp.badoo.com/jobs, resolved 147919, https://hackerone.com/reports/147919, Email spoofing in support@veris.in , resolved 148050, https://hackerone.com/reports/148050, Know undisclosed Bounty Amount when Bounty Statistics are enabled., resolved 148068, https://hackerone.com/reports/148068, Source code leakage through GIT web access at host '52.91.137.42', resolved 148151, https://hackerone.com/reports/148151, SMB User Authentication Bypass and Persistence, resolved 148163, https://hackerone.com/reports/148163, Wordpress Vulnerabilities in transparencyreport.uber.com and eng.uber.com domains, resolved 148300, https://hackerone.com/reports/148300, Full Page Caching Stored XSS Vulnerability, informative 148417, https://hackerone.com/reports/148417, CSRF with redeem coupon request , informative 148467, https://hackerone.com/reports/148467, Паблики: Модератор паблика может удалять добавленные редакторами материалы с таймером на публикацию., resolved 148517, https://hackerone.com/reports/148517, Possible CSRF during joining report as participant , resolved 148537, https://hackerone.com/reports/148537, No authorization required in Windows phone web-application, duplicate 148538, https://hackerone.com/reports/148538, No authorization required in iOS device web-application, duplicate 148609, https://hackerone.com/reports/148609, Register multiple users using one invitation (race condition), resolved 148640, https://hackerone.com/reports/148640, XSS, Unvalidated redirects & phishing website hosting on dropbox servers, not-applicable 148763, https://hackerone.com/reports/148763, Email spoofing in security@paragonie.com, informative 148764, https://hackerone.com/reports/148764, [idor] Unauthorized Read access to all the private posts(Including Photos,Videos,Gifs), resolved 148770, https://hackerone.com/reports/148770, Subdomain takeover at api.legalrobot.com due to non-used domain in Modulus.io., resolved 148777, https://hackerone.com/reports/148777, Microsoft IIS tilde directory enumeration, resolved 148848, https://hackerone.com/reports/148848, "a stored xss issue in share post menu", resolved 148865, https://hackerone.com/reports/148865, HTML in Diffusion not escaped in certain circumstances, resolved 148890, https://hackerone.com/reports/148890, Full path disclosure when CSRF validation failed , informative 148897, https://hackerone.com/reports/148897, [Thirdparty] Stored XSS in chat module - nextcloud server 9.0.51 installed in ubuntu 14.0.4 LTS, resolved 148903, https://hackerone.com/reports/148903, Airship doesn't reject weak passwords, informative 148911, https://hackerone.com/reports/148911, User enumeration via Password reset page [Minor], informative 148914, https://hackerone.com/reports/148914, Session Management Issue CMS Airship, informative 148952, https://hackerone.com/reports/148952, Content Injection error page, informative 148963, https://hackerone.com/reports/148963, Application error message, resolved 149011, https://hackerone.com/reports/149011, a stored xss issue in https://files.slack.com, resolved 149027, https://hackerone.com/reports/149027, Issue with password reset functionality [Minor], informative 149028, https://hackerone.com/reports/149028, [URGENT] Password reset emails are sent in clear-text (without encryption), informative 149154, https://hackerone.com/reports/149154, Stored xss , resolved 149212, https://hackerone.com/reports/149212, Full path + some back-end code disclosure, resolved 149268, https://hackerone.com/reports/149268, Arbitrary file upload when setting an avatar, resolved 149273, https://hackerone.com/reports/149273, Filename and directory enumeration, resolved 149279, https://hackerone.com/reports/149279, Arbitrary SQL query execution and reflected XSS in the "SQL Query Form", resolved 149287, https://hackerone.com/reports/149287, Reflected Xss in AirMax [Nanostation Loco M2], resolved 149327, https://hackerone.com/reports/149327, Web Server Disclosure, informative 149369, https://hackerone.com/reports/149369, ssl info shown , not-applicable 149435, https://hackerone.com/reports/149435, Reward Money Leakage, informative 149483, https://hackerone.com/reports/149483, Server version disclosure, informative 149571, https://hackerone.com/reports/149571, Stored XSS in wis.pr, resolved 149572, https://hackerone.com/reports/149572, AWS S3 website can't serve security headers, may allow clickjacking, resolved 149589, https://hackerone.com/reports/149589, CSRF to add admin [wordpress], resolved 149598, https://hackerone.com/reports/149598, Insecure 2FA/authentication implementation creates a brute force vulnerability, resolved 149673, https://hackerone.com/reports/149673, Reflected XSS in reddeadredemption Site located at www.rockstargames.com/reddeadredemption, resolved 149679, https://hackerone.com/reports/149679, Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.com, resolved 149710, https://hackerone.com/reports/149710, don't leak Server version for assets.gratipay.com, informative 149798, https://hackerone.com/reports/149798, Content (Text) Injection at NextCloud Server 9.0.52 - via http://custom_nextcloud_url/remote.php/dav/files/ , resolved 149855, https://hackerone.com/reports/149855, Reflected XSS in m.imgur.com, resolved 149907, https://hackerone.com/reports/149907, Urgent: attacker can access every data source on Bime, resolved 149914, https://hackerone.com/reports/149914, Attacker can access graphic representation of every query, resolved 150018, https://hackerone.com/reports/150018, Full Path Disclosure by removing CSRF token, informative 150078, https://hackerone.com/reports/150078, SSL certificate public key less than 2048 bit, not-applicable 150079, https://hackerone.com/reports/150079, Brute force on wp-login, not-applicable 150083, https://hackerone.com/reports/150083, Cross Site Scripting(XSS) on IRCCloud Badges Page (using Parameter Pollution), resolved 150156, https://hackerone.com/reports/150156, SQL Injection on sctrack.email.uber.com.cn, resolved 150179, https://hackerone.com/reports/150179, Html Injection and Possible XSS in sms-be-vip.twitter.com, resolved 150374, https://hackerone.com/reports/150374, https://windsor.shopify.com/ takeover, resolved 150375, https://hackerone.com/reports/150375, newsroom.uber.com is vulnerable to 'SOME' XSS attack via plupload.flash.swf, resolved 150520, https://hackerone.com/reports/150520, XXE at Informatica sub-domain, resolved 150540, https://hackerone.com/reports/150540, All Active user sessions should be destroyed when user change his password!, resolved 150560, https://hackerone.com/reports/150560, XSS @ *.olx.com.ar, resolved 150565, https://hackerone.com/reports/150565, XSS @ yaman.olx.ph, resolved 150568, https://hackerone.com/reports/150568, Cross Site Scripting -> Reflected XSS, resolved 150586, https://hackerone.com/reports/150586, CSRF in account configuration leads to complete account compromise, resolved 150626, https://hackerone.com/reports/150626, Heap Buffer Overflow, resolved 150631, https://hackerone.com/reports/150631, Updating and Deleting any Ads on OLX Philippines , resolved 150668, https://hackerone.com/reports/150668, stored XSS in olx.pl - ogloszenie TITLE element - moderator acc can be hacked, resolved 150746, https://hackerone.com/reports/150746, Reflected XSS in www.olx.ph, resolved 150783, https://hackerone.com/reports/150783, Arbitrary File Reading, resolved 150822, https://hackerone.com/reports/150822, XSS @ *.letgo.com, resolved 150837, https://hackerone.com/reports/150837, Reflected Cross Site scripting Attack (XSS), resolved 150905, https://hackerone.com/reports/150905, Information disclosure through directory listing at http://dockerhost01.maximum.nl:8080, resolved 150917, https://hackerone.com/reports/150917, prevent null bytes in email field, informative 150944, https://hackerone.com/reports/150944, cross-site scripting in get request, duplicate 150976, https://hackerone.com/reports/150976, Flash “local-with-filesystem” Bypass in navigateToURL, resolved 151034, https://hackerone.com/reports/151034, Xss on billing, resolved 151039, https://hackerone.com/reports/151039, Adobe Flash Player TimedEvent.parent Memory Corruption Vulnerability, resolved 151040, https://hackerone.com/reports/151040, Adobe Flash Player ShimAdPolicySelector(adPolicySelectorType=0) class Memory Corruption, resolved 151043, https://hackerone.com/reports/151043, Adobe Flash Player PSDK Class Use After Free Vulnerability, resolved 151058, https://hackerone.com/reports/151058, Stealing livechat token and using it to chat as the user - user information disclosure , resolved 151086, https://hackerone.com/reports/151086, SSRF allows access to internal services like Ganglia, resolved 151117, https://hackerone.com/reports/151117, [bbPress] Stored XSS in any forum post., resolved 151147, https://hackerone.com/reports/151147, XSS yaman.olx.ph, resolved 151149, https://hackerone.com/reports/151149, Manipulating joinolx.com Job Vacancy alert subscription emails (HTML Injection / Script Injection), resolved 151165, https://hackerone.com/reports/151165, This is a test report, not-applicable 151231, https://hackerone.com/reports/151231, Content-type sniffing leads to stored XSS in CMS Airship on Internet Explorer , resolved 151258, https://hackerone.com/reports/151258, Reflected XSS at yaman.olx.ph, informative 151276, https://hackerone.com/reports/151276, Reflected XSS in /Videos/ via calling a callback http://www.rockstargames.com/videos/#/?lb=, resolved 151295, https://hackerone.com/reports/151295, don't allow directory browsing on grtp.co, informative 151302, https://hackerone.com/reports/151302, don't leak Server version for assets.gratipay.com, duplicate 151305, https://hackerone.com/reports/151305, REFLECTED CROSS SITE SCRIPTING IN OLX, resolved 151310, https://hackerone.com/reports/151310, xss yaman.olx.ph, informative 151459, https://hackerone.com/reports/151459, Creating Post on a restricted channel, resolved 151465, https://hackerone.com/reports/151465, Get organization info base on uuid, resolved 151470, https://hackerone.com/reports/151470, [IODR] Get business trip via organization id, resolved 151475, https://hackerone.com/reports/151475, ownCloud 2.2.2.6192 DLL Hijacking Vulnerability, resolved 151516, https://hackerone.com/reports/151516, CSV Injection at Camptix Event Ticketing, resolved 151583, https://hackerone.com/reports/151583, User enumeration in wp-admin, not-applicable 151634, https://hackerone.com/reports/151634, XSS in http://localhost:8153/go/admin/config/server/update, resolved 151678, https://hackerone.com/reports/151678, Cross Site Scripting, resolved 151680, https://hackerone.com/reports/151680, Possible SSRF at URL Parameter while creating a new package repository, resolved 151691, https://hackerone.com/reports/151691, XSS on Home page olx.com.ar via auto save search text, resolved 151772, https://hackerone.com/reports/151772, Directory Listening, resolved 151779, https://hackerone.com/reports/151779, Reflected XSS, duplicate 151786, https://hackerone.com/reports/151786, X-Content-Type-Options header missing at Auth Login, resolved 151831, https://hackerone.com/reports/151831, User Supplied links on profile page is not validated and redirected via gratipay., duplicate 151847, https://hackerone.com/reports/151847, The application uses basic authentication., informative 151868, https://hackerone.com/reports/151868, No Rate Limit In Inviting Similar Contact Multiple Times, resolved 152013, https://hackerone.com/reports/152013, CSRF in 'set.php' via age causes stored XSS on 'get.php' - http://www.rockstargames.com/php/videoplayer_cache/get.php', resolved 152052, https://hackerone.com/reports/152052, CSRF Full Account Takeover, resolved 152067, https://hackerone.com/reports/152067, Stored XSS on developer.uber.com via admin account compromise, resolved 152069, https://hackerone.com/reports/152069, Stored XSS on contact name, resolved 152080, https://hackerone.com/reports/152080, Broken authentication and session management flaw , resolved 152231, https://hackerone.com/reports/152231, Out of bound read in exif_process_IFD_in_MAKERNOTE, resolved 152232, https://hackerone.com/reports/152232, NULL Pointer Dereference in exif_process_user_comment, resolved 152266, https://hackerone.com/reports/152266, Use After Free Vulnerability in SNMP with GC and unserialize(), resolved 152267, https://hackerone.com/reports/152267, Use After Free in unserialize() with Unexpected Session Deserialization, resolved 152278, https://hackerone.com/reports/152278, Stack-based buffer overflow vulnerability in php_stream_zip_opener, resolved 152280, https://hackerone.com/reports/152280, Stack-based buffer overflow vulnerability in virtual_file_ex, resolved 152281, https://hackerone.com/reports/152281, Use After Free/Double Free in Garbage Collection, resolved 152368, https://hackerone.com/reports/152368, XSS in a newrelic.com site, resolved 152398, https://hackerone.com/reports/152398, In correct casting from size_t to int lead to heap overflow in mcrypt_generic, resolved 152399, https://hackerone.com/reports/152399, php curl ext size_t overflow lead to heap corruption, resolved 152400, https://hackerone.com/reports/152400, php mcrypt ext - In correct casting from size_t to int lead to heap overflow in mdecrypt_generic, resolved 152407, https://hackerone.com/reports/152407, Missing Access Control(IDOR) To Know LinkedAccounts , resolved 152416, https://hackerone.com/reports/152416, Lazy Load stored XSS, resolved 152477, https://hackerone.com/reports/152477, Username .. (double dot) should be restricted or handled carefully, informative 152499, https://hackerone.com/reports/152499, Information disclosure, not-applicable 152569, https://hackerone.com/reports/152569, Cross-Site Request Forgery (CSRF), resolved 152584, https://hackerone.com/reports/152584, S3 bucket takeover due to proxy.harvestfiles.com, resolved 152586, https://hackerone.com/reports/152586, CSRF token fixation in Sign in with Google, resolved 152591, https://hackerone.com/reports/152591, Stored XSS on invoice, executing on any subdomain, resolved 152669, https://hackerone.com/reports/152669, Users enumeration is possible through cycling through recurring[client_id] argument value., resolved 152692, https://hackerone.com/reports/152692, Persistent Cross-Site Scripting in WooCommerce WordPress plugin, resolved 152696, https://hackerone.com/reports/152696, Leak of all project names and all user names , even across applications, resolved 152717, https://hackerone.com/reports/152717, Race Condition in Definition Votes, resolved 152772, https://hackerone.com/reports/152772, Inadequate error handling in bzread(), resolved 152782, https://hackerone.com/reports/152782, locale_accept_from_http out-of-bounds access, resolved 152784, https://hackerone.com/reports/152784, imagegif/output out-of-bounds access, resolved 152834, https://hackerone.com/reports/152834, [gratipay.com] Cross Site Tracing, informative 152925, https://hackerone.com/reports/152925, Content spoofing in cloud.nextcloud.com, resolved 152929, https://hackerone.com/reports/152929, Project Disclosure of all Harvest Instances, resolved 152944, https://hackerone.com/reports/152944, Session Management Flaw, resolved 152958, https://hackerone.com/reports/152958, Multiple XSS in Camptix Event Ticketing Plugin, resolved 153026, https://hackerone.com/reports/153026, Java Deserialization RCE via JBoss JMXInvokerServlet/EJBInvokerServlet on card.starbucks.in, resolved 153093, https://hackerone.com/reports/153093, WordPress core - Denial of Service via Cross Site Request Forgery, resolved 153095, https://hackerone.com/reports/153095, Text Only Content Spoofing on ubermovement.com Community Page, informative 153175, https://hackerone.com/reports/153175, Can add employee in business.uber.com without add payment method, informative 153251, https://hackerone.com/reports/153251, [Nextcloud 9.0.53] Content Spoofing in 'trustDomain' parameter, resolved 153580, https://hackerone.com/reports/153580, CSRF in changing settings of Basic Google Maps Placemarks, not-applicable 153618, https://hackerone.com/reports/153618, Reflected XSS via #tags= while using a callback in newswire http://www.rockstargames.com/newswire, resolved 153628, https://hackerone.com/reports/153628, [Not just a server configuration issue] Full Path Disclosure , informative 153634, https://hackerone.com/reports/153634, [alerts.newrelic.com] Scanning local network via notification channel, resolved 153666, https://hackerone.com/reports/153666, csp bypass + xss, resolved 153776, https://hackerone.com/reports/153776, gdImageTrueColorToPaletteBody allows arbitrary write/read access, resolved 153794, https://hackerone.com/reports/153794, Response splitting vulnerability in WEBrick, resolved 153799, https://hackerone.com/reports/153799, xss for admin of https://newsletter.nextcloud.com, resolved 153863, https://hackerone.com/reports/153863, heap-buffer-overflow (write) simplestring_addn simplestring.c, resolved 153905, https://hackerone.com/reports/153905, IDOR - Disable sharing, resolved 154275, https://hackerone.com/reports/154275, [doc.owncloud.org] CRLF Injection, resolved 154278, https://hackerone.com/reports/154278, Cache purge requests are not authenticated, resolved 154306, https://hackerone.com/reports/154306, [api.owncloud.org] CRLF Injection, resolved 154319, https://hackerone.com/reports/154319, [forum.owncloud.org] IE, Edge XSS via Request-URI, resolved 154369, https://hackerone.com/reports/154369, Unauthorized access to Zookeeper on http://locutus-zk3.ec2.shopify.com:2181, resolved 154397, https://hackerone.com/reports/154397, [Stored Cross-Site-Scripting] When search about Incoming ( Manual Jurnal ), resolved 154400, https://hackerone.com/reports/154400, Opportunity to set arbitrary cookies, resolved 154410, https://hackerone.com/reports/154410, Delete/modify your own comment after limited access(IDOR), resolved 154425, https://hackerone.com/reports/154425, Subdomain takeover on http://fastly.sc-cdn.net/, resolved 154529, https://hackerone.com/reports/154529, Bookmarks: Delete all existing bookmarks of a user, resolved 154762, https://hackerone.com/reports/154762, Missing authorization checks leading to the exposure of ubernihao.com administrator accounts , resolved 154827, https://hackerone.com/reports/154827, More content spoofing through dir param in the files app, resolved 154855, https://hackerone.com/reports/154855, Leaking license key in source code, resolved 154921, https://hackerone.com/reports/154921, Content Spoofing/Text Injection , resolved 154963, https://hackerone.com/reports/154963, Stealing User emails by clickjacking cards.twitter.com/xxx/xxx, resolved 155130, https://hackerone.com/reports/155130, Unauthorised access to olx.in user accounts. , resolved 155189, https://hackerone.com/reports/155189, demo.nextcloud.com: Content spoofing due to default Apache Error Page, resolved 155222, https://hackerone.com/reports/155222, (BYPASS) Open Redirect after login at http://ecommerce.shopify.com, resolved 155223, https://hackerone.com/reports/155223, Use After Free Vulnerability in array_walk()/array_walk_recursive(), resolved 155228, https://hackerone.com/reports/155228, Outdated MediaElement.js Reflected Cross-Site Scripting (XSS), resolved 155576, https://hackerone.com/reports/155576, [github.algolia.com] XSS, resolved 155578, https://hackerone.com/reports/155578, User Enumeration and Information Disclosure, informative 155618, https://hackerone.com/reports/155618, Watch any Password Video without password, resolved 155657, https://hackerone.com/reports/155657, Arbitrary Code Injection in ownCloud’s Windows Client, resolved 155685, https://hackerone.com/reports/155685, Content injection on 404 error page at faspex.uber.com, not-applicable 155690, https://hackerone.com/reports/155690, Arbitrary File Upload in Logo & Log in image Theming setting., resolved 155704, https://hackerone.com/reports/155704, Staff member can delete Private Apps, resolved 155726, https://hackerone.com/reports/155726, Create Multiple Account Using Similar X-CSRF token, not-applicable 155774, https://hackerone.com/reports/155774, CSRF - Add optional two factor mobile number, resolved 156098, https://hackerone.com/reports/156098, XSS At "pages.et.uber.com", not-applicable 156166, https://hackerone.com/reports/156166, [kb.informatica.com] Dom Based xss, resolved 156182, https://hackerone.com/reports/156182, Visibility Robots.txt file, informative 156196, https://hackerone.com/reports/156196, Error page Text Injection., not-applicable 156347, https://hackerone.com/reports/156347, Stored XSS triggered by json key during UI generation, resolved 156373, https://hackerone.com/reports/156373, Stored xss, resolved 156387, https://hackerone.com/reports/156387, Stored XSS from Display Settings triggered on Save and viewing realtime search demo, resolved 156425, https://hackerone.com/reports/156425, demo.nextcloud.com: Content spoofing due to default Apache Error Page, resolved 156510, https://hackerone.com/reports/156510, Directory listening enabled in: 88.198.160.130, resolved 156511, https://hackerone.com/reports/156511, Incorrect logic in MySQL & MariaDB protocol leads to remote SSRF/Remote file read, resolved 156520, https://hackerone.com/reports/156520, Unauthorized team members can leak information and see all API calls through /1/admin/* endpoints, even after they have been removed., resolved 156536, https://hackerone.com/reports/156536, Reading Emails in Uber Subdomains, resolved 156537, https://hackerone.com/reports/156537, IDOR Causing Deletion of any account, resolved 156542, https://hackerone.com/reports/156542, Avoid "resend verification email" confusion, resolved 156941, https://hackerone.com/reports/156941, bug, resolved 156992, https://hackerone.com/reports/156992, Login CSRF vulnerability, informative 157270, https://hackerone.com/reports/157270, CSRF vulnerability that allows an attacker to purge plugin metric data, resolved 157434, https://hackerone.com/reports/157434, XSS on IOS app via HTML rendering, resolved 157450, https://hackerone.com/reports/157450, All Active user sessions should be destroyed when user change his password!, informative 157465, https://hackerone.com/reports/157465, Host Header Injection/Redirection Attack, not-applicable 157563, https://hackerone.com/reports/157563, Cookie:HttpOnly Flag not set, duplicate 157699, https://hackerone.com/reports/157699, Disclosure of external users invited to a specific report, resolved 157750, https://hackerone.com/reports/157750, Missing rate limit on critical user actions e.g. reset password, change email, disable account., resolved 157813, https://hackerone.com/reports/157813, XSS on Meta Tag at https://m.olx.ph, resolved 157889, https://hackerone.com/reports/157889, these are my old reports and still i have not receive any good replys, these all are Cross Site Scripting(XSS) issues: POC1: https://www.youtube.com/w, resolved 157958, https://hackerone.com/reports/157958, Stored XSS, resolved 157986, https://hackerone.com/reports/157986, Internal server error 500 at log.veris.in , informative 157993, https://hackerone.com/reports/157993, Cross-Site Request Forgery (CSRF), resolved 157996, https://hackerone.com/reports/157996, Race Condition in Redeeming Coupons, resolved 158002, https://hackerone.com/reports/158002, Missing rel=noreferrer tag allows link in list to change url of currently open tab, resolved 158016, https://hackerone.com/reports/158016, Server side request forgery on image upload for lists, resolved 158021, https://hackerone.com/reports/158021, Image Upload Path Disclosure, resolved 158148, https://hackerone.com/reports/158148, reverb.twitter.com redirects to vulnerable reverb.guru, resolved 158157, https://hackerone.com/reports/158157, shopper login_code's can be brute forced, resolved 158186, https://hackerone.com/reports/158186, Non-secure requests are not automatically upgraded to HTTPS, resolved 158270, https://hackerone.com/reports/158270, Business logic Failure - Browser cache management and logout vulnerability in Certly, resolved 158287, https://hackerone.com/reports/158287, XSS on Nanostation Loco M2 Airmax, resolved 158330, https://hackerone.com/reports/158330, Ability to access all user authentication tokens, leads to RCE, resolved 158434, https://hackerone.com/reports/158434, (BYPASS) Open redirect and XSS in supporthiring.shopify.com, resolved 158461, https://hackerone.com/reports/158461, Blind XSS in mapbox.com/contact, resolved 158482, https://hackerone.com/reports/158482, Host Header poisoning on gratipay.com, duplicate 158484, https://hackerone.com/reports/158484, [scores.ubnt.com] DOM based XSS at form.html, resolved 158541, https://hackerone.com/reports/158541, Webhook allows sending payload using insecure HTTP protocol, resolved 158554, https://hackerone.com/reports/158554, Hyperlink Injection in Friend Invitation Emails, resolved 158749, https://hackerone.com/reports/158749, [alpha.informatica.com] Expensive DOMXSS, resolved 158757, https://hackerone.com/reports/158757, Cross site scripting , resolved 158853, https://hackerone.com/reports/158853, OX Guard: DOM Based Cross-Site Scripting, resolved 158872, https://hackerone.com/reports/158872, [Critical] Delete any account , resolved 158979, https://hackerone.com/reports/158979, PM with can Set up email for invoices and estimates (Access control Issue), resolved 159213, https://hackerone.com/reports/159213, The web app's forgot password page is vulnerable to text injection/content spoofing, resolved 159387, https://hackerone.com/reports/159387, PM can delete the company logo image (Vertical Privilege Escalation ), resolved 159391, https://hackerone.com/reports/159391, Record payment for any invoice by PM (Access control Issue), resolved 159393, https://hackerone.com/reports/159393, PM can delete payment of any invoice in company (Access control Issue), resolved 159395, https://hackerone.com/reports/159395, Unauthorized access to all the actions of invoices by PM (Access control Issues) , resolved 159399, https://hackerone.com/reports/159399, Unauthorized read access to Invoices by PM (Access control Issues), resolved 159460, https://hackerone.com/reports/159460, Stored XSS(Cross Site Scripting) In Slack App Name, resolved 159481, https://hackerone.com/reports/159481, full path disclosure vulnerability at https://security.olx.com/*, resolved 159497, https://hackerone.com/reports/159497, Missing Rate limiting for sensitive actions (like "forgot password") and reCaptcha error. , resolved 159507, https://hackerone.com/reports/159507, [qiwi.com] Oauth захват аккаунта, resolved 159522, https://hackerone.com/reports/159522, Open redirect using checkout_url, resolved 159526, https://hackerone.com/reports/159526, Information leakage of private program, resolved 159536, https://hackerone.com/reports/159536, Open CouchDB on experiments.ec2.shopify.com:5984, resolved 159686, https://hackerone.com/reports/159686, integer overflow in the _csv module's join_append_data function, resolved 159687, https://hackerone.com/reports/159687, integer overflow in binascii.b2a_qp, resolved 159690, https://hackerone.com/reports/159690, stack buffer overflows in the curses module, resolved 159693, https://hackerone.com/reports/159693, Py_DECREF on a non-owned object in the _sre module, resolved 159696, https://hackerone.com/reports/159696, Two vulnerabilities in the ssl module, resolved 159820, https://hackerone.com/reports/159820, Issues with uploading list images, resolved 159878, https://hackerone.com/reports/159878, [render.bitstrips.com] Stored XSS via an incorrect avatar property value, resolved 159890, https://hackerone.com/reports/159890, Ability to monitor reports' submission in real time, not-applicable 159925, https://hackerone.com/reports/159925, Send emails to all users using Camptix, not-applicable 159943, https://hackerone.com/reports/159943, Create an Unexpected Object and Don't Invoke __wakeup() in During Deserialization, resolved 159953, https://hackerone.com/reports/159953, integer overflow in curl_escape caused heap corruption, resolved 159954, https://hackerone.com/reports/159954, integer overflow in base64_decode caused heap corruption, resolved 159955, https://hackerone.com/reports/159955, integer overflow in bzdecompress caused heap corruption, resolved 159958, https://hackerone.com/reports/159958, Integer overflow lead to heap corruption in sql_regcase, resolved 159959, https://hackerone.com/reports/159959, integer overflow in quoted_printable_encode caused heap corruption, resolved 159960, https://hackerone.com/reports/159960, integer overflow in urlencode caused heap corruption, resolved 159961, https://hackerone.com/reports/159961, integer overflow in php_uuencode caused heap corruption, resolved 159984, https://hackerone.com/reports/159984, XSS On meta tags in profile page, resolved 159985, https://hackerone.com/reports/159985, [realty.mail.ru] XSS, SSI Injection, resolved 159988, https://hackerone.com/reports/159988, Heap Overflow due to integer overflows, resolved 159992, https://hackerone.com/reports/159992, memory allocator fails to realloc small block to large one, resolved 160047, https://hackerone.com/reports/160047, [apps.shopify.com] Open Redirect, resolved 160109, https://hackerone.com/reports/160109, Brute force login and bypass locked account restrictions via iOS app, resolved 160120, https://hackerone.com/reports/160120, API OAuth Public Key disclosure in mobile app, informative 160294, https://hackerone.com/reports/160294, Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128), resolved 160295, https://hackerone.com/reports/160295, Heap overflow in curl_escape, resolved 160488, https://hackerone.com/reports/160488, stored SELF xss on Basic Google Maps Placemarks Settings plugin, not-applicable 160498, https://hackerone.com/reports/160498, window.opener is leaking to external domains upon redirect on Safari, resolved 160500, https://hackerone.com/reports/160500, Bypassing CSV injection using new line charcter, resolved 160520, https://hackerone.com/reports/160520, Bypass fix in https://hackerone.com/reports/151516 report., resolved 160981, https://hackerone.com/reports/160981, Extracting private info of estimates., resolved 161189, https://hackerone.com/reports/161189, select_colors write out-of-bounds, resolved 161193, https://hackerone.com/reports/161193, imagegammacorrect allows arbitrary write access, resolved 161198, https://hackerone.com/reports/161198, wddx_deserialize null dereference with invalid xml, resolved 161200, https://hackerone.com/reports/161200, wddx_deserialize allows illegal memory access, resolved 161216, https://hackerone.com/reports/161216, wddx_deserialize null dereference, resolved 161217, https://hackerone.com/reports/161217, wddx_deserialize null dereference in php_wddx_pop_element, resolved 161290, https://hackerone.com/reports/161290, bypass to csv injection, not-applicable 161299, https://hackerone.com/reports/161299, Content Injection - apps.nextcloud.com, resolved 161301, https://hackerone.com/reports/161301, READ .svg files by changing .svg into .png extension, resolved 161323, https://hackerone.com/reports/161323, Content Injection - demo.nextcloud.com, resolved 161408, https://hackerone.com/reports/161408, [cfire.mail.ru] CSRF Bypassed - Changing anyone's 'User Info', resolved 161428, https://hackerone.com/reports/161428, Subdomain takeover at ws.bimedb.com due to unclaimed Amazon S3 bucket, resolved 161459, https://hackerone.com/reports/161459, Potentially vulnerable version of Apache software in and default files on https://iandunn.name/, informative 161529, https://hackerone.com/reports/161529, Site-wide CSRF on eats.uber.com, resolved 161621, https://hackerone.com/reports/161621, XSS Via Method injection, informative 161659, https://hackerone.com/reports/161659, ████ discloses valid Airbnb SSO login names via Google Search Results, resolved 161710, https://hackerone.com/reports/161710, Possible to steal any protected files on Android, resolved 161918, https://hackerone.com/reports/161918, Reset Link Issue, not-applicable 161924, https://hackerone.com/reports/161924, Password Reset Link issue, resolved 161932, https://hackerone.com/reports/161932, Non secure requests at guard.certly.io not upgrading to https, resolved 161935, https://hackerone.com/reports/161935, Usernames ending in .json are not restricted, informative 161947, https://hackerone.com/reports/161947, Lack of length validation on user address attribute, resolved 161991, https://hackerone.com/reports/161991, Open Redirect possible in https://www.shopify.com/admin/, resolved 162147, https://hackerone.com/reports/162147, Boards leak private label names and desciptions, resolved 162199, https://hackerone.com/reports/162199, Lack of payment type validation in dial.uber.com allows for free rides, resolved 162296, https://hackerone.com/reports/162296, XSS and HTML Injection https://sharjah.dubizzle.com/, resolved 162336, https://hackerone.com/reports/162336, x-xss protection header is not set in response header, informative 162809, https://hackerone.com/reports/162809, Changing paymentProfileUuid when booking a trip allows free rides, resolved 162822, https://hackerone.com/reports/162822, Fetch private list metadata and any user's personal name, resolved 162955, https://hackerone.com/reports/162955, Code Injection in Slack's Windows Desktop Client leads to Privilege Escalation, resolved 163087, https://hackerone.com/reports/163087, use of uninitialized variables in operator.methodcaller, resolved 163106, https://hackerone.com/reports/163106, Information Disclosure of .htaccess file in Private Server/Subdomain, resolved 163124, https://hackerone.com/reports/163124, [skyliner.io / qa.skyliner.io] Open Redirect, duplicate 163131, https://hackerone.com/reports/163131, Users contents on AWS is cacheable , resolved 163156, https://hackerone.com/reports/163156, Email Spoofing With Your Website's Email, duplicate 163227, https://hackerone.com/reports/163227, Cookie Misconfiguration, duplicate 163272, https://hackerone.com/reports/163272, OPEN URL REDIRECT through PNG files, resolved 163292, https://hackerone.com/reports/163292, Subtile Code Injection Vulnerability in Dropbox for Windows, resolved 163307, https://hackerone.com/reports/163307, WordPress Authentication Denial of Service, resolved 163338, https://hackerone.com/reports/163338, \OCA\DAV\CardDAV\ImageExportPlugin allows serving arbitrary data with user-defined or empty mimetype, resolved 163342, https://hackerone.com/reports/163342, Expired SSL certificate , resolved 163381, https://hackerone.com/reports/163381, Session hijacking attack, not-applicable 163421, https://hackerone.com/reports/163421, Wordpress: Directory Traversal / Denial of Serivce, resolved 163459, https://hackerone.com/reports/163459, potential memory corruption in or/buffers.c (particularly on 32 bit), resolved 163464, https://hackerone.com/reports/163464, User Information sent to client through websockets, resolved 163467, https://hackerone.com/reports/163467, User Information leak allows user to bypass email verification., resolved 163475, https://hackerone.com/reports/163475, Email spoofing possible via Legal Robot domain, informative 163476, https://hackerone.com/reports/163476, Information Disclosure in AWS S3 Bucket, resolved 163491, https://hackerone.com/reports/163491, CORS (Cross-Origin Resource Sharing), resolved 163501, https://hackerone.com/reports/163501, Email spoofing-fake mail from your mail domain server , informative 163526, https://hackerone.com/reports/163526, Email Spoofing, duplicate 163547, https://hackerone.com/reports/163547, Java RMI (Remote Code Execution), informative 163599, https://hackerone.com/reports/163599, Amazon Bucket Accessible (http://legalrobot.s3.amazonaws.com/), not-applicable 163646, https://hackerone.com/reports/163646, Clickjacking: X-Frame-Options header missing, duplicate 163676, https://hackerone.com/reports/163676, Legal | Application is Missing CSP(Content Security Policy) Header , resolved 163677, https://hackerone.com/reports/163677, 2 vulns , informative 163730, https://hackerone.com/reports/163730, News Feed Detected , spam 163753, https://hackerone.com/reports/163753, UI Redressing ( ClickJacking ) Issue on Information submit form , duplicate 163812, https://hackerone.com/reports/163812, Insecure Transportation Security Protocol Supported (TLS 1.0), informative 163815, https://hackerone.com/reports/163815, Lack of CSRF token validation at server side, informative 163820, https://hackerone.com/reports/163820, Sensitive information/action is stored/done is done using a GET request, resolved 163823, https://hackerone.com/reports/163823, Slow Http attack on nextcloud(DOS), resolved 163834, https://hackerone.com/reports/163834, Обход 2ух-шаговой авторизации / 2FA Bypass, resolved 163885, https://hackerone.com/reports/163885, unsecured legalrobot.co.uk assets, resolved 163888, https://hackerone.com/reports/163888, Click Jacking, duplicate 163904, https://hackerone.com/reports/163904, Username can be used to trick the victim on the name of www.gratipay.com, informative 163938, https://hackerone.com/reports/163938, Snooping into messages via email service, resolved 163949, https://hackerone.com/reports/163949, Username Restriction is not applied for reserved folders, informative 164027, https://hackerone.com/reports/164027, Reflected Self-XSS Vulnerability in the Comment section of Files Information, resolved 164137, https://hackerone.com/reports/164137, Possible content spoofing due to missing error page, resolved 164152, https://hackerone.com/reports/164152, [ibank.qiwi.ru] XSS via Request-URI, resolved 164153, https://hackerone.com/reports/164153, [ibank.qiwi.ru] UI Redressing via Request-URI, resolved 164168, https://hackerone.com/reports/164168, [qiwi.com] Information Disclosure, resolved 164224, https://hackerone.com/reports/164224, Urgent: Server side template injection via Smarty template allows for RCE, resolved 164239, https://hackerone.com/reports/164239, NON VALIDATION OF SESSIONS AFTER PASSWORD CHANGE, duplicate 164419, https://hackerone.com/reports/164419, Non-secure requests are not automatically upgraded to HTTPS, informative 164483, https://hackerone.com/reports/164483, link reset problem, not-applicable 164515, https://hackerone.com/reports/164515, Project Manager can approve pending reports(Access control Issue), resolved 164520, https://hackerone.com/reports/164520, Reflected Self-XSS Vulnerability in the Comment section of Files (Different-payloads), duplicate 164546, https://hackerone.com/reports/164546, CSRF bypass on Submit Time sheet for Approval, resolved 164648, https://hackerone.com/reports/164648, Missing access control at password change, resolved 164656, https://hackerone.com/reports/164656, [contact-sys.com] XSS via Request-URI, resolved 164662, https://hackerone.com/reports/164662, [wallet.rapida.ru] XSS Cookie flashcookie, resolved 164674, https://hackerone.com/reports/164674, CSV Injection in Camptix, resolved 164684, https://hackerone.com/reports/164684, [lk.contact-sys.com] SQL Injection reset_password FP_LK_USER_LOGIN, resolved 164687, https://hackerone.com/reports/164687, Validation bypass on user profile, resolved 164704, https://hackerone.com/reports/164704, [contact-sys.com] XSS /ajax/transfer/status trn param, resolved 164821, https://hackerone.com/reports/164821, OX Guard: DOM Based Cross-Site Scripting (#2), resolved 164833, https://hackerone.com/reports/164833, Hyperlink Injection in Friend Invitation Emails, resolved 164895, https://hackerone.com/reports/164895, Open redirection protection bypass (/cs/Satellite), resolved 164922, https://hackerone.com/reports/164922, XSS found In Your Web, informative 164933, https://hackerone.com/reports/164933, [lk.contact-sys.com] LKlang Path Traversal, resolved 164945, https://hackerone.com/reports/164945, [contact-sys.com] SQL Injection████ limit param, resolved 165046, https://hackerone.com/reports/165046, Open redirect allows changing iframe content in *.myshopify.com/admin/themes//editor, resolved 165048, https://hackerone.com/reports/165048, Access to Splunk via shard3-db2.ec2.shopify.com endpoint, resolved 165131, https://hackerone.com/reports/165131, Seemingly sensitive information at /api/v2/zones, resolved 165154, https://hackerone.com/reports/165154, Additional information for CVE-2016-5699, resolved 165219, https://hackerone.com/reports/165219, [id.rapida.ru] Full Path Disclosure, resolved 165229, https://hackerone.com/reports/165229, Nextcloud 10.0 privilege escalation issue - Normal user can mask external storage shared by admin , resolved 165275, https://hackerone.com/reports/165275, OX (Guard): Stored Cross-Site Scripting via Email Attachment, resolved 165309, https://hackerone.com/reports/165309, Subdomain Takeover in http://genghis-cdn.shopify.io/ pointing to Fastly , resolved 165324, https://hackerone.com/reports/165324, XSS on expenses attachments, resolved 165353, https://hackerone.com/reports/165353, **minor issue ** -Nextcloud 10.0 session issue with desktop client and android client, resolved 165542, https://hackerone.com/reports/165542, clickjacking at http://mailboxes.legalrobot-uat.com/, not-applicable 165561, https://hackerone.com/reports/165561, Physical Access to Mobile App Allows Local Attribute Updates without Authentication, resolved 165686, https://hackerone.com/reports/165686, Reflected XSS in Gallery App, resolved 165727, https://hackerone.com/reports/165727, Rate-limit bypass, resolved 165854, https://hackerone.com/reports/165854, Bypassing Phone Verification For Posting AD On OLX, informative 165862, https://hackerone.com/reports/165862, Invoices can be added to any retainers - even closs-platform, resolved 165894, https://hackerone.com/reports/165894, User Enumeration. , informative 165923, https://hackerone.com/reports/165923, No csrf protection on logout, informative 165930, https://hackerone.com/reports/165930, PHP info page disclosure on http://www.day.dk/, resolved 165969, https://hackerone.com/reports/165969, The “Malstaller” Attack, global hijacking of any installation process to achieve RCE with elevated privileges, Windows OS (vendor agnostic) , resolved 166080, https://hackerone.com/reports/166080, null pointer dereference in set_conversion_mode due uncheck _ctypes_conversion_errors, resolved 166231, https://hackerone.com/reports/166231, CSRF Issue, informative 166265, https://hackerone.com/reports/166265, Verification of E-Mail address possible on https://biz.yelp.com/login and https://biz.yelp.com/forgot, resolved 166581, https://hackerone.com/reports/166581, Privilege escalation - Normal user can somehow make admin to delete shared folders, resolved 166661, https://hackerone.com/reports/166661, Arbitrary heap overread in strscan on 32 bit Ruby, patch included, resolved 166682, https://hackerone.com/reports/166682, Denial of Service through set_preference.json, resolved 166694, https://hackerone.com/reports/166694, xss in Theme http://bztfashion.booztx.com, resolved 166699, https://hackerone.com/reports/166699, Reflected xss on websummit.net, resolved 166709, https://hackerone.com/reports/166709, Self-XSS via location cookie city field when getting suggestions for a new location, informative 166712, https://hackerone.com/reports/166712, Android app does not use SSL for login, informative 166826, https://hackerone.com/reports/166826, Potential Subdomain Takeover Possible, resolved 166849, https://hackerone.com/reports/166849, IDOR(indirect object references) on add friend,complement and send message , not-applicable 166861, https://hackerone.com/reports/166861, AWS hosting bucket for Legal Robots set as public browse and list contents: s3://legalrobot, not-applicable 166887, https://hackerone.com/reports/166887, Unsanitized Location Name in POS Channel can lead to XSS in Orders Timeline, resolved 167036, https://hackerone.com/reports/167036, Ngnix Server version disclosure 404 Page!, informative 167041, https://hackerone.com/reports/167041, Server version disclosure, resolved 167075, https://hackerone.com/reports/167075, XSS in SHOPIFY: Unsanitized Supplier Name can lead to XSS in Transfers Timeline, resolved 167107, https://hackerone.com/reports/167107, XSS and Open Redirect on https://jobs.dubizzle.com/, resolved 167121, https://hackerone.com/reports/167121, Второй способ обхода 2FA, resolved 167321, https://hackerone.com/reports/167321, XSS, resolved 167380, https://hackerone.com/reports/167380, content spoofing, spam 167460, https://hackerone.com/reports/167460, Session Hijacking , resolved 167481, https://hackerone.com/reports/167481, Android - Possible to intercept broadcasts about uploaded files, resolved 167510, https://hackerone.com/reports/167510, CVE-2016-5157 OpenJPEG opj_dwt_interleave_v Out-of-Bounds Write Vulnerability, resolved 167512, https://hackerone.com/reports/167512, CVE-2016-7163 OpenJPEG opj_pi_create_decode Integer Overflow Vulnerability, resolved 167582, https://hackerone.com/reports/167582, Disclosure of private photos/albums - http://www.pornhub.com/album/show_image_box, resolved 167585, https://hackerone.com/reports/167585, Unsecured Grafana instance, resolved 167631, https://hackerone.com/reports/167631, Host header poisoning leads to account password reset links hijacking, duplicate 167688, https://hackerone.com/reports/167688, msilib.OpenDatabase Type Confusion, resolved 167698, https://hackerone.com/reports/167698, Broken Authentication and Session Management(Session Fixation), duplicate 167731, https://hackerone.com/reports/167731, Make victim buy in attacker's account without any idea - http://www.booztlet.com/, resolved 167809, https://hackerone.com/reports/167809, HOST HEADER INJECTION in rpm.newrelic.com , duplicate 167828, https://hackerone.com/reports/167828, Ability to enumerate private programs using SAML, resolved 167846, https://hackerone.com/reports/167846, Deleted Post and Administrative Function Access in eCommerce Forum, resolved 167859, https://hackerone.com/reports/167859, Base alpha version code exposure, resolved 167888, https://hackerone.com/reports/167888, Uninitialized Thumbail Data Leads To Memory Leakage in exif_process_IFD_in_TIFF, resolved 167895, https://hackerone.com/reports/167895, Out of bound when verify signature of zip phar in phar_parse_zipfile, resolved 167896, https://hackerone.com/reports/167896, Out of bound when verify signature of tar phar in phar_parse_tarfile, resolved 167901, https://hackerone.com/reports/167901, integer overflow in pg_escape_string caused heap corruption, resolved 167902, https://hackerone.com/reports/167902, integer overflow in php_ldap_do_escape caused heap corruption, resolved 167903, https://hackerone.com/reports/167903, integer overflow in str_pad caused heap corruption, resolved 167904, https://hackerone.com/reports/167904, heap overflow in substr_replace, resolved 167905, https://hackerone.com/reports/167905, integer overflow in pg_escape_bytea caused heap corruption, resolved 167906, https://hackerone.com/reports/167906, integer overflow in imap_binary caused heap corruption, resolved 167907, https://hackerone.com/reports/167907, integer overflow in preg_quote caused heap corruption, resolved 167908, https://hackerone.com/reports/167908, integer overflow in fgets cause heap corruption, resolved 167909, https://hackerone.com/reports/167909, integer overflow in recode_string caused heap corruption, resolved 167910, https://hackerone.com/reports/167910, memory corruption in wordwrap function, resolved 167911, https://hackerone.com/reports/167911, integer overflow in fgetcsv caused heap corruption, resolved 167921, https://hackerone.com/reports/167921, integer overflow in xml_utf8_encode, resolved 167931, https://hackerone.com/reports/167931, Memory Corruption in During Deserialized-object Destruction, resolved 167947, https://hackerone.com/reports/167947, CVE-2016-3183 OpenJPEG sycc422_to_rgb Out-of-Bounds Read Vulnerability, resolved 167953, https://hackerone.com/reports/167953, CVE-2016-3182 OpenJPEG color_esycc_to_rgb Out-of-Bounds Read Vulnerability, resolved 167955, https://hackerone.com/reports/167955, CVE-2016-4796 OpenJPEG color_cmyk_to_rgb Out-of-Bounds Read Vulnerability, resolved 167957, https://hackerone.com/reports/167957, CVE-2016-1924 OpenJPEG opj_tgt_reset Out-of-Bounds Read Vulnerability, resolved 167977, https://hackerone.com/reports/167977, Missing type check when unserializing SplArray, resolved 168027, https://hackerone.com/reports/168027, gzdecode does NOT check output string size which leads to an overflow, resolved 168028, https://hackerone.com/reports/168028, gzuncompress does NOT check output string size which leads to an overflow, resolved 168029, https://hackerone.com/reports/168029, ldap_escape could produce string larger than 2Gb, resolved 168078, https://hackerone.com/reports/168078, Content Spoofing possible in concrete5.org, resolved 168108, https://hackerone.com/reports/168108, SSO Authentication Bypass, resolved 168116, https://hackerone.com/reports/168116, Insufficient validation on Digits bridge, resolved 168223, https://hackerone.com/reports/168223, User Information sent to client through websockets, informative 168254, https://hackerone.com/reports/168254, Http header injection, duplicate 168289, https://hackerone.com/reports/168289, coinbase Email leak while sending and requesting, informative 168293, https://hackerone.com/reports/168293, Not clearing hex-decoded variable after usage in Authentication, informative 168358, https://hackerone.com/reports/168358, Clickjacking: X-Frame Header Missing, informative 168453, https://hackerone.com/reports/168453, Users can falsely declare their own Uber account info on the monthly billing application, resolved 168458, https://hackerone.com/reports/168458, Stored XSS in https://productreviews.shopifyapps.com/proxy/v4/reviews/product, resolved 168476, https://hackerone.com/reports/168476, Incoming email hijacking on sc-cdn.net, resolved 168485, https://hackerone.com/reports/168485, Exposed, outdated nginx server (v1.4.6) potentially vulnerable to heap-based buffer overflow & RCE, resolved 168509, https://hackerone.com/reports/168509, Information leakage on https://docs.gdax.com, resolved 168538, https://hackerone.com/reports/168538, Twitter iOS fails to validate server certificate and sends oauth token, resolved 168574, https://hackerone.com/reports/168574, CORS Misconfiguration on www.zomato.com, resolved 169625, https://hackerone.com/reports/169625, Stored XSS in buy topup OLX Gold Credits , resolved 169680, https://hackerone.com/reports/169680, Bypass permissions, resolved 169699, https://hackerone.com/reports/169699, CSRF in the "Add restaurant picture" function, resolved 169704, https://hackerone.com/reports/169704, DNSSEC misconfiguration, informative 169751, https://hackerone.com/reports/169751, Stored XSS in albums on http://m.imgur.com/, resolved 169759, https://hackerone.com/reports/169759, Open redirect in bulk edit, resolved 169992, https://hackerone.com/reports/169992, Email information leakage for certain addresses, resolved 170052, https://hackerone.com/reports/170052, AWS Signature Disclosure in www.digitalsellz.com allows access to S3, resolved 170138, https://hackerone.com/reports/170138, SEH buffer overflow msgfmt_format_message, resolved 170144, https://hackerone.com/reports/170144, wddx_deserialize use-after-free, resolved 170149, https://hackerone.com/reports/170149, Time-based sql-injection на https://puzzle.mail.ru, resolved 170156, https://hackerone.com/reports/170156, Reflected XSS in Step 2 of the Installation, resolved 170161, https://hackerone.com/reports/170161, Password reset token not expiring, resolved 170241, https://hackerone.com/reports/170241, Stored Xss in rpm.newrelic.com, resolved 170260, https://hackerone.com/reports/170260, imap_rfc822_parse_headers GS Violation, resolved 170295, https://hackerone.com/reports/170295, Access to Amazon S3 bucket, duplicate 170333, https://hackerone.com/reports/170333, Host Header Injection/Redirection, duplicate 170369, https://hackerone.com/reports/170369, [kb.informatica.com] Stored XSS, resolved 170398, https://hackerone.com/reports/170398, ADB Backup is enabled within AndroidManifest, duplicate 170532, https://hackerone.com/reports/170532, Oracle Webcenter Sites administrative and hi-privilege access available directly from the internet (/cs/Satellite), resolved 170548, https://hackerone.com/reports/170548, Ruby OpenSSL Library - IV Reuse in GCM Mode, resolved 170552, https://hackerone.com/reports/170552, Slack integration setup lacks CSRF protection, resolved 170618, https://hackerone.com/reports/170618, CVE-2016-7418 PHP Out-Of-Bounds Read in php_wddx_push_element, resolved 170619, https://hackerone.com/reports/170619, PHP Integer Overflow in gdImageWebpCtx, resolved 170748, https://hackerone.com/reports/170748, RCE,SQL,Vulnerability + Exploit Method., not-applicable 170894, https://hackerone.com/reports/170894, Facebook and twitter page claimed of maximum.com [important], resolved 171048, https://hackerone.com/reports/171048, Full path disclosure vulnerability at http://corporate.olx.ph, resolved 171130, https://hackerone.com/reports/171130, Missing function level access controls allowing attacker to abuse file access controls. Multiple vulnerabilities, informative 171205, https://hackerone.com/reports/171205, No rate limit for Referral Program, resolved 171272, https://hackerone.com/reports/171272, Accessable Htaccess, resolved 171337, https://hackerone.com/reports/171337, Near-duplicate accounts allowed with ignored email mutations, resolved 171398, https://hackerone.com/reports/171398, (HackerOne SSO-SAML) Login CSRF, Open Redirect, and Self-XSS Possible Exploitation, resolved 171473, https://hackerone.com/reports/171473, HTTP Response Splitting(CRLF injection) in bi.owox.com, resolved 171497, https://hackerone.com/reports/171497, Content spoofing in lookup.nextcloud.com, resolved 171593, https://hackerone.com/reports/171593, Malicious Server can force read any file on clients system with default configuration in MySQL Clients, resolved 171670, https://hackerone.com/reports/171670, Link sanitation bypass in xss_clean() , resolved 171879, https://hackerone.com/reports/171879, Cloudflare issue: Error 521 Ray ID: 2e7ea7f706ea4056 • 2016-09-25 12:59:55 UTC Web server is down, informative 171917, https://hackerone.com/reports/171917, Name, email, phone and more disclosure on user ID (API), resolved 172115, https://hackerone.com/reports/172115, Multiple use after frees in obj2ast_* methods, resolved 172137, https://hackerone.com/reports/172137, Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com, duplicate 172289, https://hackerone.com/reports/172289, HackerOne Integrations Design Issue, resolved 172296, https://hackerone.com/reports/172296, Information Disclosure on rate limit defense mechanism, resolved 172403, https://hackerone.com/reports/172403, Python 2.7 32-bit JSON encoding heap corruption, resolved 172411, https://hackerone.com/reports/172411, Heap overflow caused by type confusion vulnerability in merge_param(), resolved 172545, https://hackerone.com/reports/172545, IDOR - Ability to view unlisted products, resolved 172549, https://hackerone.com/reports/172549, Possible Blind Writing to S3 Bucket, resolved 172562, https://hackerone.com/reports/172562, LZMADecompressor.decompress Use After Free, resolved 172574, https://hackerone.com/reports/172574, Follow Button XSS, resolved 172606, https://hackerone.com/reports/172606, Google Authenticator - Cross Site Scripting, not-applicable 172609, https://hackerone.com/reports/172609, Google Authenticator0.6 - PHP Version Dosclosure, not-applicable 172618, https://hackerone.com/reports/172618, All Plugins - Direct file access to plugin files Vulnerability, duplicate 172694, https://hackerone.com/reports/172694, Critical : Malware and XSS file can be uploaded and executed on udemy, informative 172698, https://hackerone.com/reports/172698, Subdomain take over signup.websummit, resolved 172707, https://hackerone.com/reports/172707, Udemy s3 storage can be used by an attacker personal website because of missing CSRF Token, informative 172711, https://hackerone.com/reports/172711, Content Spoofing in udemy, resolved 172733, https://hackerone.com/reports/172733, Add signature to transactions without any permission, resolved 172746, https://hackerone.com/reports/172746, WebSummit - Open Redirect , resolved 172780, https://hackerone.com/reports/172780, out of date disqus shortname usage in the web app source code, resolved 172809, https://hackerone.com/reports/172809, Flash XSS on global nav, resolved 172821, https://hackerone.com/reports/172821, Flash XSS on homepage fliptilescroller, resolved 172837, https://hackerone.com/reports/172837, password less login token expiration issue, resolved 172843, https://hackerone.com/reports/172843, DOM based reflected XSS in rockstargames.com/newswire/tags through cross domain ajax request, resolved 172933, https://hackerone.com/reports/172933, IDNs displayed in unicode in messages/about/talk sections (Homograph Attack), resolved 173043, https://hackerone.com/reports/173043, Bypassing "You've requested your data the maximum number of times today." + "Please Verify an email address with snapchat to continue" , resolved 173175, https://hackerone.com/reports/173175, Obtain the username & the uid of the one doing the S3 sync on Hackerone, resolved 173195, https://hackerone.com/reports/173195, Bypass 8 chars password complexity with 6 chars only due to insecure password reset functionaliy, resolved 173251, https://hackerone.com/reports/173251, Password Reset emails missing TLS leads account takeover, resolved 173268, https://hackerone.com/reports/173268, Login credentials transmitted in cleartext on index.rubygems.org, resolved 173412, https://hackerone.com/reports/173412, Full Sub Domain Takeover at s3.websummit.net, resolved 173417, https://hackerone.com/reports/173417, Possilbe Sub Domain takever at prestashop.algolia.com, resolved 173501, https://hackerone.com/reports/173501, Stored XSS on Admin Access Page - Email field, resolved 173551, https://hackerone.com/reports/173551, password reset token leaking allowed for ATO of an Uber account, resolved 173622, https://hackerone.com/reports/173622, Bypassing quota limit , resolved 173681, https://hackerone.com/reports/173681, [CRITICAL]-Taking over entire subdomain of romit.io, resolved 173721, https://hackerone.com/reports/173721, Bad content-type in response header when getting document can lead to html injection, resolved 173811, https://hackerone.com/reports/173811, Git available containing passwords. , resolved 173972, https://hackerone.com/reports/173972, web.xml configuration file disclosure, resolved 174069, https://hackerone.com/reports/174069, Buffer overflow in HTTP parse_hostinfo(), parse_userinfo() and parse_scheme(), resolved 174228, https://hackerone.com/reports/174228, CSRF csrftoken in cookies, informative 174395, https://hackerone.com/reports/174395, Full Sub Domain Takeover at wx.zopim.net, resolved 174404, https://hackerone.com/reports/174404, private passenger information is exposed to the Uber Driver app during ride dispatch ("Ping") events, resolved 174449, https://hackerone.com/reports/174449, Researcher gets email updates on a private program after he/she quits that program., resolved 174470, https://hackerone.com/reports/174470, Possible CSRF during external programs, resolved 174474, https://hackerone.com/reports/174474, Cookie Injection at 'harvestapp.com', resolved 174524, https://hackerone.com/reports/174524, Filename enumeration && DoS, resolved 174632, https://hackerone.com/reports/174632, Information disclosure in mmap module - python 2.7.12, resolved 174645, https://hackerone.com/reports/174645, Existence of Folder path by guessing the path through response, resolved 174668, https://hackerone.com/reports/174668, No rate-limit in SERVER_SECURITY_CHECK, resolved 174721, https://hackerone.com/reports/174721, View liked twits of private account via publish.twitter.com, resolved 174871, https://hackerone.com/reports/174871, Linking Invoice to uninvited project., resolved 174882, https://hackerone.com/reports/174882, Requesting Show CheckIn Alert for Non Friend User, resolved 174896, https://hackerone.com/reports/174896, Dav sharing permissions issue, resolved 174909, https://hackerone.com/reports/174909, Reflected Cross site scripting, informative 175061, https://hackerone.com/reports/175061, Information Disclosure on stun.screenhero.com, resolved 175070, https://hackerone.com/reports/175070, Subdomain takeover on rider.uber.com due to non-existent distribution on Cloudfront, resolved 175085, https://hackerone.com/reports/175085, URI scheme bypass in mail app lead to HTML content spoof and opener control, resolved 175091, https://hackerone.com/reports/175091, chain.__setstate__ Type Confusion, resolved 175122, https://hackerone.com/reports/175122, Public profile is vulnerable to stored XSS / Facebook Token can be stolen, resolved 175230, https://hackerone.com/reports/175230, Double-free in X509 parsing, resolved 175260, https://hackerone.com/reports/175260, missing NULL check in dom_document_save_html, resolved 175262, https://hackerone.com/reports/175262, NULL pointer dereference in SimpleXMLElement::asXML(), resolved 175263, https://hackerone.com/reports/175263, crash in openssl_random_pseudo_bytes function, resolved 175264, https://hackerone.com/reports/175264, heap overflow in php_ereg_replace function, resolved 175286, https://hackerone.com/reports/175286, Homograph attack, resolved 175310, https://hackerone.com/reports/175310, Write out-of-bounds at number_format, resolved 175311, https://hackerone.com/reports/175311, memcpy negative size parameter in php_resolve_path, resolved 175312, https://hackerone.com/reports/175312, memcpy negative parameter _bc_new_num_ex, resolved 175315, https://hackerone.com/reports/175315, Illegal write access through Locale methods, resolved 175316, https://hackerone.com/reports/175316, stack-buffer-overflow through "ResourceBundle" methods, resolved 175320, https://hackerone.com/reports/175320, 2 Directory Listing on ledger.brave.com & vault-staging.brave.com, resolved 175366, https://hackerone.com/reports/175366, Brave: Admin Panel Access, informative 175397, https://hackerone.com/reports/175397, Subdomain Takeover of Brave.com, duplicate 175403, https://hackerone.com/reports/175403, [website] Script injection in newsletter signup https://brave.com/brave_youth_program_signup.html, resolved 175410, https://hackerone.com/reports/175410, Reflected XSS at m.olx.ph, resolved 175451, https://hackerone.com/reports/175451, Full Path Disclosure at 27.prd.vine.co, resolved 175529, https://hackerone.com/reports/175529, URI Obfuscation, resolved 175587, https://hackerone.com/reports/175587, Stack Buffer Overflow in GD dynamicGetbuf, resolved 175701, https://hackerone.com/reports/175701, Status Bar Obfuscation, resolved 175760, https://hackerone.com/reports/175760, Directory Listing of all the resource files of olx.com.eg , resolved 175766, https://hackerone.com/reports/175766, Remote client memory corruption in ssl_add_clienthello_tlsext(), resolved 175779, https://hackerone.com/reports/175779, Address Bar Spoofing - Already resolved - Retroactive report, resolved 175801, https://hackerone.com/reports/175801, Reflected XSS in OLX.in, resolved 175958, https://hackerone.com/reports/175958, [iOS/Android] Address Bar Spoofing Vulnerability , resolved 175982, https://hackerone.com/reports/175982, Use-after-free in unserialize(), resolved 176002, https://hackerone.com/reports/176002, Information disclosure of user by email using buy widget, resolved 176013, https://hackerone.com/reports/176013, Disclosure of sensitive information through Google Cloud Storage bucket, resolved 176042, https://hackerone.com/reports/176042, Error Page Text Injection, informative 176065, https://hackerone.com/reports/176065, [Android] HTML Injection in BatterySaveArticleRenderer WebView, resolved 176066, https://hackerone.com/reports/176066, Denial of service attack on Brave Browser., resolved 176083, https://hackerone.com/reports/176083, JavaScript URL Issues in the latest version of Brave Browser, informative 176116, https://hackerone.com/reports/176116, Weak Forgot Password implementation, resolved 176127, https://hackerone.com/reports/176127, race condition in adding team members, resolved 176159, https://hackerone.com/reports/176159, [iOS] URI Obfuscation in iOS application, informative 176197, https://hackerone.com/reports/176197, Denial of service attack(window object) on brave browser, resolved 176226, https://hackerone.com/reports/176226, CachingIterator null dereference when convert to string, resolved 176279, https://hackerone.com/reports/176279, Heap overflow in mysqlnd related to BIT fields (CVE-2016-7412), resolved 176308, https://hackerone.com/reports/176308, Wordpress.com REST API oauth bypass via Cross Site Flashing, resolved 176364, https://hackerone.com/reports/176364, DOS in browser using window.print() function, informative 176477, https://hackerone.com/reports/176477, XSS (Reflected), informative 176494, https://hackerone.com/reports/176494, Hyperlink Injection on adding active users, informative 176599, https://hackerone.com/reports/176599, No CAPTCHA ia exist in pages, informative 176698, https://hackerone.com/reports/176698, Reflective XSS, resolved 176754, https://hackerone.com/reports/176754, Cross-site scripting (reflected), resolved 176899, https://hackerone.com/reports/176899, Editing a project (LIMITED), resolved 176929, https://hackerone.com/reports/176929, [ios] Address bar spoofing in Brave for iOS, resolved 176979, https://hackerone.com/reports/176979, Authentication Issue, resolved 177184, https://hackerone.com/reports/177184, invalid homepage URL causes 'uncaught typeerror' or blank state, resolved 177225, https://hackerone.com/reports/177225, Email Server Compromised at secure.lahitapiola.fi, resolved 177230, https://hackerone.com/reports/177230, Reflective XSS at m.olx.ph, resolved 177335, https://hackerone.com/reports/177335, Content spoofing due to the improper behavior of the 403 page in Private Server, resolved 177472, https://hackerone.com/reports/177472, CSRF: add item to victim's cart automatically (starbucks.com - updatecart), resolved 177484, https://hackerone.com/reports/177484, Information disclosure via policy update notifications after removal from program, resolved 177485, https://hackerone.com/reports/177485, Open Redirect , resolved 177508, https://hackerone.com/reports/177508, Reflected XSS by exploiting CSRF vulnerability on teavana.com wishlist comment module. (wishlist-comments), resolved 177523, https://hackerone.com/reports/177523, Lahitapiola´s customer names send to 3rd party, resolved 177551, https://hackerone.com/reports/177551, SMS/Call spamming due to truncated phone number, resolved 177619, https://hackerone.com/reports/177619, Reflective XSS at dubai.dubizzle.com, resolved 177624, https://hackerone.com/reports/177624, Unvalidated redirect on team.badoo.com, resolved 177635, https://hackerone.com/reports/177635, CSRF vulnerability in saving payment card on store.starbucks.com (COBilling -AddCreditCard), resolved 177639, https://hackerone.com/reports/177639, CSRF exploit | Adding/Editing comment of wishlist items (teavana.com - Wishlist-Comments), resolved 177713, https://hackerone.com/reports/177713, xss on demo.nextcloud.com due to outdated version, resolved 177757, https://hackerone.com/reports/177757, Stored XSS in Restoring Archived Tasks, resolved 177943, https://hackerone.com/reports/177943, Reflective XSS, resolved 178049, https://hackerone.com/reports/178049, Раскрытие баланса на //kopilka.qiwi.com, resolved 178057, https://hackerone.com/reports/178057, [ipm.informatica.com] Sql injection Oracle , resolved 178094, https://hackerone.com/reports/178094, php_snmp_parse_oid integer overflow in memory allocation, resolved 178144, https://hackerone.com/reports/178144, imagecropauto out-of-bounds access, resolved 178184, https://hackerone.com/reports/178184, SSRF in https://cards-dev.twitter.com/validator, resolved 178241, https://hackerone.com/reports/178241, [allods.mail.ru] Cross-Site Request Forgery (Add-Item), resolved 178253, https://hackerone.com/reports/178253, [pokerist.mail.ru] XSS Request-URI, resolved 178278, https://hackerone.com/reports/178278, [parc.informatica.com] Reflected Cross Site Scripting and Open Redirect, resolved 178279, https://hackerone.com/reports/178279, [hs.mail.ru] CRLF Injection / XSS, resolved 178281, https://hackerone.com/reports/178281, [hs.mail.ru] XSS play_now.php, resolved 178284, https://hackerone.com/reports/178284, [vitrina.contact-sys.com] Full Path Disclosure, resolved 178293, https://hackerone.com/reports/178293, Misconfiguration in Two Factor Authorisation, resolved 178345, https://hackerone.com/reports/178345, Limited Open redirection using SSO-SAML, resolved 178384, https://hackerone.com/reports/178384, CSRF in delete advertisement on olx.com.eg, resolved 178409, https://hackerone.com/reports/178409, Possible Subdomain Takeover at http://production.s3.rubygems.org/ pointing to Fastly , resolved 178503, https://hackerone.com/reports/178503, ability to retrieve a user's phone-number/email for a given inviteCode, resolved 178506, https://hackerone.com/reports/178506, Access private list metadata, resolved 178537, https://hackerone.com/reports/178537, Potential sub-domain hijacking, resolved 178567, https://hackerone.com/reports/178567, Arbitrary modification value "session" (Cookie) in badoo.com, resolved 178611, https://hackerone.com/reports/178611, Reflected XSS on Zones > Invocation Code, resolved 178632, https://hackerone.com/reports/178632, [afocusp.informatica.com] Sql injection afocusp.informatica.com:37777, resolved 178742, https://hackerone.com/reports/178742, Leave inaccessible messaging system with a message (https://us1.badoo.com), resolved 178831, https://hackerone.com/reports/178831, CSRF on signup endpoint (auto-api.yelp.com), resolved 178990, https://hackerone.com/reports/178990, The websocket traffic is not secure enough, informative 179021, https://hackerone.com/reports/179021, Possible content spoofing due to missing error page, informative 179034, https://hackerone.com/reports/179034, [Airship CMS] Local File Inclusion - RST Parser, resolved 179073, https://hackerone.com/reports/179073, Content Spoofing in "files" app, resolved 179103, https://hackerone.com/reports/179103, Unauthenticated Docker registry, resolved 179121, https://hackerone.com/reports/179121, Information disclosure of website, informative 179164, https://hackerone.com/reports/179164, Stored XSS in community.ubnt.com, resolved 179217, https://hackerone.com/reports/179217, server version dislosure, resolved 179248, https://hackerone.com/reports/179248, Denial of service(POP UP Recursion) on Brave browser, duplicate 179421, https://hackerone.com/reports/179421, Новый 2FA Bypass, resolved 179426, https://hackerone.com/reports/179426, Reflected XSS on blockchain.info, resolved 179559, https://hackerone.com/reports/179559, Stored XSS in Template Documents, resolved 179568, https://hackerone.com/reports/179568, Tab nabbing via window.opener, resolved 179599, https://hackerone.com/reports/179599, Information disclosure at https://blockchain.atlassian.net, resolved 179695, https://hackerone.com/reports/179695, XSS via unicode characters in upload filename, resolved 179701, https://hackerone.com/reports/179701, username enumeration , informative 179732, https://hackerone.com/reports/179732, [Yelp Blog] Backslash in search string causes JS error, informative 179826, https://hackerone.com/reports/179826, Flash XSS on Buick_RotatingMasthead_JellyBeanSlider.swf, resolved 179839, https://hackerone.com/reports/179839, ClickJacking , duplicate 179920, https://hackerone.com/reports/179920, WordPress DB Class, bad implementation of prepare method guides to sqli and information disclosure, resolved 179986, https://hackerone.com/reports/179986, Exposed API-key allows to control nightly builds of firmwares (█████████ & ████████), resolved 180037, https://hackerone.com/reports/180037, Selecting encryption for email with drive attachment overrides the drive email password, resolved 180109, https://hackerone.com/reports/180109, crash in gzcompress and 3 other compress functions, resolved 180110, https://hackerone.com/reports/180110, crash in implode() function, resolved 180111, https://hackerone.com/reports/180111, crash in bzcompress function, resolved 180112, https://hackerone.com/reports/180112, iconv() function missing string length check, resolved 180113, https://hackerone.com/reports/180113, crash in get_icu_value_internal function, resolved 180115, https://hackerone.com/reports/180115, crash in locale_get_keywords() when keyword value in locale string too long, resolved 180116, https://hackerone.com/reports/180116, another crash in locale_get_keywords function, resolved 180196, https://hackerone.com/reports/180196, Host header Injection rubygems.org, not-applicable 180253, https://hackerone.com/reports/180253, Reflected Cross-Site Scripting due to vulnerable Flash component (Flashmediaelement.swf), resolved 180346, https://hackerone.com/reports/180346, Nginx server version disclosure on engineeringblog, informative 180349, https://hackerone.com/reports/180349, Android SDK - CREATE_REQUEST broascast is unprotected, resolved 180393, https://hackerone.com/reports/180393, Subdomain Takeover, not-applicable 180397, https://hackerone.com/reports/180397, Cookie Misconfiguration, duplicate 180434, https://hackerone.com/reports/180434, cURL / libcURL - CVE-2016-8624 invalid URL parsing with '#', resolved 180527, https://hackerone.com/reports/180527, SSRF (open) - via GET request, resolved 180538, https://hackerone.com/reports/180538, X.509 certificate validation fails on international vanity domains, resolved 180548, https://hackerone.com/reports/180548, Missing restriction on string size in profile fields, resolved 180559, https://hackerone.com/reports/180559, Content spoofing on yelp.onelogin, informative 180562, https://hackerone.com/reports/180562, Memory corruption in _php_math_number_format_ex(), resolved 180563, https://hackerone.com/reports/180563, Heap overflow due to integer overflow in bzdecompress() function, resolved 180572, https://hackerone.com/reports/180572, Memory corruption due to missing check size in _php_math_number_format_ex(), resolved 180582, https://hackerone.com/reports/180582, Heap overflow due to integer overflow in php_escape_html_entities_ex() function, resolved 180584, https://hackerone.com/reports/180584, Heap overflow due to integer overflow in pg_escape_string() function, resolved 180588, https://hackerone.com/reports/180588, Invalid memory access in zend_strtod() function, resolved 180589, https://hackerone.com/reports/180589, crash in simplestring_addn function, resolved 180590, https://hackerone.com/reports/180590, Invalid memory access in spl_filesystem_dir_open function, resolved 180591, https://hackerone.com/reports/180591, Invalid memory access in php_basename function, resolved 180592, https://hackerone.com/reports/180592, Invalid memory access in spl_filesystem_info_set_filename function, resolved 180695, https://hackerone.com/reports/180695, ruby DoS https://www.mruby.science, resolved 180814, https://hackerone.com/reports/180814, crash in locale_compose() function, resolved 180895, https://hackerone.com/reports/180895, Password reset access control, resolved 180908, https://hackerone.com/reports/180908, NULL Pointer Dereference in WDDX Packet Deserialization with PDORow, resolved 180909, https://hackerone.com/reports/180909, Use-after-free in ArrayObject Deserialization, resolved 180977, https://hackerone.com/reports/180977, Exception cause SIGABRT, resolved 181061, https://hackerone.com/reports/181061, Remote Stack Overflow Vulnerability (DoS), duplicate 181073, https://hackerone.com/reports/181073, malloc negative size parameter, resolved 181088, https://hackerone.com/reports/181088, Window.opener bug at www.coinbase.com, resolved 181210, https://hackerone.com/reports/181210, Incorrect detection of onion URLs, resolved 181212, https://hackerone.com/reports/181212, Missing GIT tag/commit verification in Docker, informative 181214, https://hackerone.com/reports/181214, Using plain git protocol (vulnerable to MITM), informative 181225, https://hackerone.com/reports/181225, Missing rel=noopener noreferrer in target=_blank links (Phishing attack), resolved 181232, https://hackerone.com/reports/181232, Denial of Service in mruby due to null pointer dereference, resolved 181315, https://hackerone.com/reports/181315, Not using Binary::safe* functions for substr/strlen function, resolved 181319, https://hackerone.com/reports/181319, Memory disclosure in mruby String#lines method, resolved 181321, https://hackerone.com/reports/181321, Use after free vulnerability in mruby Array#to_h causing DOS possible RCE, resolved 181528, https://hackerone.com/reports/181528, Cross site scripting in a subdomain of newrelic.com, resolved 181558, https://hackerone.com/reports/181558, [DOS] denial of service using code snippet on brave browser, resolved 181642, https://hackerone.com/reports/181642, libtiff 4.0.6 heap bufer overflow / out of bounds read (CVE-2016-9273), resolved 181665, https://hackerone.com/reports/181665, Subdomain Takeover (moderator.ubnt.com), resolved 181677, https://hackerone.com/reports/181677, NULL pointer dereference when parsing ternary operators, resolved 181685, https://hackerone.com/reports/181685, Range#initialize_copy null pointer dereference, resolved 181686, https://hackerone.com/reports/181686, [DOS] Browser hangs on loading the code snippet, resolved 181695, https://hackerone.com/reports/181695, Undefined method_missing null pointer dereference, resolved 181748, https://hackerone.com/reports/181748, [IDOR][translate.twitter.com] Opportunity to change any comment at the forum, resolved 181816, https://hackerone.com/reports/181816, [marketplace.informatica.com] Persistent XSS through document title, resolved 181823, https://hackerone.com/reports/181823, Stored XSS в личных сообщениях, resolved 181828, https://hackerone.com/reports/181828, Segfault in mruby, mruby_engine and the parent MRI Ruby due to null pointer dereference, resolved 181849, https://hackerone.com/reports/181849, Jenkins, resolved 181871, https://hackerone.com/reports/181871, DoS: type confusion in mrb_no_method_error, resolved 181874, https://hackerone.com/reports/181874, SIGSEGV when invalid argument on remove_method, resolved 181879, https://hackerone.com/reports/181879, Struct type confusion RCE, resolved 181893, https://hackerone.com/reports/181893, TOCTTOU bug in mrb_str_setbyte leading the memory corruption, resolved 181910, https://hackerone.com/reports/181910, Range constructor type confusion DoS, resolved 181939, https://hackerone.com/reports/181939, [qpt.mail.ru] CRLF Injection / Open Redirect, resolved 181955, https://hackerone.com/reports/181955, Stored xss in ALBUM DESCRIPTION , resolved 182008, https://hackerone.com/reports/182008, Spoof Email with Hyperlink Injection via Invites functionality, resolved 182017, https://hackerone.com/reports/182017, htaccess file is accesible, resolved 182027, https://hackerone.com/reports/182027, SIGSEV on mrb_ary_splice, resolved 182033, https://hackerone.com/reports/182033, Reflected Xss on , resolved 182046, https://hackerone.com/reports/182046, Nginx server version disclosure, resolved 182089, https://hackerone.com/reports/182089, Spam Some one using (user.saveInvite) system, resolved 182132, https://hackerone.com/reports/182132, Reflected cross-site scripting (XSS) vulnerability in pornhub.com allows attackers to inject arbitrary web script or HTML., resolved 182140, https://hackerone.com/reports/182140, libtiff 4.0.6 segfault / read outside of buffer (CVE-2016-9297), resolved 182169, https://hackerone.com/reports/182169, Type confusion in FutureIter_throw() which may potentially lead to an arbitrary code execution, resolved 182234, https://hackerone.com/reports/182234, Unsecured Grafana instance, resolved 182267, https://hackerone.com/reports/182267, Password Forgot/Password Reset Request Bug, resolved 182274, https://hackerone.com/reports/182274, Null pointer dereference due to TOCTTOU bug in mrb_time_initialize, resolved 182414, https://hackerone.com/reports/182414, Stored XSS on BillingCountry parameter, resolved 182420, https://hackerone.com/reports/182420, Illegal write/read access caused by gdImageAALine overflow, resolved 182467, https://hackerone.com/reports/182467, Email Spoofing, resolved 182474, https://hackerone.com/reports/182474, Use After Free in PHP7 unserialize(), resolved 182484, https://hackerone.com/reports/182484, Broken handling of maximum number of method call arguments leads to segfault, resolved 182487, https://hackerone.com/reports/182487, CSRF Token Bypass in Account Deletion, resolved 182530, https://hackerone.com/reports/182530, Bypass the resend limit in Send Invites, resolved 182557, https://hackerone.com/reports/182557, links the user may download can be a malicious files, informative 182576, https://hackerone.com/reports/182576, Subdomain Takeover on http://kiosk.owox.com/, resolved 182637, https://hackerone.com/reports/182637, Administrator Access To Management Console, resolved 182670, https://hackerone.com/reports/182670, Email link poisoning / Host header attack, resolved 183127, https://hackerone.com/reports/183127, ClickJacking, duplicate 183231, https://hackerone.com/reports/183231, SIGSEGV on mruby mrb_str_modify() (Invalid memory access), resolved 183239, https://hackerone.com/reports/183239, SIGSEGV on mruby's mark_tbl() (Invalid memory access), resolved 183245, https://hackerone.com/reports/183245, Nginx version disclosure via response header, resolved 183318, https://hackerone.com/reports/183318, Direct IP Access, not-applicable 183352, https://hackerone.com/reports/183352, Возможность провести DoS атаку от имени vk.com сервера, resolved 183356, https://hackerone.com/reports/183356, Segfault and/or potential unwanted (byte)code execution with "break" and "||=" inside a loop, resolved 183405, https://hackerone.com/reports/183405, Null target_class DoS, resolved 183425, https://hackerone.com/reports/183425, Segmentation fault when a Ruby method is invoked by a C method via Object#send, resolved 183458, https://hackerone.com/reports/183458, Command injection in the process of downloading the latest version of the cloud key firmware through the unifi management software., resolved 183568, https://hackerone.com/reports/183568, [Buddypress] Arbitrary File Deletion through bp_avatar_set, resolved 183577, https://hackerone.com/reports/183577, Sub domain issues., resolved 183624, https://hackerone.com/reports/183624, Race Condition Vulnerability On Pornhubpremium.com, resolved 183667, https://hackerone.com/reports/183667, Null pointer dereference in ary_concat, duplicate 183696, https://hackerone.com/reports/183696, Invalid memory access while freeing memory, caused by invalid type passed to mrb_ary_unshift, duplicate 183835, https://hackerone.com/reports/183835, Reflected XSS vulnerability on a DoD website, resolved 183844, https://hackerone.com/reports/183844, Reflected XSS on a DoD website, resolved 183854, https://hackerone.com/reports/183854, Reflective XSS vulnerability on a DoD website, resolved 183855, https://hackerone.com/reports/183855, Reflected XSS on a Department of Defense website, resolved 183871, https://hackerone.com/reports/183871, Reflected XSS on a DoD website, resolved 183878, https://hackerone.com/reports/183878, Reflected XSS on a Navy website, resolved 183925, https://hackerone.com/reports/183925, Unrestricted File Download / Path Traversal, resolved 183971, https://hackerone.com/reports/183971, Stored cross-site scripting (XSS) on a DoD website, resolved 183978, https://hackerone.com/reports/183978, Local File Inclusion vulnerability on an Army system allows downloading local files, resolved 184042, https://hackerone.com/reports/184042, Reflected cross-site scripting vulnerability on a DoD website, resolved 184057, https://hackerone.com/reports/184057, Read Application Name , Subscribers Count , resolved 184076, https://hackerone.com/reports/184076, Information disclosure on a DoD website, resolved 184125, https://hackerone.com/reports/184125, Reflected XSS vulnerability on a DoD website, resolved 184199, https://hackerone.com/reports/184199, Reflected XSS on an Army website, resolved 184200, https://hackerone.com/reports/184200, Reflected XSS on a DoD website, resolved 184279, https://hackerone.com/reports/184279, RCE on a Department of Defense website, resolved 184286, https://hackerone.com/reports/184286, Reflected XSS on a Department of Defense website, resolved 184472, https://hackerone.com/reports/184472, http://████/data.json showing users sensitive information via json file, informative 184495, https://hackerone.com/reports/184495, Cross-site scripting (XSS) vulnerability on a DoD website, resolved 184558, https://hackerone.com/reports/184558, Information disclosure vulnerability on a DoD website, resolved 184575, https://hackerone.com/reports/184575, Cross-site scripting vulnerability on a DoD website, resolved 184596, https://hackerone.com/reports/184596, Unrestricted File Upload, resolved 184661, https://hackerone.com/reports/184661, mruby-time: Crash host with uninitialized Time obj, resolved 184698, https://hackerone.com/reports/184698, Eavesdropping on private Slack calls, resolved 184712, https://hackerone.com/reports/184712, Denial of service due to invalid memory access in mrb_ary_concat, resolved 184715, https://hackerone.com/reports/184715, Read after free in mrb_vm_exec with OP_ARYCAT reading R(B), resolved 184750, https://hackerone.com/reports/184750, Reflected XSS on a DoD website, resolved 184759, https://hackerone.com/reports/184759, XSS on a DoD website, resolved 184857, https://hackerone.com/reports/184857, Crash: calling Proc::initialize_copy with a Proc instance where initialize never ran leads to a crash, resolved 184877, https://hackerone.com/reports/184877, Out-of-date Version (Apache) , resolved 184881, https://hackerone.com/reports/184881, invalid URL parsing with and '@', not-applicable 184884, https://hackerone.com/reports/184884, Subdomain Takeover on http://blog.owox.com/, informative 184901, https://hackerone.com/reports/184901, Stored cross site scripting (XSS) vulnerability on a DoD website, resolved 184933, https://hackerone.com/reports/184933, Insecure direct object reference vulnerability on a DoD website, resolved 185041, https://hackerone.com/reports/185041, Type confusion in mrb_exc_set leading to memory corruption, resolved 185051, https://hackerone.com/reports/185051, Type confusion in wrap_decimal leading to memory corruption, resolved 185387, https://hackerone.com/reports/185387, Null pointer dereference regression in parse.y, resolved 185705, https://hackerone.com/reports/185705, Null pointer dereference in mrb_str_concat, duplicate 185775, https://hackerone.com/reports/185775, Crash: Initialize Decimal with itself triggers an assertion, resolved 185794, https://hackerone.com/reports/185794, Crash: mrb_any_to_s can't handle NilClass, Symbol and Fixnum, resolved 185833, https://hackerone.com/reports/185833, Incomplete or No Cache-control and Pragma HTTP Header Set, resolved 185835, https://hackerone.com/reports/185835, Secure Pages Include Mixed Content, duplicate 185862, https://hackerone.com/reports/185862, Twitter for android is exposing user's location to any installed android app, resolved 185899, https://hackerone.com/reports/185899, Invalid memory write caused by incorrect upper bound in array_copy, resolved 185907, https://hackerone.com/reports/185907, unchecked unserialize usage in WordPress-Functionality-Plugin-Skeleton/functionality-plugin-skeleton.php, resolved 185909, https://hackerone.com/reports/185909, unchecked unserialize usages in audit-trail-extension/audit-trail-extension.php, resolved 185914, https://hackerone.com/reports/185914, constant cache_page_secret in regolith, resolved 185957, https://hackerone.com/reports/185957, Crash: A call to Symbol.new leads to a crash when inspecting the resulting object, resolved 186156, https://hackerone.com/reports/186156, SQL Injection vulnerability on a DoD website, resolved 186189, https://hackerone.com/reports/186189, Information leakage on a Department of Defense website, resolved 186279, https://hackerone.com/reports/186279, IDOR - disclosure of private videos - /api_android_v3/getUserVideos, resolved 186307, https://hackerone.com/reports/186307, Information disclosure vulnerability on a DoD website, resolved 186308, https://hackerone.com/reports/186308, Information disclosure vulnerability in a DoD website, resolved 186315, https://hackerone.com/reports/186315, Cross-site scripting (XSS) vulnerability on a DoD website, resolved 186316, https://hackerone.com/reports/186316, DNS Misconfiguration, duplicate 186317, https://hackerone.com/reports/186317, Information disclosure on a DoD website, duplicate 186326, https://hackerone.com/reports/186326, Arbitary file download vulnerability on a DoD website, resolved 186352, https://hackerone.com/reports/186352, Fetching binaries (for software installation) over HTTP without verification (RCE as ROOT by MITM), resolved 186393, https://hackerone.com/reports/186393, Subdomain Takeover on OWOX.RU, duplicate 186402, https://hackerone.com/reports/186402, Cross-Site Scripting (XSS) on a DoD website, resolved 186462, https://hackerone.com/reports/186462, Stored XSS at 'Buy Button' page, resolved 186530, https://hackerone.com/reports/186530, Information disclosure vulnerability on a DoD website, resolved 186554, https://hackerone.com/reports/186554, Stored XSS in Adress Book (starbucks.com/account/profile), resolved 186586, https://hackerone.com/reports/186586, Access to Grafana Dashboard, resolved 186613, https://hackerone.com/reports/186613, Stored XSS on the http://ht.pornhub.com/widgets/, resolved 186723, https://hackerone.com/reports/186723, Crash: Overwriting NoMethodError with a builtin class crashes/corrupts memory, resolved 186766, https://hackerone.com/reports/186766, Subdomain takeover on happymondays.starbucks.com due to non-used AWS S3 DNS record, resolved 187006, https://hackerone.com/reports/187006, Open Redirect in a DoD website, resolved 187134, https://hackerone.com/reports/187134, JSBeautifier BApp: Race condition leads to memory disclosure, resolved 187225, https://hackerone.com/reports/187225, Web Browser XSS Protection Not Enabled, not-applicable 187232, https://hackerone.com/reports/187232, Arbitrary Script Injection (Mail) in a DoD Website, resolved 187305, https://hackerone.com/reports/187305, Invalid handling of zero-length heredoc identifiers leads to infinite loop in the sandbox, resolved 187380, https://hackerone.com/reports/187380, Stored xss, duplicate 187410, https://hackerone.com/reports/187410, Store XSS, resolved 187460, https://hackerone.com/reports/187460, Files Drop: WebDAV endpoint is leaking existence of resources, resolved 187520, https://hackerone.com/reports/187520, Wordpress 4.7 - CSRF -> HTTP SSRF any private ip:port and basic-auth, resolved 187536, https://hackerone.com/reports/187536, Null pointer derefence due to bug in codegen with negation without using value, resolved 187539, https://hackerone.com/reports/187539, Null pointer dereference due to bug in codegen with negation of floats, duplicate 187542, https://hackerone.com/reports/187542, Brave Browser unexpectedly allows to send arbitrary IPC messages, resolved 187602, https://hackerone.com/reports/187602, [element.mail.ru] /.svn/entries, resolved 187705, https://hackerone.com/reports/187705, Authentication bypass vulnerability on a DoD website, resolved 187759, https://hackerone.com/reports/187759, Persistent XSS vulnerability on a DoD website, resolved 187822, https://hackerone.com/reports/187822, Reflected XSS vulnerability on a DoD website, resolved 187881, https://hackerone.com/reports/187881, XSS vulnerability on an Army website, resolved 187969, https://hackerone.com/reports/187969, Open redirect vulnerability in a DoD website, resolved 188078, https://hackerone.com/reports/188078, Command Execution because of extension handling, duplicate 188086, https://hackerone.com/reports/188086, Sending arbitrary IPC messages via overriding Function.prototype.apply, resolved 188102, https://hackerone.com/reports/188102, 3 heap corruptions in PHP, resolved 188124, https://hackerone.com/reports/188124, Violation of secure design principles on a DoD website, resolved 188132, https://hackerone.com/reports/188132, Wordpress Version Disclosure Bug On Nextcloud, informative 188149, https://hackerone.com/reports/188149, Personal information disclosure on a DoD website, resolved 188185, https://hackerone.com/reports/188185, Dom Based Xss DIV.innerHTML parameters store.starbucks*, resolved 188195, https://hackerone.com/reports/188195, Login Hints on Admin Panel, informative 188205, https://hackerone.com/reports/188205, BruteForce in to Admin Account, informative 188266, https://hackerone.com/reports/188266, Redirect in adding advance cash on delivery app, resolved 188279, https://hackerone.com/reports/188279, Multiple vulnerabilities in http://blog.dubizzle.com/uae, resolved 188284, https://hackerone.com/reports/188284, Remote code execution on an Army website, resolved 188313, https://hackerone.com/reports/188313, Segmentation fault due to bad memory access in kh_get_mt, resolved 188326, https://hackerone.com/reports/188326, Buffer overflow in mrb_time_asctime, resolved 188338, https://hackerone.com/reports/188338, Unvalidated / Open Redirect, resolved 188482, https://hackerone.com/reports/188482, Unsecured Kibana/Elasticsearch instance, resolved 188561, https://hackerone.com/reports/188561, Sending arbitrary IPC messages via overriding Array.prototype.push, informative 188661, https://hackerone.com/reports/188661, Invalid read when wddx decodes empty boolean element, resolved 188691, https://hackerone.com/reports/188691, Reflected XSS in a Navy website, resolved 188692, https://hackerone.com/reports/188692, httponly flag not set + csrftoken in url, informative 188743, https://hackerone.com/reports/188743, XXE on DoD web server, resolved 188929, https://hackerone.com/reports/188929, Time Based SQL Injection vulnerability on a DoD website, resolved 188972, https://hackerone.com/reports/188972, Persistent XSS in www.starbucks.com, resolved 189023, https://hackerone.com/reports/189023, S3 ACL misconfiguration, informative 189069, https://hackerone.com/reports/189069, SQL injection vulnerability on a DoD website, resolved 189149, https://hackerone.com/reports/189149, QuickTime Promotion on a DoD website, resolved 189192, https://hackerone.com/reports/189192, Unsecured DB instance, resolved 189241, https://hackerone.com/reports/189241, Reflected XSS on a DoD website, resolved 189332, https://hackerone.com/reports/189332, SQL injection vulnerability on a DoD website, resolved 189356, https://hackerone.com/reports/189356, Text injection on Auth problem at urbandictionary.com, resolved 189378, https://hackerone.com/reports/189378, Unauthenticated Stored XSS on .myshopify.com via checkout page, resolved 189414, https://hackerone.com/reports/189414, Information disclosure on a DoD website, resolved 189458, https://hackerone.com/reports/189458, Information disclosure vulnerability on a DoD website, resolved 189633, https://hackerone.com/reports/189633, Certain inputs cause tight C-level recursion leading to process stack overflow, resolved 189648, https://hackerone.com/reports/189648, Server Side Request Forgery (SSRF) vulnerability in a DoD website, resolved 189704, https://hackerone.com/reports/189704, Segmentation fault due to invalid memory access in codegen when using break with the 127th argument a constant, duplicate 189726, https://hackerone.com/reports/189726, Websites opened from reports can change url of report page , resolved 189768, https://hackerone.com/reports/189768, [controlsyou.quora.com] 429 Too Many Requests Error-Page XSS, resolved 189793, https://hackerone.com/reports/189793, [Android] XSS via start ContentActivity, resolved 189834, https://hackerone.com/reports/189834, [kb.informatica.com] DOM based XSS in the bindBreadCrumb function, resolved 189851, https://hackerone.com/reports/189851, Time Based SQL Injection vulnerability on a DoD website, resolved 189878, https://hackerone.com/reports/189878, CSRF header is sent to external websites when using data-remote forms, resolved 190015, https://hackerone.com/reports/190015, Certificate signed using SHA-1, duplicate 190016, https://hackerone.com/reports/190016, [network.informatica.com] The login form XSS via the referer value, resolved 190020, https://hackerone.com/reports/190020, [careers.informatica.com] XSS on "isJTN", resolved 190133, https://hackerone.com/reports/190133, Segfault when passing invalid values to `values_at`, resolved 190194, https://hackerone.com/reports/190194, Cookie HttpOnly Flag Not Set , duplicate 190195, https://hackerone.com/reports/190195, [qiwi.com] .bash_history, resolved 190205, https://hackerone.com/reports/190205, Reflected XSS on a DoD website, resolved 190217, https://hackerone.com/reports/190217, [marketplace.informatica.com] Profile stored XSS, resolved 190247, https://hackerone.com/reports/190247, Reflected XSS vector, resolved 190373, https://hackerone.com/reports/190373, Gratipay uses the random module's cryptographically insecure PRNG., informative 190427, https://hackerone.com/reports/190427, Reflected XSS on a DoD website, resolved 190434, https://hackerone.com/reports/190434, SQL Injection in sijoitustalous_peruutus (viestinta.lahitapiola.fi), resolved 190798, https://hackerone.com/reports/190798, Reflected XSS on teavana.com (Locale-Change), resolved 190863, https://hackerone.com/reports/190863, imagefilltoborder stackoverflow on truecolor images, resolved 190870, https://hackerone.com/reports/190870, Stored XSS on new Calling plugin (spreed), resolved 190933, https://hackerone.com/reports/190933, Invalid parameter in memcpy function trough openssl_pbkdf2, resolved 190951, https://hackerone.com/reports/190951, XSS on manually entering Postal codes, resolved 190964, https://hackerone.com/reports/190964, Content type incorrectly stated, informative 191179, https://hackerone.com/reports/191179, http://digital.starbucks.com/ Creation of Google G Suite Account on Behalf of starbucks. , resolved 191196, https://hackerone.com/reports/191196, Authorization issue in Google G Suite allows DoS through HTTP redirect, resolved 191216, https://hackerone.com/reports/191216, SSRF via git Repo by URL Abuse, duplicate 191220, https://hackerone.com/reports/191220, HTTP OPTION Method is Enabled on portswigger.net , not-applicable 191243, https://hackerone.com/reports/191243, File upload vulnerability on a DoD website, resolved 191323, https://hackerone.com/reports/191323, Sub Domain Takeover at mk.prd.vine.co, resolved 191328, https://hackerone.com/reports/191328, Invalid memory access in `mrb_str_format`, resolved 191332, https://hackerone.com/reports/191332, Reflected XSS in [olx.qa], resolved 191380, https://hackerone.com/reports/191380, CRLF and XSS stored on ton.twitter.com, resolved 191381, https://hackerone.com/reports/191381, Reflected cross-site scripting (XSS) vulnerability on a DoD website, resolved 191407, https://hackerone.com/reports/191407, DOM Based XSS on an Army website, resolved 191416, https://hackerone.com/reports/191416, DOM Based XSS on a DoD website, resolved 191543, https://hackerone.com/reports/191543, ssrf xspa [https://prt.mail.ru/], resolved 191608, https://hackerone.com/reports/191608, Cross-site request forgery vulnerability on a DoD website, resolved 191643, https://hackerone.com/reports/191643, Password complexity requirements not enforced, resolved 191674, https://hackerone.com/reports/191674, XSS vulnerability using GIF tags, resolved 191689, https://hackerone.com/reports/191689, Incorrect code generation when result of NODE_NEGATE is not used, resolved 191810, https://hackerone.com/reports/191810, Reflected XSS in lert.uber.com, resolved 191830, https://hackerone.com/reports/191830, Server side information disclosure on a DoD website, resolved 191831, https://hackerone.com/reports/191831, Cross-site request forgery (CSRF) vulnerability on a DoD website, resolved 191884, https://hackerone.com/reports/191884, Remote Unrestricted file Creation/Deletion and Possible RCE., resolved 191890, https://hackerone.com/reports/191890, DOM Based XSS in Discourse Search, resolved 191902, https://hackerone.com/reports/191902, HTML injection vulnerability on a DoD website, resolved 191909, https://hackerone.com/reports/191909, XSS Vulnerability on Image link parser, resolved 191938, https://hackerone.com/reports/191938, SIGSEGV on mruby mrb_get_args() , resolved 191979, https://hackerone.com/reports/191979, Limitation of app specific password scope can be bypassed (NC-SA-2017-009), resolved 191994, https://hackerone.com/reports/191994, SIGSEGV mrb_obj_freeze() Manipulating Register RAX and RSI, resolved 192074, https://hackerone.com/reports/192074, Default credentials on a DoD website, resolved 192079, https://hackerone.com/reports/192079, SQL Injection vulnerability in a DoD website, resolved 192082, https://hackerone.com/reports/192082, Attackers can control which security questions they are presented (████████), resolved 192110, https://hackerone.com/reports/192110, SQL Injection vulnerability in a DoD website, resolved 192127, https://hackerone.com/reports/192127, Buffer underflow in sprintf, resolved 192131, https://hackerone.com/reports/192131, CSRF Attack on (m.badoo.com)deleting account and erasing imported contacts, resolved 192140, https://hackerone.com/reports/192140, XSS on postal codes, resolved 192197, https://hackerone.com/reports/192197, Information disclosure in coinbase android app, informative 192223, https://hackerone.com/reports/192223, XSS vulnerability on Audio and Video parsers, resolved 192235, https://hackerone.com/reports/192235, Integer Overflow in mrb_ary_set, resolved 192284, https://hackerone.com/reports/192284, olx.ph is vulnerable to POODLE attack, informative 192318, https://hackerone.com/reports/192318, mrb_vformat() heap overflow could lead to code execution, resolved 192362, https://hackerone.com/reports/192362, Heap Overflow in mrb_arb_splice, resolved 192373, https://hackerone.com/reports/192373, [cooking.lady.mail.ru] Open Redirect, resolved 192375, https://hackerone.com/reports/192375, [ml.money.mail.ru] Open Redirect, resolved 192388, https://hackerone.com/reports/192388, Unauthorised read Access to Expense Receipt of any user in the company(Vertical Privilege escalation), resolved 192485, https://hackerone.com/reports/192485, SIGSEGV on mrb_vm_exec() Null Deref, resolved 192512, https://hackerone.com/reports/192512, RCE on default Ubuntu Desktop >= 12.10 Quantal, resolved 192532, https://hackerone.com/reports/192532, SIGABRT, SIGSEGV mspace_free() and mrb_default_allocf(), resolved 192567, https://hackerone.com/reports/192567, Remote code execution vulnerability on a DoD website, resolved 192577, https://hackerone.com/reports/192577, Server side information disclosure, informative 192578, https://hackerone.com/reports/192578, kh_get_n2s() stack overrun, resolved 192611, https://hackerone.com/reports/192611, Users can bookmark other user's messages, resolved 192618, https://hackerone.com/reports/192618, Creating arbitrary cookies values /cs/CookieServer (www.lahitapiola.fi), resolved 192648, https://hackerone.com/reports/192648, Account takeover via Pornhub Oauth, resolved 192665, https://hackerone.com/reports/192665, heap-buffer-overflow on mruby, resolved 192667, https://hackerone.com/reports/192667, [stagecafrstore.starbucks.com] CRLF Injection, XSS, resolved 192734, https://hackerone.com/reports/192734, SIGSEGV Null Pointer mrb_str_concat(), resolved 192749, https://hackerone.com/reports/192749, [newscdn.starbucks.com] CRLF Injection, XSS, resolved 192751, https://hackerone.com/reports/192751, XSS vulnerability on a DoD website, resolved 192786, https://hackerone.com/reports/192786, Reflected XSS in U2F plugin by shipping the example endpoints, resolved 192886, https://hackerone.com/reports/192886, Mapbox Android SDK uses Broadcast Receiver instead of Local Broadcast Manager, resolved 192896, https://hackerone.com/reports/192896, Memory disclosure in timegm, resolved 192922, https://hackerone.com/reports/192922, Stored XSS at https://finance.owox.com/customer/accountList, resolved 192931, https://hackerone.com/reports/192931, Server-side include injection vulnerability in a DoD website, resolved 192940, https://hackerone.com/reports/192940, Remote File Inclusion, Malicious File Hosting, and Cross-site Scripting (XSS) in ████████, resolved 192986, https://hackerone.com/reports/192986, User Enumeration, informative 193027, https://hackerone.com/reports/193027, [http2.cloudflare.com] Open Redirect, resolved 193056, https://hackerone.com/reports/193056, Subdomain Takeover at http://gameday.websummit.net, resolved 193075, https://hackerone.com/reports/193075, SIGSEGV - mrb_check_intern_str() - NullPointer, resolved 193077, https://hackerone.com/reports/193077, mrb_str_modify try to write to memory not marked for writing, resolved 193081, https://hackerone.com/reports/193081, Null pointer dereference in mrb_str_prepend, resolved 193143, https://hackerone.com/reports/193143, Use After Free in str_replace, resolved 193419, https://hackerone.com/reports/193419, Способ узнать имя человека удаленной страницы, resolved 193436, https://hackerone.com/reports/193436, SQL injection vulnerability on a DoD website, resolved 193462, https://hackerone.com/reports/193462, a stored xss in web widget chat, resolved 193478, https://hackerone.com/reports/193478, Create New User Whilst Logged On, not-applicable 193481, https://hackerone.com/reports/193481, Reflected XSS on a DoD website, resolved 193517, https://hackerone.com/reports/193517, attempting double-free using the mruby compiler `mrbc`, resolved 193556, https://hackerone.com/reports/193556, Session Fixation At Logout /Session Misconfiguration, informative 193719, https://hackerone.com/reports/193719, Double free of filename after codegen error, resolved 193724, https://hackerone.com/reports/193724, SIGSEGV - kh_resize_iv - Null Deref, resolved 193753, https://hackerone.com/reports/193753, Directory listing, informative 193759, https://hackerone.com/reports/193759, Способ узнать имя человека удаленной страницы 2, resolved 193773, https://hackerone.com/reports/193773, SIGABRT - mrb_default_allocf , resolved 193799, https://hackerone.com/reports/193799, XSS in ubermovement.com via editable Google Sheets, resolved 193932, https://hackerone.com/reports/193932, Misconfigured password reset vulnerability on a DoD website, resolved 193936, https://hackerone.com/reports/193936, SQL injection vulnerability on a DoD website, resolved 194065, https://hackerone.com/reports/194065, DoS vulnerability in mod_auth_digest CVE-2016-2161, resolved 194142, https://hackerone.com/reports/194142, Legal Robot AWS S3 Bucket Directory Listing, resolved 194207, https://hackerone.com/reports/194207, Reflected XSS and Open Redirect (verkkopalvelu.lahitapiola.fi), resolved 194294, https://hackerone.com/reports/194294, Reflected XSS on a DoD website, resolved 194308, https://hackerone.com/reports/194308, Password reset vulnerability on a DoD website, resolved 194318, https://hackerone.com/reports/194318, Brute Force Attack against PIN on Card History Page Could Lead to Card Information Discovery / Fraud, resolved 194329, https://hackerone.com/reports/194329, No session logout after changing password & alsoandroid sessions not shown in sessions list so they can be deleted, resolved 194351, https://hackerone.com/reports/194351, Able to download arbitrary PHP files at yelpblog.com, resolved 194454, https://hackerone.com/reports/194454, Exposed Unencrypted Telnet Endpoint, resolved 194564, https://hackerone.com/reports/194564, Review remote code execution in SwiftMailer, resolved 194574, https://hackerone.com/reports/194574, IDOR - Folder names disclosure inside a domain, regardless of user, resolved 194594, https://hackerone.com/reports/194594, IDOR on partners.uber.com allows for a driver to override administrator documents, resolved 194647, https://hackerone.com/reports/194647, GlobaLeaks is vulnerable to timing attacks., resolved 194721, https://hackerone.com/reports/194721, Verification of email addresses possible through https://www.yelp.com/signup/facebook, resolved 194790, https://hackerone.com/reports/194790, IDOR - Downloading all attachements if having access to a shared link, resolved 194832, https://hackerone.com/reports/194832, Authentication Bypass on monitoring server, resolved 194866, https://hackerone.com/reports/194866, Deleting Key-value pair from Frozen HASH or Clearing a Frozen HASH, resolved 194884, https://hackerone.com/reports/194884, Heap use-after-free during range creation, resolved 194906, https://hackerone.com/reports/194906, Heap overflow due to off-by-one when expanding stack, resolved 194952, https://hackerone.com/reports/194952, Moniter Failed Sends too many emails, informative 195045, https://hackerone.com/reports/195045, Set Cookie Via SVG, resolved 195051, https://hackerone.com/reports/195051, SQL injection vulnerability in a DoD website, resolved 195058, https://hackerone.com/reports/195058, Users can download old project exports due to unclaimed namespace, resolved 195088, https://hackerone.com/reports/195088, Every user can delete public deploy keys, resolved 195134, https://hackerone.com/reports/195134, User with guest access can access private merge requests, resolved 195140, https://hackerone.com/reports/195140, Users with guest access can post notes to private merge requests, issues, and snippets, resolved 195163, https://hackerone.com/reports/195163, SAP Server - default credentials enabled, resolved 195205, https://hackerone.com/reports/195205, lert.uber.com: Few default folders/files of AURA Framework are accessible, resolved 195216, https://hackerone.com/reports/195216, No valid SPF records on demo.globaleaks.org, informative 195350, https://hackerone.com/reports/195350, Subdomain takeover on podcasts.slack-core.com, resolved 195356, https://hackerone.com/reports/195356, HTML Injection/Load Images vulnerability on a DoD website, resolved 195544, https://hackerone.com/reports/195544, Exposed Access Control Data Backup Files on DoD Website, resolved 195580, https://hackerone.com/reports/195580, Crash (DoS) when parsing a hostile TIFF, resolved 195586, https://hackerone.com/reports/195586, Memory corruption when parsing a hostile PHAR archive, resolved 195635, https://hackerone.com/reports/195635, Video player on ███ allows arbitrary remote videos to be played, resolved 195636, https://hackerone.com/reports/195636, Information disclosure vulnerability on a DoD website, resolved 195638, https://hackerone.com/reports/195638, Information disclosure vulnerability on a DoD website, resolved 195688, https://hackerone.com/reports/195688, NULL Pointer Dereference while unserialize php object, resolved 195836, https://hackerone.com/reports/195836, Information disclosure vulnerability on a DoD website, resolved 195842, https://hackerone.com/reports/195842, Segmentation fault - mrb_gc_mark, resolved 195913, https://hackerone.com/reports/195913, Излишние права при авторизации через интерфейс mail.ru, informative 195950, https://hackerone.com/reports/195950, Use of uninitialized memory in unserialize(), resolved 195996, https://hackerone.com/reports/195996, Changing details of other users profile using UUID (IDOR), resolved 196222, https://hackerone.com/reports/196222, RTLO char allowed in chat, resolved 196300, https://hackerone.com/reports/196300, Blind SQLi in a DoD Website, resolved 196358, https://hackerone.com/reports/196358, Report redaction doesn't apply to report title update activities, resolved 196380, https://hackerone.com/reports/196380, SIGSEGV in mrb_vm_exec, resolved 196386, https://hackerone.com/reports/196386, SIGSEGV - mrb_vm_exec - vm.c in line:1272, resolved 196416, https://hackerone.com/reports/196416, Clearing , Shifting and Pop Value from Frozen Array , resolved 196448, https://hackerone.com/reports/196448, Local file inclusion vulnerability on a DoD website, resolved 196458, https://hackerone.com/reports/196458, apps.shopify.com - CSRF token leakage through Google Analytics, resolved 196482, https://hackerone.com/reports/196482, Information disclosure vulnerability on a DoD website, resolved 196498, https://hackerone.com/reports/196498, Segmentation fault on program counter, resolved 196624, https://hackerone.com/reports/196624, dom xss in https://www.slackatwork.com, resolved 196655, https://hackerone.com/reports/196655, Disclose any user's private email through API, resolved 196715, https://hackerone.com/reports/196715, CSRF Send a message at street-combats.mail.ru, resolved 196819, https://hackerone.com/reports/196819, Heap Buffer overflow in mrb_funcall_with_block, resolved 196833, https://hackerone.com/reports/196833, Vulnerable Javascript library, informative 196846, https://hackerone.com/reports/196846, Open redirect / Reflected XSS payload in root that affects all your sites (store.starbucks.* / shop.starbucks.* / teavana.com), resolved 196937, https://hackerone.com/reports/196937, Возможность смотреть видео рекомендации любого пользователя вконтакте, resolved 196969, https://hackerone.com/reports/196969, bug reporting template encourages users to paste config file with passwords, resolved 196989, https://hackerone.com/reports/196989, XSS on username when register to proffesional account, resolved 197055, https://hackerone.com/reports/197055, Information disclosure vulnerability on a DoD website, resolved 197114, https://hackerone.com/reports/197114, IDOR - Access to private video thumbnails even if video requires password authentication, resolved 197115, https://hackerone.com/reports/197115, Clickjacking @ Main Domain[www.yelp.com], informative 197153, https://hackerone.com/reports/197153, Ability to post comments to a crew even after getting kicked out, resolved 197238, https://hackerone.com/reports/197238, Server Version Of https://www.olx.ph/, informative 197253, https://hackerone.com/reports/197253, formassembly.com is vulnerable to padding-oracle attacks., resolved 197279, https://hackerone.com/reports/197279, [m.airbnb.com] CRLF Injection, resolved 197334, https://hackerone.com/reports/197334, [airbnb.com] XSS via Cookie flash, duplicate 197337, https://hackerone.com/reports/197337, [IMP] - Blind XSS in the admin panel for reviewing comments, resolved 197365, https://hackerone.com/reports/197365, SSRF через Share-ботов, resolved 197443, https://hackerone.com/reports/197443, XSS in topics because of bandcamp preview engine vulnerability, resolved 197489, https://hackerone.com/reports/197489, Subdomain takeover at signup.uber.com, resolved 197585, https://hackerone.com/reports/197585, Starbucks.com is reachable via ip address thus possible to link any doamin to Starbucks., not-applicable 197693, https://hackerone.com/reports/197693, SIGSEGV - mrb_vm_exec - line:1681, resolved 197694, https://hackerone.com/reports/197694, SIGSEGV - mrb_obj_extend - line:413, resolved 197719, https://hackerone.com/reports/197719, Still heap overflow in mrb_ary_splice, resolved 197723, https://hackerone.com/reports/197723, Null pointer dereference in mrb_str_modify, resolved 197726, https://hackerone.com/reports/197726, newrelic.atlassian.net - jira information disclosure, resolved 197754, https://hackerone.com/reports/197754, SQL Injection vulnerability in a DoD website, resolved 197755, https://hackerone.com/reports/197755, SQL injection found in US Navy Website (http://███/), resolved 197786, https://hackerone.com/reports/197786, User Information Disclosure via REST API, resolved 197789, https://hackerone.com/reports/197789, [insideok.ru] Database Dump, resolved 197877, https://hackerone.com/reports/197877, User Information Disclosure via REST API, resolved 197878, https://hackerone.com/reports/197878, WordPress <= 4.6.1 Stored XSS Via Theme File, resolved 197880, https://hackerone.com/reports/197880, Nginx version disclosure via forbidden page, informative 197902, https://hackerone.com/reports/197902, Stored XSS in topics because of whitelisted_generic engine vulnerability, resolved 197907, https://hackerone.com/reports/197907, Misconfigured user account settings on DoD website, resolved 197914, https://hackerone.com/reports/197914, Stored XSS in posts because of absence of oembed variables values escaping, resolved 197916, https://hackerone.com/reports/197916, Crash in print_backtrace, resolved 197958, https://hackerone.com/reports/197958, [EdgeSwitch] Web GUI command injection as root with Privilege-1 and Privilege-15 users, resolved 197976, https://hackerone.com/reports/197976, Open FTP on ███, resolved 198012, https://hackerone.com/reports/198012, Disclosure of administrators via JSON on nextcloud.com Wordpress, resolved 198218, https://hackerone.com/reports/198218, HTML Injection on ████, resolved 198221, https://hackerone.com/reports/198221, Restricted User can view multiple account details including customer_root_account_id, payment method, date of first payment, etc., resolved 198249, https://hackerone.com/reports/198249, [XSS/3dsecure.qiwi.com] 3DSecure XSS, resolved 198251, https://hackerone.com/reports/198251, [XSS/pay.qiwi.com] Pay SubDomain Hard-Use XSS, resolved 198259, https://hackerone.com/reports/198259, Reflected XSS vulnerability on a DoD website, resolved 198452, https://hackerone.com/reports/198452, SIGABRT - mrb_realloc_simple - gc.c - line:201, resolved 198470, https://hackerone.com/reports/198470, csrf blogs.starbucks.com, duplicate 198494, https://hackerone.com/reports/198494, Lack of Controls Allowing for Card and PIN Enumeration Leading to Fraud, resolved 198622, https://hackerone.com/reports/198622, Clickjacking Periscope.tv on Chrome, resolved 198673, https://hackerone.com/reports/198673, HTTP-Basic Authentication on logs.nextcloud.com, informative 198690, https://hackerone.com/reports/198690, SSRF in alerts.newrelic.com exposes entire internal network, resolved 198718, https://hackerone.com/reports/198718, Blacklist bypass for /cs/Satellite (www.lahitapiola.fi), resolved 198723, https://hackerone.com/reports/198723, Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization, resolved 198732, https://hackerone.com/reports/198732, Use After Free in unserialize(), resolved 198733, https://hackerone.com/reports/198733, Type Confusion in Object Deserialization, resolved 198734, https://hackerone.com/reports/198734, GMP Deserialization Type Confusion Vulnerability [MyBB <= 1.8.3 RCE Vulnerability], resolved 198773, https://hackerone.com/reports/198773, Drone Nextcloud, informative 198851, https://hackerone.com/reports/198851, XSS in api_v1, resolved 198907, https://hackerone.com/reports/198907, HTML Injection possible due to bad filter, resolved 198927, https://hackerone.com/reports/198927, Parsing invalid unicode codepoints using json c extension (2.0.1+) triggers a segfault, resolved 198969, https://hackerone.com/reports/198969, IDOR - Deleting other user's reminders just by id, resolved 199082, https://hackerone.com/reports/199082, Multiple Vulnerabilities in Oracle Webcenter Sites (/cs/Satellite), resolved 199243, https://hackerone.com/reports/199243, No user confirmation when an auto-updated extension gets more permissions, resolved 199281, https://hackerone.com/reports/199281, IDOR - Leaking other user's folder names from /appsuite/api/import?action=ICA, resolved 199286, https://hackerone.com/reports/199286, Group admin can remove user from all his groups via API, resolved 199321, https://hackerone.com/reports/199321, IDOR - Deleting other user's signature via /appsuite/api/snippet?action=update (although an error is thrown), resolved 199436, https://hackerone.com/reports/199436, Yelp.com is vulnerable to SWEET32 attack, informative 199438, https://hackerone.com/reports/199438, SWEET32 TLS attack, informative 199445, https://hackerone.com/reports/199445, Nextcloud.com is vulnerable to SWEET32 attack, informative 199644, https://hackerone.com/reports/199644, Privilege Escalation on a DoD Website, resolved 199714, https://hackerone.com/reports/199714, Missing Rate Limit for Current Password field in nextcloud.com, resolved 199764, https://hackerone.com/reports/199764, Aborted - proc.c - line:143, resolved 199779, https://hackerone.com/reports/199779, Google Analytics could be used as CSP bypass for data exfiltration on hackerone.com, resolved 199804, https://hackerone.com/reports/199804, Persistent XSS on ForecastApp, resolved 199996, https://hackerone.com/reports/199996, HTML injection-WordCamp Talks plugin, not-applicable 200034, https://hackerone.com/reports/200034, [marketplace.informatica.com] Search XSS, resolved 200072, https://hackerone.com/reports/200072, Bypass email validity in newsletter field, informative 200079, https://hackerone.com/reports/200079, Critical information disclosure at https://█████████, resolved 200125, https://hackerone.com/reports/200125, Information disclosure vulnerability on a DoD website, resolved 200179, https://hackerone.com/reports/200179, SMS URL verification link does not expire on phone number change and lacks rate limiting, resolved 200210, https://hackerone.com/reports/200210, SQL Injection on /webApp/viivanalle (viestinta.lahitapiola.fi), resolved 200212, https://hackerone.com/reports/200212, Sql injection on /webApp/sijoituswebinaari (viestinta.lahitapiola.fi), resolved 200214, https://hackerone.com/reports/200214, SQL Injection on /webApp/lapsuudenturva (viestinta.lahitapiola.fi), resolved 200224, https://hackerone.com/reports/200224, SSRF на https://target.my.com/, resolved 200351, https://hackerone.com/reports/200351, XSS in flashmediaelement.swf (business-blog.zomato.com), resolved 200355, https://hackerone.com/reports/200355, MailPoet Newsletters <= 2.7.2 - Authenticated Reflected Cross-Site Scripting (XSS), resolved 200387, https://hackerone.com/reports/200387, Incorrect code generation with redo inside NODE_RESCUE., resolved 200419, https://hackerone.com/reports/200419, Clickjacking, resolved 200427, https://hackerone.com/reports/200427, Access of Android protected components via embedded intent, resolved 200487, https://hackerone.com/reports/200487, Incomplete HTML sanitization + Session id leaking + private information disclosure, resolved 200572, https://hackerone.com/reports/200572, Information About Your System(Sensitive Directories), not-applicable 200576, https://hackerone.com/reports/200576, Logic flaw enables restricted account to access account license key, resolved 200623, https://hackerone.com/reports/200623, SQL injection vulnerability on a DoD website, resolved 200683, https://hackerone.com/reports/200683, CSRF bypass + XSS on verkkopalvelu.tapiola.fi, resolved 200753, https://hackerone.com/reports/200753, [nutty.ubnt.com] DOM Based XSS nuttyapp github-btn.html, resolved 200762, https://hackerone.com/reports/200762, Email Spoofing, informative 200821, https://hackerone.com/reports/200821, heap-use-after-free /home/operac/testafl/mruby/mrubylast/mruby/src/gc.c, resolved 200826, https://hackerone.com/reports/200826, [github.algolia.com] DOM Based XSS github-btn.html, resolved 200909, https://hackerone.com/reports/200909, Out of bounds memory read in unserialize(), resolved 201152, https://hackerone.com/reports/201152, [ipm.informatica.com]- Broken Authentication, resolved 201300, https://hackerone.com/reports/201300, Attacker can get vine repost user all informations even Ip address and location ., resolved 201489, https://hackerone.com/reports/201489, Wordpress 4.7.1, resolved 201512, https://hackerone.com/reports/201512, SQL Injection vulnerability in a DoD website, resolved 201520, https://hackerone.com/reports/201520, test.zba.se is vulnerable to SSL POODLE , resolved 201529, https://hackerone.com/reports/201529, Can upload files without authentication on AirFibre 3.2, resolved 201796, https://hackerone.com/reports/201796, cloudup Subdomain Takeover That resolves to Desk.com ( CNAME cloudup.desk.com ) , resolved 201838, https://hackerone.com/reports/201838, [tanks.mail.ru] Open Redirect, resolved 201848, https://hackerone.com/reports/201848, Click jacking in delete image of user in Yelp, duplicate 201855, https://hackerone.com/reports/201855, Information disclosue in Android Application, duplicate 201897, https://hackerone.com/reports/201897, Recursion causing uninitialized memory reads leading to a segfault, resolved 201903, https://hackerone.com/reports/201903, Segmentfault at mrb_vm_exec, resolved 201905, https://hackerone.com/reports/201905, SIGSEGV - vm.c - line:1214, resolved 201940, https://hackerone.com/reports/201940, Account hijack via deleted PH account, resolved 201948, https://hackerone.com/reports/201948, Disclosure of information on static.dl.mail.ru, informative 201984, https://hackerone.com/reports/201984, Wordpress directories/files visible to internet, resolved 202177, https://hackerone.com/reports/202177, Login with Google Not Authenticated on iOS App, resolved 202354, https://hackerone.com/reports/202354, Stored XSS / Bypassing .htaccess protection in http://nodebb.ubnt.com/, resolved 202361, https://hackerone.com/reports/202361, Requestor Email Disclosure via Email Notification, informative 202362, https://hackerone.com/reports/202362, Null pointer dereference in mrb_random_initialize, resolved 202496, https://hackerone.com/reports/202496, Stored XSS vulnerability on a DoD website, duplicate 202499, https://hackerone.com/reports/202499, User with only Viewing Privilege can send message to Room, resolved 202501, https://hackerone.com/reports/202501, Restricted user is able to delete filter sets of admin users in https://infrastructure.newrelic.com/accounts/{{ACC#}}/settings/filterSets, resolved 202536, https://hackerone.com/reports/202536, [xss] pornhubpremium.com, /redeem?code= URL endpoint , resolved 202548, https://hackerone.com/reports/202548, XSS Vulnerability at https://www.pornhubpremium.com/premium_signup? URL endpoint , resolved 202582, https://hackerone.com/reports/202582, Denial of service (segfault) due to null pointer dereference in mrb_obj_instance_eval, resolved 202584, https://hackerone.com/reports/202584, Denial of service (segfault) due to null pointer dereference in mrb_vm_exec, resolved 202619, https://hackerone.com/reports/202619, SQL injection vulnerability on a DoD website, resolved 202652, https://hackerone.com/reports/202652, Remote command execution (RCE) vulnerability on a DoD website, resolved 202725, https://hackerone.com/reports/202725, Public access to objects in AWS S3 bucket, resolved 202740, https://hackerone.com/reports/202740, Missing Server Side Rate Limiting can Lead to VK Account Take over , resolved 202774, https://hackerone.com/reports/202774, Type Juggling -> PHP Object Injection -> SQL Injection Chain, resolved 202781, https://hackerone.com/reports/202781, Chained Bugs to Leak Victim's Uber's FB Oauth Token, resolved 202797, https://hackerone.com/reports/202797, found a vulnerability in your website, resolved 202808, https://hackerone.com/reports/202808, Cross-site request forgery (CSRF) vulnerability in a DoD website, resolved 202823, https://hackerone.com/reports/202823, Vine all registered user Private/sensitive information disclosure .[ Ip address/phone no/email and many other informations ], resolved 202918, https://hackerone.com/reports/202918, yaman.olx.ph/wordpress is using a very vulnerable version of WordPress and contains directory listing, resolved 202921, https://hackerone.com/reports/202921, Unauthorised Access to Anyone's User Account, resolved 202939, https://hackerone.com/reports/202939, Debug.log file Exposed to Public \Full Path Disclosure\, resolved 202949, https://hackerone.com/reports/202949, Wordpress Content injection , resolved 202951, https://hackerone.com/reports/202951, [marketplace.informatica.com]- Stored XSS on Image title and Edit Property, resolved 202960, https://hackerone.com/reports/202960, CVE-2017-5204: The IPv6 parser in tcpdump before 4.9.0 has a buffer overflow in print-ip6.c:ip6_print(), resolved 202965, https://hackerone.com/reports/202965, CVE-2017-5341 The OTV parser in tcpdump before 4.9.0 has a buffer overflow in print-otv.c:otv_print(), resolved 202967, https://hackerone.com/reports/202967, CVE-2017-5484 The ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-atm.c:sig_print(), resolved 202968, https://hackerone.com/reports/202968, CVE-2017-5342 In tcpdump before 4.9.0 a bug in multiple protocol parsers could cause a buffer overflow in print-ether.c:ether_print(), resolved 202969, https://hackerone.com/reports/202969, CVE-2017-5482 The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print()., resolved 203002, https://hackerone.com/reports/203002, Incorrect GC behavior in xxlimited could lead to use-after-free, resolved 203042, https://hackerone.com/reports/203042, Find whether a video has been favourited or not, for any user [via YouPorn Mobile API], resolved 203047, https://hackerone.com/reports/203047, Add a video to favourite list of any user [via YouPorn API / FrontEnd], resolved 203060, https://hackerone.com/reports/203060, Cross-site scripting (XSS) on a DoD website, resolved 203088, https://hackerone.com/reports/203088, Brave payments remembers history even after clearing all browser data., not-applicable 203241, https://hackerone.com/reports/203241, Reflected XSS, resolved 203311, https://hackerone.com/reports/203311, Bypass file access control vulnerability on a DoD website, resolved 203384, https://hackerone.com/reports/203384, HTTP trace method is enabled on gip.rocks, resolved 203388, https://hackerone.com/reports/203388, Content length restriction bypass can lead to DOS by reading large files on gip.rocks, resolved 203391, https://hackerone.com/reports/203391, Content Spoofing or Text Injection in (403 forbidden page injection) and Nginx version disclosure via response header, informative 203409, https://hackerone.com/reports/203409, HTTP trace method is enabled on aspen.io, resolved 203513, https://hackerone.com/reports/203513, SIGSEGV - mrb_vm_exec - line:1312, resolved 203515, https://hackerone.com/reports/203515, Wordpress 4.7.2 - Two XSS in Media Upload when file too large., resolved 203594, https://hackerone.com/reports/203594, Calendar and addressbook names disclosed (NC-SA-2017-012), resolved 203595, https://hackerone.com/reports/203595, forgot to add the patch, resolved 203600, https://hackerone.com/reports/203600, Remote code execution vulnerability on a DoD website, resolved 203614, https://hackerone.com/reports/203614, Enumerating emails through "Forgot Password" form, informative 203658, https://hackerone.com/reports/203658, Restricted file access when it exists in old versions of task or wiki document, informative 203673, https://hackerone.com/reports/203673, AirFibre products vulnerable to HTTP Header injection, resolved 203726, https://hackerone.com/reports/203726, Open Redirect in .greenhouse.io, resolved 203912, https://hackerone.com/reports/203912, Stored XSS via Discussion Title and Send as Email attribute in [marketplace.informatica.com], resolved 203935, https://hackerone.com/reports/203935, Time Based SQL-inject in post-parametr login[username] [domain - youporn.com], resolved 203974, https://hackerone.com/reports/203974, Reflected XSS in Meta Tag, resolved 204047, https://hackerone.com/reports/204047, Segmentation fault while printing backtrace, resolved 204048, https://hackerone.com/reports/204048, Illegal account registration in ████████, resolved 204050, https://hackerone.com/reports/204050, [Android API] SQL injection ( errortoken.json ), resolved 204198, https://hackerone.com/reports/204198, Clickjacking or URL Masking , informative 204237, https://hackerone.com/reports/204237, [informatica.com]- Cross Site scripting , resolved 204239, https://hackerone.com/reports/204239, [informatica.com]- Information Disclosure , resolved 204292, https://hackerone.com/reports/204292, <- Critical IDOR vulnerability in socialclub allow to insert and delete comments as another user and it discloses sensitive information ->, resolved 204421, https://hackerone.com/reports/204421, Heap buffer oveflow with many arguments, resolved 204513, https://hackerone.com/reports/204513, Infrastructure - Photon - SSRF, resolved 204568, https://hackerone.com/reports/204568, stack trace exposed on https://receipts.uber.com/, informative 204628, https://hackerone.com/reports/204628, segafult in mruby's sprintf - mrb_str_format, resolved 204703, https://hackerone.com/reports/204703, CSRF to change password, resolved 204774, https://hackerone.com/reports/204774, A crash when an exception is caught in a caller and the receiver returned from `ensure`, resolved 204802, https://hackerone.com/reports/204802, pam-ussh may be tricked into using another logged in user's ssh-agent, resolved 204969, https://hackerone.com/reports/204969, XSS with needed user intervention, resolved 204984, https://hackerone.com/reports/204984, IDOR - Accessing other user's attachements via PUT /appsuite/api/files?action=saveAs, resolved 204996, https://hackerone.com/reports/204996, Access to job creation web page on http://████████, resolved 205034, https://hackerone.com/reports/205034, [wave.informatica.com]- Subdomain missconfiguration, resolved 205069, https://hackerone.com/reports/205069, express config leaking stacktrace, resolved 205250, https://hackerone.com/reports/205250, Missing SPF Flags on nextcloud.com, duplicate 205284, https://hackerone.com/reports/205284, SIGABRT - method_missing - mark_context_stack, resolved 205309, https://hackerone.com/reports/205309, Broken Authentication and session management OWASP A2, not-applicable 205360, https://hackerone.com/reports/205360, Content-Injection/XSS ████, resolved 205481, https://hackerone.com/reports/205481, Wordpress unzip_file path traversal, resolved 205506, https://hackerone.com/reports/205506, youporn email notification enable/disable and newsletter , resolved 205521, https://hackerone.com/reports/205521, Heap Buffer overflow in mrb_ary_unshift, resolved 205529, https://hackerone.com/reports/205529, Combined attacks leading to stealing user's account, resolved 205536, https://hackerone.com/reports/205536, Use After Free in mrb_vm_exec, resolved 205626, https://hackerone.com/reports/205626, XSS Stored, resolved 205796, https://hackerone.com/reports/205796, CRLF инъекция на https://tz.mail.ru, resolved 205884, https://hackerone.com/reports/205884, Interger overflow in str_substr leading to read/write out of bound memory, resolved 205908, https://hackerone.com/reports/205908, LDAP login possible even though account doesn't match user filter, resolved 205920, https://hackerone.com/reports/205920, show control page if you insert ' at http://viestinta.lahitapiola.fi/, resolved 205925, https://hackerone.com/reports/205925, Application code is not obfuscated -- OWASP M9 (2016), informative 205949, https://hackerone.com/reports/205949, Subdomain takeover in many subdomains, resolved 205953, https://hackerone.com/reports/205953, CSRF - Adding unlimited number of saved items via GET request, resolved 206109, https://hackerone.com/reports/206109, mruby heap use-after-free , resolved 206125, https://hackerone.com/reports/206125, Reflected XSS in olx.pt, resolved 206239, https://hackerone.com/reports/206239, Heap Buffer Overflow while processing OP_SEND, resolved 206319, https://hackerone.com/reports/206319, Persistent CSRF in /GiftCert-AddToBasket prevents purchases on eCommerce sites, resolved 206359, https://hackerone.com/reports/206359, Email Spoofing, not-applicable 206516, https://hackerone.com/reports/206516, Subdomain Takeover (http://docs.olx.ph/ , http://calendar.olx.ph/, http://sites.olx.ph/), resolved 206591, https://hackerone.com/reports/206591, Open Redirect on central.uber.com allows for account takeover, resolved 206650, https://hackerone.com/reports/206650, Broken Authentication - Security token gets captured via man in the middle attack, resolved 206653, https://hackerone.com/reports/206653, Captcha bypass for the most important function - At en.instagram-brand.com, resolved 206737, https://hackerone.com/reports/206737, XSS via login cookie, resolved 206811, https://hackerone.com/reports/206811, Open Redirect located at https://www.robinhood.com/oauth2/authorize/?, resolved 206872, https://hackerone.com/reports/206872, SQL injection in 3rd party software Anomali, resolved 206877, https://hackerone.com/reports/206877, HTML injection in Desktop Client, resolved 206894, https://hackerone.com/reports/206894, SSRF at iris.lystit.com, resolved 207013, https://hackerone.com/reports/207013, Public Vulnerable Version of Confluence https://confluence.olx.com, resolved 207042, https://hackerone.com/reports/207042, Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP, resolved 207053, https://hackerone.com/reports/207053, Writable RubyCi Amazon s3 bucket, resolved 207062, https://hackerone.com/reports/207062, Воскрешение сессии после сброса сессий / смены пароля / принудительной смены пароля, resolved 207099, https://hackerone.com/reports/207099, Insecure Direct Object Reference (IDOR) vulnerability in a DoD website, resolved 207170, https://hackerone.com/reports/207170, Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domain, resolved 207236, https://hackerone.com/reports/207236, Potentially sensitive information disclosure on a DoD website, informative 207285, https://hackerone.com/reports/207285, Open redirection , resolved 207321, https://hackerone.com/reports/207321, Controlled address leak due to type confusion - ASLR bypass, resolved 207329, https://hackerone.com/reports/207329, Mixed Active content issue on https://www.lyst.com, resolved 207384, https://hackerone.com/reports/207384, Directory listing - i am able to download all php_agent archive, not-applicable 207388, https://hackerone.com/reports/207388, Sensitive information disclosure, informative 207399, https://hackerone.com/reports/207399, CSRF possible when SOP Bypass/UXSS is available, resolved 207404, https://hackerone.com/reports/207404, SSL Certification Expired And TLS Vulnerability , informative 207431, https://hackerone.com/reports/207431, One of yelp.com url is redirecting to domain which is not yet purchased, informative 207435, https://hackerone.com/reports/207435, Research papers on yelp are getting indexed by google bots., not-applicable 207457, https://hackerone.com/reports/207457, SSL/TLS Vulnerability at khanacademy.org, informative 207477, https://hackerone.com/reports/207477, SSRF in ███████, resolved 207505, https://hackerone.com/reports/207505, Unvalidated redirect in alerts.newrelic.com/auth/newrelic?origin=, resolved 207552, https://hackerone.com/reports/207552, No Security check at changing password and at adding mobile number which leads to account takeover and spam, informative 207576, https://hackerone.com/reports/207576, Subdomain takeover on s3.shopify.com, resolved 207695, https://hackerone.com/reports/207695, sqli, resolved 207710, https://hackerone.com/reports/207710, Heap use-after-free in mrb_vm_exec , resolved 207781, https://hackerone.com/reports/207781, Reflected XSS vulnerability in a DoD website , duplicate 207792, https://hackerone.com/reports/207792, http://ht.pornhub.com/ stored XSS in widget stylesheet, resolved 207983, https://hackerone.com/reports/207983, read outside of buffer (heap buffer overflow) in S_regmatch - regexec.c:6057, resolved 208141, https://hackerone.com/reports/208141, /icons/README is still available on viestinta.lahitapiola.fi, resolved 208363, https://hackerone.com/reports/208363, Memory corrouption in mrb_gc_mark, resolved 208407, https://hackerone.com/reports/208407, Able to create basic user account via Google login on HackerOne Drupal CMS, resolved 208480, https://hackerone.com/reports/208480, Site configured improperly at subdomain of lyst.co.uk, resolved 208481, https://hackerone.com/reports/208481, Remote file inclusion vulnerability on a DoD website, resolved 208526, https://hackerone.com/reports/208526, Null pointer dereference in mark_context_stack, resolved 208556, https://hackerone.com/reports/208556, Cross-site scripting (XSS) vulnerability on a DoD website, resolved 208566, https://hackerone.com/reports/208566, Outdated Jenkins server hosted at OwnCloud.org, resolved 208622, https://hackerone.com/reports/208622, Reflected cross-site scripting (XSS) vulnerability in scores.ubnt.com allows attackers to inject arbitrary web script via p parameter., resolved 208654, https://hackerone.com/reports/208654, Обход: "Аудиозапись недоступна для прослушивания в Вашем регионе.", resolved 208719, https://hackerone.com/reports/208719, Subdomain Takeover at Landing.udemy.com , resolved 208734, https://hackerone.com/reports/208734, CSRF @ configuration , resolved 208834, https://hackerone.com/reports/208834, Address bar spoofing in Brave browser via. window close warnings, informative 208978, https://hackerone.com/reports/208978, [URGENT] Opportunity to publish tweets on any twitters account, resolved 209004, https://hackerone.com/reports/209004, Subdomain takeover #2 at info.hacker.one, resolved 209008, https://hackerone.com/reports/209008, Authentication Bypass - Chaining two vulnerabilities leads to account takeover at en.instagram-brand.com, resolved 209140, https://hackerone.com/reports/209140, Private program email forwarding response invitation not expire after first use., resolved 209223, https://hackerone.com/reports/209223, Open S3 Bucket WriteAble To Any Aws User, resolved 209251, https://hackerone.com/reports/209251, public report - Reproducible - Writable RubyCi Amazon s3 bucket[207053], resolved 209352, https://hackerone.com/reports/209352, Cross Domain leakage of sensitive information - Leading to Account Takeover at Instagram Brand, resolved 209368, https://hackerone.com/reports/209368, [wallet.rapida.ru] Mass SMS flood, resolved 209449, https://hackerone.com/reports/209449, Heap buffer overflow with long array assignment, resolved 209520, https://hackerone.com/reports/209520, http://www.nextcloud.com/wp-includes/js/swfupload/swfupload.swf allows open redirect / site defacement, resolved 209736, https://hackerone.com/reports/209736, DOM XSS on teavana.com via "pr_zip_location" parameter, resolved 209765, https://hackerone.com/reports/209765, Heap buffer overflow in mruby value_move, resolved 209821, https://hackerone.com/reports/209821, URL Given leading to end users ending up in malicious sites, informative 209860, https://hackerone.com/reports/209860, Rate Limitation Vulnerability (DDos), duplicate 209917, https://hackerone.com/reports/209917, javascript: and mailto: links are allowed in JIRA integration settings, duplicate 209937, https://hackerone.com/reports/209937, SIGSEGV - mark_context_stack, resolved 209949, https://hackerone.com/reports/209949, Arbitrary heap exposure in JSON.generate, resolved 210190, https://hackerone.com/reports/210190, Transitioning a Private Program to Public Does Not Clear Previously Private Updates to Hackers, resolved 210238, https://hackerone.com/reports/210238, full path disclosure on www.rockstargames.com via apache filename brute forcing, resolved 210246, https://hackerone.com/reports/210246, Invalid Pointer Reference from OP_RESCUE, resolved 210298, https://hackerone.com/reports/210298, Privilege Escalation in Default Notification Preferences, resolved 210304, https://hackerone.com/reports/210304, Privilege Escalation in Share Report, resolved 210331, https://hackerone.com/reports/210331, SSLv3 POODLE Vulnerability, resolved 210354, https://hackerone.com/reports/210354, RTLO character in file names, resolved 210384, https://hackerone.com/reports/210384, Open Redirect, resolved 210417, https://hackerone.com/reports/210417, Bypass CAPTCHA protection, resolved 210429, https://hackerone.com/reports/210429, mrb_vm_exec - null ptr dereference, resolved 210525, https://hackerone.com/reports/210525, Information disclosure vulnerability on a DoD website, resolved 210572, https://hackerone.com/reports/210572, Full path Disclosure in Rockstargames.com██████████ , resolved 210654, https://hackerone.com/reports/210654, Bypass to postMessage origin validation via FTP, resolved 210671, https://hackerone.com/reports/210671, Null pointer dereferences from mrb_vm_exec, resolved 210741, https://hackerone.com/reports/210741, Unserialize leading to arbitrary PHP function invoke, resolved 210779, https://hackerone.com/reports/210779, [Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailable, resolved 210875, https://hackerone.com/reports/210875, use of unsafe host header leads to open redirect, resolved 210994, https://hackerone.com/reports/210994, Control Character Injection In Messages, resolved 211021, https://hackerone.com/reports/211021, Null pointer dereference in 'get_file', resolved 211065, https://hackerone.com/reports/211065, Gitlab.com is vulnerable to reverse tabnabbing., resolved 211072, https://hackerone.com/reports/211072, Написать от имени любого пользователя на его стене, если он перейдет по ссылке. https://vk.com/al_video.php, resolved 211149, https://hackerone.com/reports/211149, Inadequate/dangerous jQuery behavior, resolved 211206, https://hackerone.com/reports/211206, Version 4.7.2 of wordpress is vulnerable, resolved 211213, https://hackerone.com/reports/211213, https://xmpp.nextcloud.com///;@www.google.com allows open redirect, resolved 211283, https://hackerone.com/reports/211283, Cross Site WebSocket Hijacking, informative 211381, https://hackerone.com/reports/211381, Remote Code Execution (RCE) in a DoD website, resolved 211418, https://hackerone.com/reports/211418, Source Code Disclosure (CGI), resolved 211643, https://hackerone.com/reports/211643, Stored Cross Site Scripting in Customer Name, resolved 211988, https://hackerone.com/reports/211988, sql injection vulnerablity found, not-applicable 212015, https://hackerone.com/reports/212015, Unable to register in starbucks IN app, not-applicable 212022, https://hackerone.com/reports/212022, Remote Code Execution (RCE) in a DoD website, resolved 212046, https://hackerone.com/reports/212046, Создание ссылки от имени чужой страницы vk.cc, resolved 212067, https://hackerone.com/reports/212067, An “algobot”-s GitHub access token was leaked, resolved 212074, https://hackerone.com/reports/212074, SIGSEGV - mrb_yield_with_class, resolved 212107, https://hackerone.com/reports/212107, Null pointer dereference in mrb_class, resolved 212239, https://hackerone.com/reports/212239, sprintf gem - format string combined attack, resolved 212241, https://hackerone.com/reports/212241, sprintf combined format string attack, resolved 212253, https://hackerone.com/reports/212253, XSS via SVG file, duplicate 212456, https://hackerone.com/reports/212456, SIGSEGV - kh_get_n2s - in /src/symbol.c:37, resolved 212523, https://hackerone.com/reports/212523, Single user DOS on selectedLanuage -cookie at (verkkopalvelu.tapiola.fi), resolved 212629, https://hackerone.com/reports/212629, Gitlab.com is vulnerable to reverse tabnabbing. (#2), resolved 212696, https://hackerone.com/reports/212696, RCE by command line argument injection to `gm convert` in `/edit/process?a=crop`, resolved 212721, https://hackerone.com/reports/212721, IE 11 Self-XSS on Jira Integration Preview Base Link, resolved 212770, https://hackerone.com/reports/212770, Content spoofing due to the improper behavior of the 403 page, resolved 212882, https://hackerone.com/reports/212882, SIGABRT in only mirb, resolved 212931, https://hackerone.com/reports/212931, heap-buffer-overflow (buffer read overrun) in curl: ourWriteOut() src/tool_writeout.c:115, resolved 212985, https://hackerone.com/reports/212985, Remote code execution vulnerability on a DoD website, resolved 213056, https://hackerone.com/reports/213056, Invalid request may lead content spoofing for phishing, resolved 213069, https://hackerone.com/reports/213069, Remote Code Execution (RCE) in a DoD website, duplicate 213114, https://hackerone.com/reports/213114, Gitlab.com is vulnerable to reverse tabnabbing via AsciiDoc links. (#3), resolved 213180, https://hackerone.com/reports/213180, Password reset form ignores email field, resolved 213190, https://hackerone.com/reports/213190, Reflected XSS in openapi.starbucks.com /searchasyoutype/v1/search?x-api-key=, resolved 213227, https://hackerone.com/reports/213227, DOM XSS vulnerability in search dialogue (NC-SA-2017-007), resolved 213239, https://hackerone.com/reports/213239, Blind SQLi vulnerability in a DoD Website, resolved 213255, https://hackerone.com/reports/213255, SIGSEGV in str_buf_cat, resolved 213261, https://hackerone.com/reports/213261, Use-after-free leading to an invalid pointer dereference, resolved 213358, https://hackerone.com/reports/213358, SSRF at apps.nextcloud.com/developer/apps/releases/new, informative 213360, https://hackerone.com/reports/213360, Content Spoofing/Text Injection in nextcloud.com, resolved 213437, https://hackerone.com/reports/213437, Critical vulnerability in JSON Web Encryption (JWE) - RFC 7516 Invalid Curve attack, resolved 213558, https://hackerone.com/reports/213558, Arbitrary Local-File Read from Admin - Restore From Backup due to Symlinks, resolved 213767, https://hackerone.com/reports/213767, Password Policy Bypass, informative 213776, https://hackerone.com/reports/213776, Remote Command Execution on a DoD website, duplicate 213779, https://hackerone.com/reports/213779, SIGSEGV - mrb_obj_value, resolved 213789, https://hackerone.com/reports/213789, Update php-saml library to 2.10.5, resolved 213936, https://hackerone.com/reports/213936, Token leakage by referrer, resolved 213942, https://hackerone.com/reports/213942, Differential "Show Raw File" feature exposes generated files to unauthorised users, resolved 213991, https://hackerone.com/reports/213991, Setting Arbitrary Cookie at kitcrm.com, resolved 214000, https://hackerone.com/reports/214000, SIGABRT - mirb and mruby, resolved 214001, https://hackerone.com/reports/214001, File access controls incorrectly enforced for files shared via QuickLink - Unshared files can be accessed, resolved 214022, https://hackerone.com/reports/214022, Admin Command Injection via username in user_archive ExportCsvFile, resolved 214028, https://hackerone.com/reports/214028, Race condition in GitLab import, giving access to other people their imports due to filename collision, resolved 214034, https://hackerone.com/reports/214034, Open redirect, resolved 214044, https://hackerone.com/reports/214044, Stored XSS in [shop].myshopify.com/admin/orders/[id], resolved 214087, https://hackerone.com/reports/214087, Clickjacking Vulnerability found on Yelp, resolved 214171, https://hackerone.com/reports/214171, Null pointer dereferences in ary_concat, resolved 214340, https://hackerone.com/reports/214340, Content spoofing due to the improper behavior of the 403 page, resolved 214370, https://hackerone.com/reports/214370, Comments Denial of Service in socialclub.rockstargames.com, resolved 214436, https://hackerone.com/reports/214436, HTTP Header Injection/HTTP_Response_Splitting, informative 214449, https://hackerone.com/reports/214449, Content-Length restriction bypass to heap overflow in gip.rocks., resolved 214484, https://hackerone.com/reports/214484, Stored XSS, resolved 214570, https://hackerone.com/reports/214570, Nginx Version Disclosure, informative 214571, https://hackerone.com/reports/214571, Login form on non-HTTPS page, resolved 214576, https://hackerone.com/reports/214576, SIGABRT - mirb - Double Free, resolved 214620, https://hackerone.com/reports/214620, Cloudflare based XSS for IE11, resolved 214642, https://hackerone.com/reports/214642, Reflected XSS on frag.mail.ru, resolved 214681, https://hackerone.com/reports/214681, Null pointer dereference in ary_concat , resolved 214763, https://hackerone.com/reports/214763, Profile bio at rockstar is accepting control characters, resolved 214798, https://hackerone.com/reports/214798, SQL injection on https://███████, resolved 214800, https://hackerone.com/reports/214800, Default page exposes admin functions and all metods and classes available. on https://██████/█████/dwr/index.html, resolved 214839, https://hackerone.com/reports/214839, Report invitation links not restricted to any existing user, resolved 214845, https://hackerone.com/reports/214845, SIGSEGV in mrb_vm_exec, resolved 215044, https://hackerone.com/reports/215044, [iOS] URL can be replaceState by blob URL in iOS Brave, resolved 215053, https://hackerone.com/reports/215053, Ability to log in as any user without authentication if █████████ is empty, resolved 215083, https://hackerone.com/reports/215083, Cleartext Password returned in JSON response, resolved 215105, https://hackerone.com/reports/215105, SSRF vulnerability in gitlab.com via project import., resolved 215326, https://hackerone.com/reports/215326, Подмена SSL-сертификата для любой группы в секции Управление группой->Работа с API неавторизированным пользователем., resolved 215372, https://hackerone.com/reports/215372, Server version/OS type disclosure via HTTP Response Header, informative 215381, https://hackerone.com/reports/215381, CSRF on Periscope Web OAuth authorization endpoint , resolved 215383, https://hackerone.com/reports/215383, Cross-Site Request Forgery, duplicate 215384, https://hackerone.com/reports/215384, [Subgroups] Unprivileged User Can Disclose Private Group Names, resolved 215410, https://hackerone.com/reports/215410, HTML Injection in Owncloud, resolved 215447, https://hackerone.com/reports/215447, SIGSEGV in mrb_class, resolved 215625, https://hackerone.com/reports/215625, A HackerOne employee's GitHub personal access token exposed in Travis CI build logs, resolved 215854, https://hackerone.com/reports/215854, Garbage collector crash, resolved 215859, https://hackerone.com/reports/215859, [REMOTE] Full Account Takeover At https://██████████████/CAS/, resolved 215891, https://hackerone.com/reports/215891, Null pointer dereference in mrb_class, resolved 215967, https://hackerone.com/reports/215967, SIGABRT in mrb_debug_info_append_file, resolved 215970, https://hackerone.com/reports/215970, [Repository Import] Open Redirect via "continue[to]" parameter , resolved 216151, https://hackerone.com/reports/216151, Use-after-free in _asyncio_Future_remove_done_callback, resolved 216161, https://hackerone.com/reports/216161, CSRF Token Design Flaw, informative 216243, https://hackerone.com/reports/216243, CSV injection in gitlab.com via issues export feature., resolved 216271, https://hackerone.com/reports/216271, SSL Padding Oracle On Downgraded Legacy Encryption (POODLE) Vulnerability, resolved 216289, https://hackerone.com/reports/216289, Раскрытие информации о частной группе или приложении, resolved 216294, https://hackerone.com/reports/216294, Session replay vulnerability in www.urbandictionary.com, resolved 216336, https://hackerone.com/reports/216336, Source Code Disclosure, informative 216351, https://hackerone.com/reports/216351, Null pointer dereferences in mrb_get_args, resolved 216373, https://hackerone.com/reports/216373, deleting payment profile during active trip puts account into arrears but active trip is temporarily “free”, resolved 216379, https://hackerone.com/reports/216379, Blind Stored XSS against Pornhub employees using Amateur Model Program, resolved 216389, https://hackerone.com/reports/216389, Full access at an internal service of Shopify, resolved 216453, https://hackerone.com/reports/216453, Unfiltered `class` attribute in markdown code, resolved 216469, https://hackerone.com/reports/216469, Reflected XSS on ht.pornhub.com - /export/GetPreview, resolved 216533, https://hackerone.com/reports/216533, ssrf xspa [https://prt.mail.ru/] 2, resolved 216615, https://hackerone.com/reports/216615, Crash in ary_concat() , resolved 216699, https://hackerone.com/reports/216699, SQL Injection vulnerability in a DoD website, resolved 216700, https://hackerone.com/reports/216700, heap use-after-free in mrb_vm_exec(), resolved 216725, https://hackerone.com/reports/216725, SIGABRT - in free, resolved 216746, https://hackerone.com/reports/216746, Phabricator is vulnerable to padding oracle attacks and chosen-ciphertext attacks., resolved 216806, https://hackerone.com/reports/216806, Reflected XSS in login redirection module, resolved 216822, https://hackerone.com/reports/216822, Stored XSS via transloadit.com and imageproxy, resolved 216992, https://hackerone.com/reports/216992, Heap Buffer Overflow in mrb_hash_keys, resolved 216998, https://hackerone.com/reports/216998, CSV Injection with the CVS export feature, informative 217058, https://hackerone.com/reports/217058, CRLF injection in info.hacker.one, resolved 217083, https://hackerone.com/reports/217083, SIGSEGV in mrb_str_inum, resolved 217097, https://hackerone.com/reports/217097, SIGSEGV in mrb_vm_exec, resolved 217108, https://hackerone.com/reports/217108, Reflected XSS in a DoD Website, resolved 217344, https://hackerone.com/reports/217344, Path traversal on ████████, resolved 217381, https://hackerone.com/reports/217381, doc.owncloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service), resolved 217430, https://hackerone.com/reports/217430, [connect.teavana.com] Open Redirect and abuse of connect.teavana.com, resolved 217431, https://hackerone.com/reports/217431, sweet32 , informative 217555, https://hackerone.com/reports/217555, Possible to unsubscribe from activities using CSRF @ mijn.werkenbijdefensie.nl, resolved 217558, https://hackerone.com/reports/217558, Possible to view and takeover other user's education and courses @ mijn.werkenbijdefensie.nl, resolved 217610, https://hackerone.com/reports/217610, kh_put_iv SEGFAULT - mruby 1.2.0, resolved 217679, https://hackerone.com/reports/217679, ВИП подарки бесплатные без подключения ВИП услуги, resolved 217739, https://hackerone.com/reports/217739, Stored XSS on any page in most Uber domains, resolved 217745, https://hackerone.com/reports/217745, XSS in $shop$.myshopify.com/admin/ via "Button Objects" in malicious app, resolved 217747, https://hackerone.com/reports/217747, Information disclosure vulnerability on a DoD website, resolved 218088, https://hackerone.com/reports/218088, Request Hijacking Vulnerability in RubyGems 2.6.11 and earlier, resolved 218136, https://hackerone.com/reports/218136, Reflected XSS vulnerability on a DoD website, resolved 218199, https://hackerone.com/reports/218199, Directory Listing In Subdomain Of nextcloud.com, informative 218226, https://hackerone.com/reports/218226, Stored XSS in comments on https://www.starbucks.co.uk/blog/*, resolved 218233, https://hackerone.com/reports/218233, Null pointer dereference in OP_ENTER, resolved 218264, https://hackerone.com/reports/218264, An Automattic employee's GitHub personal access token exposed in Travis CI build logs, resolved 218287, https://hackerone.com/reports/218287, In App purchase Hack , resolved 218324, https://hackerone.com/reports/218324, An unsafe design practice in the Passphrase may result in Secret being accidentally changed., informative 218342, https://hackerone.com/reports/218342, RCE (Remote Code Execution) Vulnerability on Ruby, not-applicable 218465, https://hackerone.com/reports/218465, [staging-engineering.gnip.com] Publicly accessible GIT directory, resolved 218567, https://hackerone.com/reports/218567, SIGSEGV in array_copy - array.c:71, resolved 218570, https://hackerone.com/reports/218570, Invalid pointer dereference in OP_ENTER, resolved 218680, https://hackerone.com/reports/218680, [buy.coinbase.com]Content Injection, resolved 218705, https://hackerone.com/reports/218705, Example HackerOne security@ forward domain is not registered, resolved 218733, https://hackerone.com/reports/218733, Design Issues on ( ███ ) Lead to show ( IPS of Users ) , resolved 218748, https://hackerone.com/reports/218748, Parameter tampering can result in product price manipulation, resolved 218803, https://hackerone.com/reports/218803, SIGABRT in sym_validate_len - symbol.c:44, resolved 218872, https://hackerone.com/reports/218872, Stored XSS on Files overview by abusing git submodule URL, resolved 218876, https://hackerone.com/reports/218876, Share tokens for public calendars disclosed (NC-SA-2017-011), resolved 218898, https://hackerone.com/reports/218898, Table and Column Exposure, resolved 218966, https://hackerone.com/reports/218966, avrecode: global-buffer-overflow in get_neighbor(), resolved 219014, https://hackerone.com/reports/219014, [dev-unifi-go.ubnt.com] Insecure CORS, Stealing Cookies, resolved 219140, https://hackerone.com/reports/219140, Reflected XSS Vulnerability in www.lahitapiola.fi/cs/Satellite, resolved 219170, https://hackerone.com/reports/219170, XSS, resolved 219171, https://hackerone.com/reports/219171, Возможность взлома любого пользователя, не использующего двухфакторной аутентификации, через получения кода восстановления на чужой номер., resolved 219192, https://hackerone.com/reports/219192, Resend invitation to members by Read only user(Privilege Escalation), resolved 219197, https://hackerone.com/reports/219197, [██████████.gnip.com] .htpasswd disclosure, resolved 219203, https://hackerone.com/reports/219203, Login bypass on travel.██████████ aka "Harvest Spring Summit 2017", resolved 219215, https://hackerone.com/reports/219215, Client can redirect payment, causing payment discrepancy between Harvest and PayPal, resolved 219293, https://hackerone.com/reports/219293, Invalid Pointer reference in L_RESCUE, resolved 219323, https://hackerone.com/reports/219323, CSV injection in gratipay.com via payment history export feature., resolved 219356, https://hackerone.com/reports/219356, Manipulation of submit payment request allows me to obtain Infrastructure Pro/Other Services for free or at greatly reduced price, resolved 219447, https://hackerone.com/reports/219447, Open redirect on marketing site, resolved 219458, https://hackerone.com/reports/219458, Open Redirect, resolved 219499, https://hackerone.com/reports/219499, POODLE SSLv3.0, informative 219509, https://hackerone.com/reports/219509, Store XSS on Informatica University via transcript (informatica.csod.com), resolved 219599, https://hackerone.com/reports/219599, Open Redirection at https://it.mail.ru/, resolved 219601, https://hackerone.com/reports/219601, Transferring incorrect data to the http://gip.rocks/v1 endpoint with correct Content-Type leads to local paths disclosure through the error message, duplicate 219657, https://hackerone.com/reports/219657, api.vk.com отдаёт в ответ HTML авторизированную страницу vk.com, resolved 219715, https://hackerone.com/reports/219715, Раскрытие имени файла приватных документов, resolved 219729, https://hackerone.com/reports/219729, Reflected XSS on a DoD website, resolved 219821, https://hackerone.com/reports/219821, XSS, resolved 219870, https://hackerone.com/reports/219870, mirb only: stack-buffer-overflow (OOB write) in main(), resolved 220009, https://hackerone.com/reports/220009, Lack of input sanitization in Marketo form leads to execution of HTML in lead emails, resolved 220116, https://hackerone.com/reports/220116, SSLv3 Poodle Vulnerability, resolved 220150, https://hackerone.com/reports/220150, 200 http code in 403 forbidden directories on main Ubnt.com domain, resolved 220185, https://hackerone.com/reports/220185, Password reset Token not expiring , resolved 220385, https://hackerone.com/reports/220385, Delete All Data of Any User, resolved 220445, https://hackerone.com/reports/220445, Race condition leads to duplicate payouts, resolved 220615, https://hackerone.com/reports/220615, Expired SSL certificate, resolved 220737, https://hackerone.com/reports/220737, Tabnabbing via Window.Opener @Mavenlink, resolved 220774, https://hackerone.com/reports/220774, API Last Request Date/Time Not Updating, resolved 220852, https://hackerone.com/reports/220852, XSS STORED AT socialclub.rockstargames.com (add friend request from profile attacker), resolved 220864, https://hackerone.com/reports/220864, Unauthorized access to attachments details of Private Calendar appointments (Access control issue), resolved 220874, https://hackerone.com/reports/220874, Critical : View/Edit access to private appointments of calendar folder by read only user (Vertical privilege escalation), resolved 220903, https://hackerone.com/reports/220903, Authenticated Cross-site Scripting in Template Name, resolved 220909, https://hackerone.com/reports/220909, Autoclose can close any task regardless of policies/spaces, resolved 220946, https://hackerone.com/reports/220946, https://portal.nextcloud.com/.htaccess file is readable, resolved 221041, https://hackerone.com/reports/221041, Cookie bomb, resolved 221133, https://hackerone.com/reports/221133, Sub Domain Takeover, resolved 221163, https://hackerone.com/reports/221163, heap-buffer-overflow (read outside of buffer) in Sass::Prelexer::exactly<(char)92>(char const*) - libsass/src/lexer.hpp:92, informative 221250, https://hackerone.com/reports/221250, /accounts/USERID.json file is left open for Restricted User of organization disclosing Owners's Mobile Number and "billing_info, cc_email", duplicate 221251, https://hackerone.com/reports/221251, heap-buffer-overflow (read outside of buffer) in mrb_vm_exec(), resolved 221260, https://hackerone.com/reports/221260, stack overflow in libsass, resolved 221262, https://hackerone.com/reports/221262, stack overflow #2 in libsass, resolved 221264, https://hackerone.com/reports/221264, stack overflow #3 in libsass, resolved 221267, https://hackerone.com/reports/221267, stack overflow #4 in libsass, resolved 221286, https://hackerone.com/reports/221286, stack overflow #5 in libsass, resolved 221287, https://hackerone.com/reports/221287, null pointer dereference in Sass::Eval::operator()(Sass::Map*), resolved 221289, https://hackerone.com/reports/221289, heap-use-after-free in Sass::SharedPtr::incRefCount(), resolved 221292, https://hackerone.com/reports/221292, stack overflow #6 in libsass, resolved 221294, https://hackerone.com/reports/221294, Java Deserialization RCE via JBoss on card.starbucks.in, resolved 221298, https://hackerone.com/reports/221298, GIT Detected, resolved 221325, https://hackerone.com/reports/221325, Stored XSS in Express Objects - Concrete5 v8.1.0, resolved 221328, https://hackerone.com/reports/221328, HTTP 401 response injection on "amp.twimg.com/amplify-web-player/prod/source.html" through "image_src" parameter, resolved 221333, https://hackerone.com/reports/221333, Information Disclosure, informative 221380, https://hackerone.com/reports/221380, Stored XSS in RSS Feeds Title (Concrete5 v8.1.0), resolved 221432, https://hackerone.com/reports/221432, CSRF-Token leak by request forgery, resolved 221454, https://hackerone.com/reports/221454, Privilege escalation in the client impersonation functionality, resolved 221461, https://hackerone.com/reports/221461, homograph-attack (unicode vuln), duplicate 221507, https://hackerone.com/reports/221507, Multiple stored XSS in WordPress, resolved 221625, https://hackerone.com/reports/221625, UBNT Amplification DDOS Attack, resolved 221631, https://hackerone.com/reports/221631, [ux.shopify.com] Subdomain takeover, resolved 221712, https://hackerone.com/reports/221712, Null pointer dereferences in kh_copy_mt, resolved 221757, https://hackerone.com/reports/221757, Blind SQL Injection, resolved 221833, https://hackerone.com/reports/221833, [https://jenkins.brew.sh] Jenkins in Debug Mode with Stack Traces Enabled, resolved 221869, https://hackerone.com/reports/221869, Email enumeration of users, resolved 221883, https://hackerone.com/reports/221883, DOM-based XSS on youporn.com (main page), resolved 221893, https://hackerone.com/reports/221893, XSS in the search bar of mercantile.wordpress.org, resolved 221908, https://hackerone.com/reports/221908, Host header Injection, informative 221948, https://hackerone.com/reports/221948, The mailbox verification API interface is unlimited and can be used as a mailbox bomb, not-applicable 221950, https://hackerone.com/reports/221950, The special code in editor has no Authority control and can lead to Information Disclosure, informative 221955, https://hackerone.com/reports/221955, duplicate hsts headers lead to firefox ignoring hsts on business.uber.com, resolved 221989, https://hackerone.com/reports/221989, Server version disclosure on [jenkins.brew.sh], informative 222036, https://hackerone.com/reports/222036, Missing SSL can leak job token , resolved 222040, https://hackerone.com/reports/222040, Reflected XSS at https://da.wordpress.org/themes/?s= via "s=" parameter , resolved 222058, https://hackerone.com/reports/222058, Content Spoofing/Text Injection in https://demo.nextcloud.com, resolved 222063, https://hackerone.com/reports/222063, Sensitive information disclosure via response headers on jenkins.brew.sh, duplicate 222080, https://hackerone.com/reports/222080, The email API to reset password is unlimited and can be used as a email bomb, duplicate 222082, https://hackerone.com/reports/222082, Broken Authentication & Session Management (Login Bypass) at support.owox.com, resolved 222096, https://hackerone.com/reports/222096, [bot.brew.sh] Full Path Disclosure, resolved 222108, https://hackerone.com/reports/222108, Stack Trace on jenkins.brew.sh, informative 222171, https://hackerone.com/reports/222171, heap use after free in fiber_switch, resolved 222252, https://hackerone.com/reports/222252, Дубликат: https://hackerone.com/reports/219171 (доступ к аккаунту, через сброс пароля), resolved 222294, https://hackerone.com/reports/222294, heap-use-after-free in mrb_vm_exec - vm.c:1247, resolved 222506, https://hackerone.com/reports/222506, Mixed Reflected-Stored XSS on pornhub.com (without user interaction) in the playlist playing section, resolved 222556, https://hackerone.com/reports/222556, XSS on pornhubselect.com, resolved 222660, https://hackerone.com/reports/222660, The email API to test email-server settings is unlimited and can be used as a email bomb, informative 222667, https://hackerone.com/reports/222667, Possible SSRF in email server settings(SMTP mode), informative 222692, https://hackerone.com/reports/222692, plugins.trac.wordpress.org likely vulnerable to Cross Site Tracing (xst), TRACE HTTP method should be disabled, resolved 222724, https://hackerone.com/reports/222724, Open Aws Amazon S3 Buckets, resolved 222762, https://hackerone.com/reports/222762, Clickjacking In https://demo.nextcloud.com, not-applicable 222805, https://hackerone.com/reports/222805, Content (Text) Injection at https://nextcloud.com, informative 222838, https://hackerone.com/reports/222838, Stored XSS in Gallery application (NC-SA-2017-010), resolved 222870, https://hackerone.com/reports/222870, IRC-Bot exposes information, resolved 223014, https://hackerone.com/reports/223014, SAML Authentication Bypass on uchat.uberinternal.com, resolved 223024, https://hackerone.com/reports/223024, Clickjacking In jobs.wordpress.net, resolved 223172, https://hackerone.com/reports/223172, Просмотр привязного к странице email, всего лишь раз скомпрометировав письмо-уведомление, resolved 223203, https://hackerone.com/reports/223203, SVG Server Side Request Forgery (SSRF), resolved 223324, https://hackerone.com/reports/223324, Registration captcha bypass, resolved 223326, https://hackerone.com/reports/223326, Open Redirect via "next" parameter in third-party authentication, resolved 223327, https://hackerone.com/reports/223327, No expiration of session ID after Password change, resolved 223329, https://hackerone.com/reports/223329, Logout CSRF, resolved 223331, https://hackerone.com/reports/223331, [demo.weblate.org] Stored Self-XSS via Editor Link in Profile, resolved 223333, https://hackerone.com/reports/223333, CSRF : Reset API , resolved 223337, https://hackerone.com/reports/223337, No BruteForce Protection, resolved 223339, https://hackerone.com/reports/223339, Activation tokens are not expiring, resolved 223343, https://hackerone.com/reports/223343, Already Registered Email Disclosure, resolved 223344, https://hackerone.com/reports/223344, CSV Injection with the CSV export feature, resolved 223345, https://hackerone.com/reports/223345, CSRF : Lock and Unlock Translation, resolved 223350, https://hackerone.com/reports/223350, Web server is vulnerable to Beast Attack, resolved 223355, https://hackerone.com/reports/223355, Insecure Account Removal, resolved 223362, https://hackerone.com/reports/223362, Improper Password Reset Policy on https://hosted.weblate.org/, resolved 223363, https://hackerone.com/reports/223363, Escape sequence injection vulnerability in WEBrick BasicAuth, resolved 223367, https://hackerone.com/reports/223367, CSRF - Changing the full name / adding a secondary email identity of an account via a GET request, resolved 223374, https://hackerone.com/reports/223374, You can simply just use passwords that simply are as 123456, resolved 223384, https://hackerone.com/reports/223384, Directory Listing , resolved 223391, https://hackerone.com/reports/223391, Clickjacking docs.weblate.org, resolved 223396, https://hackerone.com/reports/223396, hosted.weblate.org: X-XSS-Protection not enabled, resolved 223421, https://hackerone.com/reports/223421, Open port leads to information disclosure, informative 223427, https://hackerone.com/reports/223427, Login using disconnected google account i.e login using old email id, resolved 223430, https://hackerone.com/reports/223430, Content Spoofing, resolved 223434, https://hackerone.com/reports/223434, Improper access control when an added email address is deleted from authentication, duplicate 223435, https://hackerone.com/reports/223435, Open SMTP port can let anyone send email from mail.chihar.com, not-applicable 223454, https://hackerone.com/reports/223454, Missing restriction on string size of Full Name at https://demo.weblate.org/accounts/register/, resolved 223456, https://hackerone.com/reports/223456, Content Spoofing in error message, resolved 223461, https://hackerone.com/reports/223461, Weak e-mail change functionality could lead to account takeover, resolved 223475, https://hackerone.com/reports/223475, Existing sessions valid after removing third party auth, resolved 223525, https://hackerone.com/reports/223525, Spamming any user from Reset Password Function, resolved 223531, https://hackerone.com/reports/223531, User Enumeration when adding email to account, resolved 223542, https://hackerone.com/reports/223542, Abuse of Api that causes spamming users and possible DOS due to missing rate limit on contact form, resolved 223545, https://hackerone.com/reports/223545, Missing DMARC on weblate.org, resolved 223557, https://hackerone.com/reports/223557, Abuse of Api that causes spamming users and possible DOS due to missing rate limit, resolved 223597, https://hackerone.com/reports/223597, Посмотреть видеоролики, которые пользователь когда-либо скидывал в ЛС. , resolved 223609, https://hackerone.com/reports/223609, Notify user about password change, resolved 223618, https://hackerone.com/reports/223618, Null Password - Setting a new password doesn't check for empty spaces, resolved 223625, https://hackerone.com/reports/223625, Subdomain Takeover (and Stored XSS) via Trailing Dot at https://coding-exercises.udemy.com, resolved 223630, https://hackerone.com/reports/223630, Content Spoofing, duplicate 223637, https://hackerone.com/reports/223637, [hosted.weblate.org]Account Takeover, resolved 223653, https://hackerone.com/reports/223653, demo.weblate.org is vulnerable to SWEET32 Vulnerability, resolved 223692, https://hackerone.com/reports/223692, Self XSS at translation page through Editor Link at demo.weblate.org, resolved 223694, https://hackerone.com/reports/223694, No Rate Limitting at Change Password, resolved 223718, https://hackerone.com/reports/223718, Open redirect in Signing in via Social Sites, duplicate 223723, https://hackerone.com/reports/223723, weblate.org: X-XSS-Protection not enabled, resolved 223759, https://hackerone.com/reports/223759, information disclose, informative 223846, https://hackerone.com/reports/223846, Access to completion page without performing any action, resolved 223851, https://hackerone.com/reports/223851, Setting a password with a single character, resolved 223854, https://hackerone.com/reports/223854, No Password Length Restriction leads to Denial of Service, resolved 223906, https://hackerone.com/reports/223906, Dropbox Paper - Markdown XSS, resolved 223931, https://hackerone.com/reports/223931, Specify maximal length in new comment, resolved 223936, https://hackerone.com/reports/223936, Multiple cryptographic vulnerabilities in login page on ███████, resolved 223999, https://hackerone.com/reports/223999, CSV export filter bypass leads to formula injection., resolved 224006, https://hackerone.com/reports/224006, HttpOnly Flag not set , resolved 224015, https://hackerone.com/reports/224015, Specify maximal length in translation, resolved 224072, https://hackerone.com/reports/224072, Running 2 accounts with a single email, resolved 224095, https://hackerone.com/reports/224095, password reset email spamming, not-applicable 224096, https://hackerone.com/reports/224096, ShopifyAPI is vulnerable to timing attacks., resolved 224108, https://hackerone.com/reports/224108, Cross Site Scripting, informative 224186, https://hackerone.com/reports/224186, Email spoofing at weblate.org, resolved 224198, https://hackerone.com/reports/224198, Missing/Breach of Internal Security Boundary - Access to Job Queue Results in Remote Code Execution, informative 224214, https://hackerone.com/reports/224214, Lack of Password Confirmation when Changing Password and Email, duplicate 224287, https://hackerone.com/reports/224287, Email verification over an unencrypted channel, resolved 224291, https://hackerone.com/reports/224291, CSV Injection with the CVS export feature - Glossary, resolved 224317, https://hackerone.com/reports/224317, Open redirect while disconnecting authenticated account, resolved 224342, https://hackerone.com/reports/224342, Bypassing captcha in registration on Hosted site, informative 224362, https://hackerone.com/reports/224362, Invalidate session after password reset - hosted website, duplicate 224379, https://hackerone.com/reports/224379, session id missing secure flag - Hosted Website, resolved 224460, https://hackerone.com/reports/224460, Rate Limit Bypass on login Page, resolved 224556, https://hackerone.com/reports/224556, Self-XSS in WordPress Editor Link Modal, resolved 224572, https://hackerone.com/reports/224572, Weak password policy, resolved 224904, https://hackerone.com/reports/224904, SSL Key Certificate expires, informative 224927, https://hackerone.com/reports/224927, Missing Rate Limiting protection leading to mass triggering of e-mails, resolved 225020, https://hackerone.com/reports/225020, reflected xss @ www.█████████, resolved 225098, https://hackerone.com/reports/225098, SQL exception in JSON format, resolved 225100, https://hackerone.com/reports/225100, CSRF to Connect third party Account, resolved 225326, https://hackerone.com/reports/225326, CSRF For Adding Users, resolved 225495, https://hackerone.com/reports/225495, full path disclosure at hosted.weblate.org/admin/accounts/profile/ , resolved 225537, https://hackerone.com/reports/225537, Node modules path disclosure due to lack of error handling, resolved 225540, https://hackerone.com/reports/225540, Incorrect HTTPS Certificate, resolved 225555, https://hackerone.com/reports/225555, ClickJacking on Debug, resolved 225653, https://hackerone.com/reports/225653, Account Takeover using Third party Auth CSRF, resolved 225722, https://hackerone.com/reports/225722, 7BO: Binary Option Robot URL should be HTTPS, resolved 225754, https://hackerone.com/reports/225754, Insecure SHA1withRSA in b5s.hackerone-ext-content.com and a4l.hackerone-ext-content.com, resolved 225769, https://hackerone.com/reports/225769, Facebook share URL should be HTTPS, resolved 225777, https://hackerone.com/reports/225777, DOMPurify 0.8.9 released, resolved 225831, https://hackerone.com/reports/225831, Extract Billing admin email address using random team id, resolved 225897, https://hackerone.com/reports/225897, Throttling Bypass - ws1.dashlane.com, resolved 225901, https://hackerone.com/reports/225901, Missing filteration of meta characters in full name field on registration page https://demo.weblate.org/accounts/register, resolved 225936, https://hackerone.com/reports/225936, Cross-site scripting (XSS) vulnerability on a DoD website, resolved 226037, https://hackerone.com/reports/226037, Wordpress Vulnerable to Potential Unauthorized Password Reset, resolved 226094, https://hackerone.com/reports/226094, I am because bug, spam 226097, https://hackerone.com/reports/226097, I am because bug, spam 226104, https://hackerone.com/reports/226104, Incomplete fix for #181225 (target=_blank vulnerability), not-applicable 226188, https://hackerone.com/reports/226188, I am because bug, spam 226199, https://hackerone.com/reports/226199, Changing Victim's JIRA Integration Settings Through Multiple Bugs, resolved 226203, https://hackerone.com/reports/226203, Cross-site-Scripting, resolved 226211, https://hackerone.com/reports/226211, SQL Injection vulnerability in a DoD website, resolved 226212, https://hackerone.com/reports/226212, directory information disclose, informative 226245, https://hackerone.com/reports/226245, Remote code execution (RCE) in multiple DoD websites, resolved 226334, https://hackerone.com/reports/226334, Improper validation of Email , informative 226335, https://hackerone.com/reports/226335, Escape sequence injection in "summary" field, resolved 226343, https://hackerone.com/reports/226343, Full Path Disclosure in airship.paragonie.com '/cabins/', informative 226408, https://hackerone.com/reports/226408, Open Redirect in shopify app URL, resolved 226418, https://hackerone.com/reports/226418, HackerOne reports escalation to JIRA is CSRF vulnerable, resolved 226427, https://hackerone.com/reports/226427, Information disclosure vulnerability on a DoD website, resolved 226505, https://hackerone.com/reports/226505, There is an vulnerability in https://bridge.cspr.ng where an attacker can users directory, informative 226514, https://hackerone.com/reports/226514, Full Path Disclousure on https://airship.paragonie.com, informative 226518, https://hackerone.com/reports/226518, no session logout after changing the password in https://bridge.cspr.ng/, informative 226612, https://hackerone.com/reports/226612, CSRF, resolved 226640, https://hackerone.com/reports/226640, IDOR in tender.mail.ru leading to Information Disclosure, resolved 226648, https://hackerone.com/reports/226648, Unauthorized access to the slack channel via inside.gratipay.com/appendices/chat, informative 226659, https://hackerone.com/reports/226659, Password Reset link hijacking via Host Header Poisoning , resolved 226712, https://hackerone.com/reports/226712, Broken Authentication & Session Management - Failure to Invalidate Session on all other browsers at Password change, not-applicable 226756, https://hackerone.com/reports/226756, local file disclosure via FFmpeg hls processing, resolved 226783, https://hackerone.com/reports/226783, HTML Injection on airlink.ubnt.com, resolved 227102, https://hackerone.com/reports/227102, Two Error-Based SQLi in courses.aspx on ██████████, resolved 227230, https://hackerone.com/reports/227230, API Webhooks Fire And Are Unlisted After Permissions Removed, resolved 227298, https://hackerone.com/reports/227298, dom based xss in *.zendesk.com/external/zenbox/, resolved 227344, https://hackerone.com/reports/227344, CVE-2017-8798 - miniupnp getHTTPResponse chunked encoding integer signedness error, resolved 227486, https://hackerone.com/reports/227486, XSS on https://www.starbucks.co.uk (can lead to credit card theft) (/shop/paymentmethod), resolved 227522, https://hackerone.com/reports/227522, IDOR in editing courses, resolved 227587, https://hackerone.com/reports/227587, SQL Injection vulnerability in a DoD website, resolved 227643, https://hackerone.com/reports/227643, Cross-site scripting (XSS) vulnerability on a DoD website, resolved 227659, https://hackerone.com/reports/227659, Weak password requirement on techsupport.teradici.com , resolved 227663, https://hackerone.com/reports/227663, [https://www.dashlane.com] Test Panel Disclosure, resolved 227725, https://hackerone.com/reports/227725, Missing CSRF Token On Add Coupon To Basket, duplicate 227726, https://hackerone.com/reports/227726, Missing CSRF Token On Remove Coupun From Cart, duplicate 227762, https://hackerone.com/reports/227762, Heap Overflow in fiber_switch triggered from Fiber.transfer, resolved 227781, https://hackerone.com/reports/227781, Получение предложенных фотографий паблику , resolved 227806, https://hackerone.com/reports/227806, [qiwi.me] No limits on image download requests, resolved 227837, https://hackerone.com/reports/227837, ClickJacking in editing business name, informative 227880, https://hackerone.com/reports/227880, XXE in DoD website that may lead to RCE, resolved 228006, https://hackerone.com/reports/228006, Cross-site Scripting (XSS) on [maximum.nl] , resolved 228112, https://hackerone.com/reports/228112, Directory Disclose,Email Disclose Zendmail vulnerability, resolved 228156, https://hackerone.com/reports/228156, https://www.legalrobot.com/, not-applicable 228295, https://hackerone.com/reports/228295, User can be fooled to Bookmark any restaurant by clickjacking, informative 228323, https://hackerone.com/reports/228323, Weak Password Policy on techsupport.teradici.com, duplicate 228383, https://hackerone.com/reports/228383, IDOR on DoD Website exposes FTP users and passes linked to all accounts!, resolved 228399, https://hackerone.com/reports/228399, Any authenticated user can download full list of users, including email, resolved 228471, https://hackerone.com/reports/228471, DNSSEC Zone Walk using NSEC Records, informative 228495, https://hackerone.com/reports/228495, Partial disclosure of Private Videos through data-mediabook attribute information leak, resolved 228539, https://hackerone.com/reports/228539, self xss in, not-applicable 228648, https://hackerone.com/reports/228648, WannaCrypt “Killswitch”, resolved 228825, https://hackerone.com/reports/228825, (Authenticated) RCE by bypassing of the .htaccess blacklist, resolved 228854, https://hackerone.com/reports/228854, WordPress Automatic Update Protocol Does Not Authenticate Updates Provided by the Server, not-applicable 228873, https://hackerone.com/reports/228873, Misconfiguration: Missing Custom Error Page (CWE-12 & CWE-756), informative 229170, https://hackerone.com/reports/229170, RTLO character allowed in shared files, informative 229199, https://hackerone.com/reports/229199, Limited code execution vulnerability on a DoD website, resolved 229405, https://hackerone.com/reports/229405, Csrf in watch-unwatch projects, resolved 229417, https://hackerone.com/reports/229417, Design Flaw in session management of password reset , resolved 229483, https://hackerone.com/reports/229483, Improper validation of unicode characters, resolved 229498, https://hackerone.com/reports/229498, Host header injection/redirection via newsletter signup, resolved 229511, https://hackerone.com/reports/229511, No Rate Limiting at /contact, resolved 229528, https://hackerone.com/reports/229528, Login CSRF : Login Authentication Flaw, resolved 229532, https://hackerone.com/reports/229532, Insecure Account Removal #2, resolved 229541, https://hackerone.com/reports/229541, Captcha Bypass at Email Reset can lead to Spamming users., resolved 229577, https://hackerone.com/reports/229577, Old password can be new password, resolved 229584, https://hackerone.com/reports/229584, Captcha bypass at registration, informative 229599, https://hackerone.com/reports/229599, Email Spoofing Vulnerability from nextcloud., spam 229622, https://hackerone.com/reports/229622, Directory traversal at https://nightly.ubnt.com, resolved 229690, https://hackerone.com/reports/229690, Amazon S3 bucket misconfiguration (share), resolved 229796, https://hackerone.com/reports/229796, Missing restriction on string size, resolved 229825, https://hackerone.com/reports/229825, Rate Limit Issue on hosted.weblate.org, resolved 229869, https://hackerone.com/reports/229869, Adding Email lacks Password validation, resolved 229909, https://hackerone.com/reports/229909, No notificatoin sent on email after account deletion., resolved 229920, https://hackerone.com/reports/229920, Password Restriction, resolved 229987, https://hackerone.com/reports/229987, Password token validation in https://demo.weblate.org/, resolved 230029, https://hackerone.com/reports/230029, Stored XSS in Pages SEO dialog Name field (concrete5 8.1.0), resolved 230076, https://hackerone.com/reports/230076, Takeover of an account via reset password options after removing the account, resolved 230098, https://hackerone.com/reports/230098, Full directory path listing, spam 230119, https://hackerone.com/reports/230119, Reflected XSS in Zomato Mobile - category parameter, resolved 230194, https://hackerone.com/reports/230194, Option method enabled, resolved 230231, https://hackerone.com/reports/230231, XSS в портальной навигации, resolved 230278, https://hackerone.com/reports/230278, Stored XSS in Headline TextControl element in Express forms [ concrete5 8.1.0 ], resolved 230328, https://hackerone.com/reports/230328, IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email , resolved 230428, https://hackerone.com/reports/230428, Csrf bug on signup session, informative 230435, https://hackerone.com/reports/230435, DOM Based XSS In mercantile.wordpress.org, resolved 230525, https://hackerone.com/reports/230525, Domain takeover (legalrobot.co.za), resolved 230581, https://hackerone.com/reports/230581, Clickjacking wordcamp.org, resolved 230608, https://hackerone.com/reports/230608, [marketplace.informatica.com] User email disclosure, resolved 230633, https://hackerone.com/reports/230633, Weblate- Banner Grabbing-Ngnix Server version, resolved 230648, https://hackerone.com/reports/230648, Weblate |Security Misconfiguration| Method Enumeration Possible on domain , resolved 230674, https://hackerone.com/reports/230674, No rate limiting at POST /2/2017-05-22/send_identifier_token, resolved 230681, https://hackerone.com/reports/230681, Reflected XSS on Branch domain, resolved 230688, https://hackerone.com/reports/230688, CSRF на сброс ключа трансляции., resolved 230714, https://hackerone.com/reports/230714, Arbitary file download vulnerability on a DoD website, resolved 230832, https://hackerone.com/reports/230832, cuvva.com vulnerable to sweet32, informative 230837, https://hackerone.com/reports/230837, CSRF To Like/Unlike Photos, resolved 230863, https://hackerone.com/reports/230863, CSRF bypass ( Delate Source Translation From dictionaries ) in demo.weblate.org, resolved 230870, https://hackerone.com/reports/230870, Arbitary file download vulnerability on a DoD website, resolved 231062, https://hackerone.com/reports/231062, CSP "script-src" includes "unsafe-inline" in weblate.org and demo.weblate.org, informative 231068, https://hackerone.com/reports/231068, RC4 cipher suit in use in vpn.corp.cuvva.co, resolved 231086, https://hackerone.com/reports/231086, CSP "script-src" includes "unsafe-inline" in https://gratipay.com, informative 231267, https://hackerone.com/reports/231267, Development configuration file, resolved 231374, https://hackerone.com/reports/231374, cuvva.com website CSP "script-src" includes "unsafe-inline", informative 231380, https://hackerone.com/reports/231380, Missing rate limit on https://underwriter.partner.cuvva.com/login, resolved 231389, https://hackerone.com/reports/231389, Stored XSS in snapmatic comments, resolved 231434, https://hackerone.com/reports/231434, https://admin.corp.cuvva.co/ is vulnerable to Clickjacking attacks due to missing X-Frame-Options , resolved 231444, https://hackerone.com/reports/231444, Stored XSS in profile activity feed messages, resolved 231460, https://hackerone.com/reports/231460, Open prod Jenkins instance, resolved 231508, https://hackerone.com/reports/231508, CRLF Injection [vpn.corp.cuvva.com], resolved 231510, https://hackerone.com/reports/231510, Gratipay Website CSP "script-scr" includes "unsafe-inline", informative 231524, https://hackerone.com/reports/231524, HTML injection and limited XSS via logo image upload - Nextcloud 12.0.0, resolved 231687, https://hackerone.com/reports/231687, Remote Code Execution (RCE) vulnerability in multiple DoD websites, resolved 231694, https://hackerone.com/reports/231694, Clickjacking vulnerability in support-dashboard.corp.cuvva.co, informative 231713, https://hackerone.com/reports/231713, OLX is vulnerable to clickjaking, informative 231738, https://hackerone.com/reports/231738, No Notification Sent When Email Is Changed., resolved 231749, https://hackerone.com/reports/231749, Your two domain login email address are disclosed in , resolved 231760, https://hackerone.com/reports/231760, Open redirect on sign in , not-applicable 231805, https://hackerone.com/reports/231805, Insecure Cache-Control Leading to API key Retrieval, resolved 231813, https://hackerone.com/reports/231813, Verification code for Underwriter dashboard can be brute-forced, informative 231917, https://hackerone.com/reports/231917, Shared file link - password protection bypass under certain conditions, resolved 231926, https://hackerone.com/reports/231926, Remote Code Execution (RCE) in a DoD website, resolved 232150, https://hackerone.com/reports/232150, heap-buffer-overflow (READ of size 11) in Perl 5.25.x, resolved 232174, https://hackerone.com/reports/232174, XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applications, resolved 232185, https://hackerone.com/reports/232185, Subdomain take over oh-no.cuvva.co and ohno.cuvva.co, informative 232306, https://hackerone.com/reports/232306, Improper Cookie expiration | Cookies Expiration Set to Future , resolved 232327, https://hackerone.com/reports/232327, CRLF Injection on openvpn.svc.ubnt.com, resolved 232330, https://hackerone.com/reports/232330, Remote Code Execution (RCE) vulnerability in a DoD website, resolved 232347, https://hackerone.com/reports/232347, [FG-VD-17-063] NextCloud Insufficient Attack Protection Vulnerability Notification, resolved 232403, https://hackerone.com/reports/232403, Missing Rate limiting on https://underwriter.partner.cuvva.com/login, duplicate 232432, https://hackerone.com/reports/232432, Universal Cross-Site Scripting in Keybase Chrome extension, resolved 232499, https://hackerone.com/reports/232499, Control characters incorrectly handled on Crew Status Update, resolved 232562, https://hackerone.com/reports/232562, IDOR spam anyone's cellphone number through Cuvva app link, informative 232614, https://hackerone.com/reports/232614, Uploaded XLF files result in External Entity Execution, resolved 232878, https://hackerone.com/reports/232878, Missing rate-limits at endpoints, resolved 232994, https://hackerone.com/reports/232994, API Does Not Apply Access Controls to Translations, resolved 233099, https://hackerone.com/reports/233099, CSRF in Report Lost or Stolen Page https://www.starbucks.com/account/card, resolved 233376, https://hackerone.com/reports/233376, mailbomb through invite feature on chrome addon, resolved 233379, https://hackerone.com/reports/233379, Attacker can trick other into logging in as themselves, resolved 233402, https://hackerone.com/reports/233402, Possible Subdomain Takeover, resolved 233408, https://hackerone.com/reports/233408, Subdomain takeover (sales.mixmax.com), resolved 233440, https://hackerone.com/reports/233440, heap-buffer-overflow (READ of size 61) in Perl_re_intuit_start(), resolved 234701, https://hackerone.com/reports/234701, Security Vulnerability - SMTP protection not used, resolved 234713, https://hackerone.com/reports/234713, Clickjacking on Mixmax.com, resolved 234758, https://hackerone.com/reports/234758, CRLF Injection on https://vpn.mixmax.com, resolved 234947, https://hackerone.com/reports/234947, Sensitive Support Mail Disclosure, resolved 235016, https://hackerone.com/reports/235016, rpcbind "rpcbomb" CVE-2017-8779, CVE-2017-8804, resolved 235059, https://hackerone.com/reports/235059, Privilege escalation-User who does not have access is able to add notes to the contact, resolved 235139, https://hackerone.com/reports/235139, Twitter SSO allows unverified e-mail registration, leads to Slack and social media hijacks, resolved 235200, https://hackerone.com/reports/235200, Cross-origin resource sharing misconfig | steal user information , resolved 235216, https://hackerone.com/reports/235216, Exposed FTP Credentials on ███████, resolved 235292, https://hackerone.com/reports/235292, [compose.mixmax.com] Stored XSS on compose.mixmax.com in contact names., resolved 235605, https://hackerone.com/reports/235605, Remote Code Execution (RCE) in DoD Websites, resolved 235642, https://hackerone.com/reports/235642, [CRITICAL] Full account takeover using CSRF, resolved 235842, https://hackerone.com/reports/235842, Ruby 2.3.x and 2.2.x still bundle DoS vulnerable verision of libYAML, resolved 235866, https://hackerone.com/reports/235866, Cross-site Scripting (XSS) in /updates-pro/archive/, resolved 236188, https://hackerone.com/reports/236188, Missing restriction on string size of contact field, resolved 236276, https://hackerone.com/reports/236276, Unable to register in starbucks app, not-applicable 236301, https://hackerone.com/reports/236301, Blind SSRF due to img tag injection in career form, resolved 236349, https://hackerone.com/reports/236349, [out-of-scope] toxiproxy: Lack of CSRF protection allows an attacker to gain access to internal Shopify network, resolved 236390, https://hackerone.com/reports/236390, Email Leakage in staging environment, resolved 236398, https://hackerone.com/reports/236398, no captcha for register user and weak question attacker can spam email, resolved 236533, https://hackerone.com/reports/236533, Session cookie without secure flag on https://underwriter.partner.cuvva.com, resolved 236552, https://hackerone.com/reports/236552, Unauthenticated RCE in Vaultpress, resolved 236599, https://hackerone.com/reports/236599, Open redirects protection bypass, resolved 236607, https://hackerone.com/reports/236607, Remote Code Execution in the Import Channel function, resolved 237071, https://hackerone.com/reports/237071, X-Frame-Options, informative 237100, https://hackerone.com/reports/237100, [app.mixmax.com] Stored XSS on Adding new enhancement., resolved 237125, https://hackerone.com/reports/237125, no string size restriction on team name, resolved 237184, https://hackerone.com/reports/237184, Session fixation in password protected public download., resolved 237232, https://hackerone.com/reports/237232, Unauthenticated 'display name' information leak on enumeration of login names, resolved 237262, https://hackerone.com/reports/237262, Invitation tokens leak to Google Analytics, resolved 237357, https://hackerone.com/reports/237357, CRLF Injection at vpn.bitstrips.com, resolved 237381, https://hackerone.com/reports/237381, SSRF and local file disclosure in https://wordpress.com/media/videos/ via FFmpeg HLS processing, resolved 237544, https://hackerone.com/reports/237544, Weak Password Policy, informative 237860, https://hackerone.com/reports/237860, ci.nextcloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service), resolved 237915, https://hackerone.com/reports/237915, PHP mbstring / Oniguruma multiple remote heap/stack corruptions, resolved 237927, https://hackerone.com/reports/237927, Stored XSS templates -> 'call for action' feature, resolved 238041, https://hackerone.com/reports/238041, BruteForce Any [My.com] Account Credentials., resolved 238117, https://hackerone.com/reports/238117, Open redirect while disconnecting Email, resolved 238260, https://hackerone.com/reports/238260, Uninstalling Slack for Windows (64-bit), then reinstalling keeps you logged in without authentication, resolved 238344, https://hackerone.com/reports/238344, http://lists.parrotsec.org vulnerable to MITM, resolved 238842, https://hackerone.com/reports/238842, XSS on http://irc.parrotsec.org, resolved 238890, https://hackerone.com/reports/238890, SAUCE Access_key and User_name leaked in Travis CI build logs, resolved 238906, https://hackerone.com/reports/238906, Stored XSS in Templates>Enahance>Social Badges, resolved 238915, https://hackerone.com/reports/238915, Text injection on status.algolia.com, resolved 239170, https://hackerone.com/reports/239170, CSRF bug , not-applicable 239359, https://hackerone.com/reports/239359, Timing attack woocommerce, simplify commerce gateway, resolved 239380, https://hackerone.com/reports/239380, Session Cookie without HttpOnly and secure flag set, informative 239479, https://hackerone.com/reports/239479, HTTP - Basic Authentication on https://www.stellar.org/wp-login.php, not-applicable 239481, https://hackerone.com/reports/239481, [gamesventures.mail.ru] Publicly accessible GIT directory, resolved 239482, https://hackerone.com/reports/239482, [sputnik.mail.ru] Publicly accessible GIT directory, resolved 239503, https://hackerone.com/reports/239503, Open Redirect & Information Disclosure [mijn.werkenbijdefensie.nl], resolved 239623, https://hackerone.com/reports/239623, Many Slack teams can be joined by abusing an improperly configured support@ inbox, resolved 239719, https://hackerone.com/reports/239719, Privilege Escalation using API->Feature, resolved 239762, https://hackerone.com/reports/239762, XSS at https://app.goodhire.com/member/GH.aspx, resolved 239818, https://hackerone.com/reports/239818, Design issue with webhook (several) notifications on mixmax.com, resolved 240048, https://hackerone.com/reports/240048, Imperfect CSRF To Overwrite Server Config at /go/admin/restful/configuration/file/POST/xml, resolved 240083, https://hackerone.com/reports/240083, Updating payout preference to CurrencyCloud doesn't notify user via email, resolved 240091, https://hackerone.com/reports/240091, Open redirect at app.goodhire.com via ReturnUrl parameter, resolved 240098, https://hackerone.com/reports/240098, CSRF: Replacing the router configuration backup having an 'operator' user and bypassing the "Referer:' whitelist protection, resolved 240256, https://hackerone.com/reports/240256, [mercantile.wordpress.org] Reflected XSS, resolved 240562, https://hackerone.com/reports/240562, Privilege Escalation., resolved 240659, https://hackerone.com/reports/240659, heap-buffer-overflow (READ of size 1) in cpptoml::parser::consume_whitespace(), resolved 240821, https://hackerone.com/reports/240821, Ability To Takeover any account by Emaill., resolved 240886, https://hackerone.com/reports/240886, Multiple File Manipulation bugs in WP Super Cache , resolved 240958, https://hackerone.com/reports/240958, Firefly's verify_access_token() function does a byte-by-byte comparison of HMAC values., resolved 240987, https://hackerone.com/reports/240987, Email Spoofing, duplicate 240989, https://hackerone.com/reports/240989, xss found in zomato, resolved 241044, https://hackerone.com/reports/241044, Privilege Escalation: From operator to ubnt (and root) with non-interactive Session Hijacking, resolved 241192, https://hackerone.com/reports/241192, CSP Policy Bypass and javascript execution, duplicate 241194, https://hackerone.com/reports/241194, Session ID is accessible via XSS, resolved 241198, https://hackerone.com/reports/241198, pornhub.com/user/welcome/basicinfo nickname field is vulnerable on xss, resolved 241202, https://hackerone.com/reports/241202, Unsafe arithmetic in PyString_DecodeEscape, resolved 241231, https://hackerone.com/reports/241231, flash injection in http://www.rockstargames.com/IV/imgPlayer/imageEmbed.swf, resolved 241244, https://hackerone.com/reports/241244, Spring security configuration allows agent sessions to be hijacked, resolved 241323, https://hackerone.com/reports/241323, woocommerce - prevent_caching() bug / bypass, resolved 241341, https://hackerone.com/reports/241341, CSP Policy Bypass and javascript execution Still Not Fixed, duplicate 241484, https://hackerone.com/reports/241484, Открытое перенапровление на OpenID, resolved 241503, https://hackerone.com/reports/241503, Possible subdomain takeover at openapi.starbucks.com, resolved 241596, https://hackerone.com/reports/241596, Improper validation of unicode characters still not fixed, resolved 241598, https://hackerone.com/reports/241598, Full Name Overwrite on Third party login, resolved 241608, https://hackerone.com/reports/241608, Running 2 accounts with a single email [Part 2], resolved 241619, https://hackerone.com/reports/241619, DOM-based XSS in store.starbucks.co.uk on IE 11, resolved 241623, https://hackerone.com/reports/241623, Persistence of Third Party Association., resolved 241892, https://hackerone.com/reports/241892, Possible user session hijack by invalid HTTPS certificate on inside.gratipay.com domain, duplicate 241950, https://hackerone.com/reports/241950, Non-secure requests are not automatically upgraded to HTTPS, informative 242119, https://hackerone.com/reports/242119, Roundcube virtualmin privilege escalation (CVE-2017-8114), resolved 242171, https://hackerone.com/reports/242171, Improper validation of unicode characters, resolved 242213, https://hackerone.com/reports/242213, Stored XSS in the any user profile using website link, resolved 242243, https://hackerone.com/reports/242243, Open Redirect through POST Request, resolved 242314, https://hackerone.com/reports/242314, Open redirect on https://werkenbijdefensie.nl/, resolved 242354, https://hackerone.com/reports/242354, Null pointer dereference with send/method_missing, resolved 242407, https://hackerone.com/reports/242407, Privilege Escalation with Session Hijacking Having a Non-privileged Valid User, resolved 242408, https://hackerone.com/reports/242408, Нет маркера на добавление песни в плейлист пользователя, resolved 242489, https://hackerone.com/reports/242489, Possibility of DOS Through logging System, informative 242579, https://hackerone.com/reports/242579, 4 severe remote + several minor OpenVPN vulnerabilities, resolved 242622, https://hackerone.com/reports/242622, Possible User Session Hijack using Invalid HTTPS certificate on inside.gratipay.com domain, not-applicable 242727, https://hackerone.com/reports/242727, Android content provider exposes password-protected share password hashes, resolved 242765, https://hackerone.com/reports/242765, Any user with invite capabilities can take-over any account on Discourse, resolved 242846, https://hackerone.com/reports/242846, Password Change not notified when changed from settings, informative 242874, https://hackerone.com/reports/242874, Bypassing Verify Humans Page, informative 242905, https://hackerone.com/reports/242905, XSS in http://www.rockstargames.com/theballadofgaytony/js/jquery.base.js, resolved 242945, https://hackerone.com/reports/242945, No filteration of null characters in name field, resolved 242964, https://hackerone.com/reports/242964, Adding or removing a new non-preferred payout method does not trigger an e-mail or account notification, resolved 243001, https://hackerone.com/reports/243001, Open Redirect, resolved 243003, https://hackerone.com/reports/243003, No limit of summary length allows Denail of Service, resolved 243049, https://hackerone.com/reports/243049, Call back number not verified, informative 243094, https://hackerone.com/reports/243094, Paragonie Airship Admin CSRF on Extensions Pages, resolved 243138, https://hackerone.com/reports/243138, Improper parsing of input could lead to future XSS vulnerabilities in Sequences, informative 243156, https://hackerone.com/reports/243156, Installing a crafted gem package may create or overwrite files, resolved 243277, https://hackerone.com/reports/243277, SSRF via webhook, resolved 243474, https://hackerone.com/reports/243474, Identity Login Page Redirect Can Be Manipulated, resolved 243594, https://hackerone.com/reports/243594, Reset password more than once with a reset link, resolved 243609, https://hackerone.com/reports/243609, The username of an account can be .., resolved 243611, https://hackerone.com/reports/243611, Improper validation of unicode characters still not fixed #2, resolved 243616, https://hackerone.com/reports/243616, Previous password could set as new password, resolved 243619, https://hackerone.com/reports/243619, No Rate Limitation on Regenerate Api Key, resolved 243635, https://hackerone.com/reports/243635, Improper validation of unicode characters #3, resolved 243824, https://hackerone.com/reports/243824, [afisha.mail.ru] HTML-инъекция через XSS на портале виджета, resolved 243842, https://hackerone.com/reports/243842, Password token validation in Weblate Bypass, resolved 243865, https://hackerone.com/reports/243865, SSRF thru File Replace, resolved 243943, https://hackerone.com/reports/243943, IDOR [partners.shopify.com] - User with ONLY Manage apps permission is able to get shops info and staff names from inside the shop, resolved 244070, https://hackerone.com/reports/244070, SSl Weak Ciphers, duplicate 244092, https://hackerone.com/reports/244092, Password of failed (2FA) login attempt is stored in log, resolved 244287, https://hackerone.com/reports/244287, Password token validation in Weblate Bypass #2, resolved 244292, https://hackerone.com/reports/244292, CSV Injection https://hub.grab.com, resolved 244432, https://hackerone.com/reports/244432, Missing SPF Flags, resolved 244434, https://hackerone.com/reports/244434, Leaking password reset token via referrer from external Twitter share button, resolved 244459, https://hackerone.com/reports/244459, Apache HTTP Request Parsing Whitespace Defects, resolved 244474, https://hackerone.com/reports/244474, Mailgun misconfiguration , resolved 244555, https://hackerone.com/reports/244555, Email Spoofing Via /api/v1/users/reset_password, resolved 244567, https://hackerone.com/reports/244567, [Privilege Escalation] Authenticated users can manipulate others fullname without their knowledge, resolved 244612, https://hackerone.com/reports/244612, Password reset links should expire after being used, instead of at specific time, resolved 244614, https://hackerone.com/reports/244614, Password token validation in https://wakatime.com/, resolved 244636, https://hackerone.com/reports/244636, IDOR create accounts and verify them with original account email, resolved 244677, https://hackerone.com/reports/244677, Add arbitrary content to Password Reset Email, resolved 244697, https://hackerone.com/reports/244697, UI Redressing on Embedded Charts, resolved 244721, https://hackerone.com/reports/244721, Open Redirect on [My.com], resolved 244724, https://hackerone.com/reports/244724, Unsafe Inline and Eval CSP Usage, resolved 244766, https://hackerone.com/reports/244766, https://wakatime.com/ website CSP "script-src" includes "unsafe-inline", resolved 244778, https://hackerone.com/reports/244778, Logout CSRF, duplicate 244781, https://hackerone.com/reports/244781, Users with member privilege are able to see emails and membership information of other users, resolved 244813, https://hackerone.com/reports/244813, No rate limit when creating new goals [https://wakatime.com/goals], resolved 244836, https://hackerone.com/reports/244836, [Critical] billion dollars issue, spam 244875, https://hackerone.com/reports/244875, Session Not Expired On Logout, duplicate 244902, https://hackerone.com/reports/244902, XSS through document projects, resolved 244904, https://hackerone.com/reports/244904, Use after free in mruby-mpdecimal, resolved 244958, https://hackerone.com/reports/244958, No redirect uri for Twitter Oath resulting in token leak, resolved 244967, https://hackerone.com/reports/244967, Clickjacking on authorized page https://wakatime.com/share/embed, resolved 244971, https://hackerone.com/reports/244971, No notificatoin sent on email after account deletion., resolved 245124, https://hackerone.com/reports/245124, Session not expired on logout, duplicate 245147, https://hackerone.com/reports/245147, No rate limiting for confirmation email, can spam anyone with confirmation emails, resolved 245221, https://hackerone.com/reports/245221, null pointer dereference and segfault in tile-count-merge, resolved 245228, https://hackerone.com/reports/245228, Object Injection in Woocommerce / Handle PDT Responses from PayPal, resolved 245233, https://hackerone.com/reports/245233, HTML - injection , not-applicable 245236, https://hackerone.com/reports/245236, Missing filteration of meta characters in all full name field on wakatime.com, resolved 245296, https://hackerone.com/reports/245296, Persistent XSS on keybase.io via "payload" field in `/user/sigchain_signature.toffee` template, resolved 245304, https://hackerone.com/reports/245304, Running 2 accounts with a single email #3, resolved 245305, https://hackerone.com/reports/245305, Two email addresses can access the same account, resolved 245311, https://hackerone.com/reports/245311, Missing Account Deletion Notification, resolved 245334, https://hackerone.com/reports/245334, Lack of Password Confirmation When Changing Email, resolved 245340, https://hackerone.com/reports/245340, Bypassing Access control, changing owner's name in a private leaderboard, resolved 245346, https://hackerone.com/reports/245346, JSON CSRF on POST Heartbeats API, resolved 245408, https://hackerone.com/reports/245408, Login to any account with the emailaddress, resolved 245450, https://hackerone.com/reports/245450, Reset password more than once with a reset link #2, resolved 245485, https://hackerone.com/reports/245485, CRLF Injection on ███████, resolved 245514, https://hackerone.com/reports/245514, Sensitive Cookie Without 'HttpOnly' Flag, informative 245518, https://hackerone.com/reports/245518, [debian.weblate.org]-Missing SPF Record, resolved 245527, https://hackerone.com/reports/245527, No rate limit on creating private leaderboards., resolved 245538, https://hackerone.com/reports/245538, Blocking users to sign up on the site, resolved 245762, https://hackerone.com/reports/245762, self cross site scripting, informative 245956, https://hackerone.com/reports/245956, Use-after-free in PHP7's unserialize(), resolved 245969, https://hackerone.com/reports/245969, Use any User to Follow you (Increase Followers) [IDOR], resolved 246042, https://hackerone.com/reports/246042, Password Policy Issue, resolved 246055, https://hackerone.com/reports/246055, Public calendar link can be invisible, resolved 246085, https://hackerone.com/reports/246085, Просмотр аватара и название частной группы, resolved 246302, https://hackerone.com/reports/246302, Running 2 accounts with a single email, informative 246412, https://hackerone.com/reports/246412, SQL Injection, exploitable in boolean mode, resolved 246419, https://hackerone.com/reports/246419, [Privilege Escalation] Authenticated users can manipulate others fullname without their knowledge [Team Vector], resolved 246505, https://hackerone.com/reports/246505, Reflected XSS via Double Encoding, resolved 246634, https://hackerone.com/reports/246634, XSS в письме, в поле отправителя., resolved 246663, https://hackerone.com/reports/246663, [FG-VD-17-115] Mail.ru's Amigo Browser DLL Pre-Loading Vulnerability Notification, resolved 246780, https://hackerone.com/reports/246780, Using an outdated version of OpenSSH on db01.wakatime.com, resolved 246794, https://hackerone.com/reports/246794, XSS on "widgets.shopifyapps.com" via "stripping" attribute and "shop" parameter, resolved 246801, https://hackerone.com/reports/246801, Captcha Bypass in Coinbase SignUp Form, resolved 246803, https://hackerone.com/reports/246803, [spectacles.com] Bypassing quantity limit in orders, resolved 246819, https://hackerone.com/reports/246819, Private videos can be added to our playlists, resolved 246838, https://hackerone.com/reports/246838, by pass rate limit exceed , resolved 246897, https://hackerone.com/reports/246897, Open Redirect, resolved 246995, https://hackerone.com/reports/246995, [█████████] Hardcoded credentials in Android App, resolved 247002, https://hackerone.com/reports/247002, Apache Server-Status Detected, resolved 247027, https://hackerone.com/reports/247027, CVE-2017-10965: Null pointer dereference in Irssi <1.0.4 , resolved 247028, https://hackerone.com/reports/247028, CVE-2017-10966: Heap-use-after-free in Irssi <1.0.4, resolved 247072, https://hackerone.com/reports/247072, Узнать название частной группы и ее аватарку по видеоролику., resolved 247084, https://hackerone.com/reports/247084, Moneybird customers invoices leak in cacheable urls, resolved 247158, https://hackerone.com/reports/247158, Bypass OTP verification when placing Order, resolved 247225, https://hackerone.com/reports/247225, Session Duplication due to Broken Access Control, duplicate 247246, https://hackerone.com/reports/247246, Dom based xss affecting all pages from https://www.grab.com/., resolved 247517, https://hackerone.com/reports/247517, Stored XSS in Private Messages 'Reply' allows to execute malicious JavaScript against any user while replying to the message which contains payload, resolved 247521, https://hackerone.com/reports/247521, Stored XSS in Name field in User Groups/Group Details form, resolved 247628, https://hackerone.com/reports/247628, Reading redacted data via hackbot's answers, resolved 247640, https://hackerone.com/reports/247640, Ruby 2.4.1 has "Stack consistency error" and aborts when processing return statement within a case statement, informative 247680, https://hackerone.com/reports/247680, SSRF in imgur video GIF conversion, resolved 247700, https://hackerone.com/reports/247700, Application-level DoS on image's "size" parameter., resolved 247721, https://hackerone.com/reports/247721, The auth token does not expire on logging out and even after logging out all sessions, resolved 248037, https://hackerone.com/reports/248037, SQL TEST, not-applicable 248116, https://hackerone.com/reports/248116, Remote Code Execution (RCE) in a DoD website, resolved 248133, https://hackerone.com/reports/248133, Stored XSS vulnerability in RSS Feeds Description field, resolved 248560, https://hackerone.com/reports/248560, [parcel.grab.com] DOM XSS at /assets/bower_components/lodash/perf/, resolved 248588, https://hackerone.com/reports/248588, [wakatime.com] HTML Injection github-btn.html, resolved 248599, https://hackerone.com/reports/248599, Information disclosure same issue #176002, resolved 248601, https://hackerone.com/reports/248601, PHP INI Parsing Stack Buffer Overflow Vulnerability, resolved 248609, https://hackerone.com/reports/248609, PHP OpenSSL zif_openssl_seal() heap overflow (wild memcpy), resolved 248656, https://hackerone.com/reports/248656, bypass of 2FA, resolved 248659, https://hackerone.com/reports/248659, PHP WDDX Deserialization Heap OOB Read in timelib_meridian(), resolved 248668, https://hackerone.com/reports/248668, XXE on sms-be-vip.twitter.com in SXMP Processor, resolved 248693, https://hackerone.com/reports/248693, Git repository found, resolved 249234, https://hackerone.com/reports/249234, Posting to Twitter CSRF on php/post_twitter_authenticate.php, resolved 249337, https://hackerone.com/reports/249337, Non-functional 2FA recovery codes, resolved 249339, https://hackerone.com/reports/249339, Missing link to TOTP manual enroll option, resolved 249346, https://hackerone.com/reports/249346, Missing link to 2FA recovery code, resolved 249398, https://hackerone.com/reports/249398, Password complexity not evenly enforced, resolved 249431, https://hackerone.com/reports/249431, 2FA user enumeration via password reset, resolved 249467, https://hackerone.com/reports/249467, 2FA user enumeration via login, resolved 249695, https://hackerone.com/reports/249695, 2FA Error Handling on Google Authenticator, resolved 249759, https://hackerone.com/reports/249759, Lack of Sanitization and Insufficient Authentication, resolved 249786, https://hackerone.com/reports/249786, Отсутствие flood контроля в ИСТОРИЯХ вк, resolved 250082, https://hackerone.com/reports/250082, Enhancement: email confirmation for 2FA recovery, resolved 250088, https://hackerone.com/reports/250088, Account profile shows encryption recovery box for all users, resolved 250243, https://hackerone.com/reports/250243, Users with 2FA can have multiple sessions, resolved 250253, https://hackerone.com/reports/250253, Password complexity ignores empty spaces, resolved 250273, https://hackerone.com/reports/250273, Image lib - unescaped file path, resolved 250386, https://hackerone.com/reports/250386, CSRF Проверить является ли пользователь админом группы., resolved 250430, https://hackerone.com/reports/250430, CSRF on cuvva.insure allows to attacker to send multiple SMS to download the app without visiting the cuvva, informative 250457, https://hackerone.com/reports/250457, User enumeration, resolved 250581, https://hackerone.com/reports/250581, CVE-2017-11367: Global buffer overflow (READ of size 4) in shoco C library , resolved 250587, https://hackerone.com/reports/250587, Potential code injection in fun delete_directory, resolved 250741, https://hackerone.com/reports/250741, [New Feature] Password history check, resolved 250766, https://hackerone.com/reports/250766, Subdomain misconfiguration [mail.legalrobot.com], informative 250837, https://hackerone.com/reports/250837, Stored xss via template injection, resolved 251043, https://hackerone.com/reports/251043, Stored XSS at Moneybird, resolved 251200, https://hackerone.com/reports/251200, Missing Issuer parameter on TOTP 2FA, resolved 251224, https://hackerone.com/reports/251224, Blind stored xss [parcel.grab.com] > name parameter , resolved 251358, https://hackerone.com/reports/251358, Stored XSS vulnerability in additional URLs in 'Location' dialog [Sitemap], resolved 251468, https://hackerone.com/reports/251468, Pages don't render in old browsers like IE11, resolved 251469, https://hackerone.com/reports/251469, Meta characters are not filtered into full name on profile page, resolved 251526, https://hackerone.com/reports/251526, No notification on change password feature, resolved 251572, https://hackerone.com/reports/251572, Length extension attack leading to HTML injection, resolved 251732, https://hackerone.com/reports/251732, uninitilized server memory disclosure via ImageMagick in my.mail.ru and cloud.mail.ru, resolved 251747, https://hackerone.com/reports/251747, Frans Visits Vegas Announcement, resolved 252043, https://hackerone.com/reports/252043, Restaurant payment information leakage, resolved 252324, https://hackerone.com/reports/252324, CSRF Добавить просмотр к записи без ведома пользователя., resolved 252544, https://hackerone.com/reports/252544, Token leakage by referrer header & analytics, resolved 252580, https://hackerone.com/reports/252580, Scrollbar Width permits detecting browser platform, resolved 252626, https://hackerone.com/reports/252626, [Android org.torproject.android] Possible to force list of bridges, informative 252699, https://hackerone.com/reports/252699, Hyper Link Injection In email and Space Characters Allowed at Password Field., informative 252894, https://hackerone.com/reports/252894, Missing URL sanitization in comments can be leveraged for phishing, informative 253128, https://hackerone.com/reports/253128, CSRF Vulnerability allows attackers to steal SocialClub private token., resolved 253202, https://hackerone.com/reports/253202, Unrestricted file upload - cloudacademy.informatica.com, resolved 253313, https://hackerone.com/reports/253313, XSS Vulnerability in WooCommerce Product Vendors plugin, resolved 253429, https://hackerone.com/reports/253429, Linux TBB SFTP URI allows local IP disclosure, resolved 253448, https://hackerone.com/reports/253448, [Cross-domain Referer leakage] Password reset token leakage via referer, resolved 253558, https://hackerone.com/reports/253558, SSRF , resolved 253926, https://hackerone.com/reports/253926, DKIM records not present, Email Hijacking is possible....., resolved 253929, https://hackerone.com/reports/253929, I found a way to instantly take over ads by other users and change them (IDOR), resolved 253934, https://hackerone.com/reports/253934, Password reset token issue, resolved 253975, https://hackerone.com/reports/253975, insecure redirect in https://www.rockstargames.com, resolved 254151, https://hackerone.com/reports/254151, IDOR in activateFuelCard id allows bulk lookup of driver uuids, resolved 254200, https://hackerone.com/reports/254200, Escaping images directory in S3 bucket when saving new avatar, using Path Traversal in filename, resolved 254211, https://hackerone.com/reports/254211, [www.zomato.com/dubai/gold] CRITICAL - Allowing arbitrary amount to become a GOLD Member, resolved 254343, https://hackerone.com/reports/254343, dom based xss in https://www.rockstargames.com/GTAOnline/, resolved 254588, https://hackerone.com/reports/254588, Removed staff members who had "Manage shops" permission can still create development stores, resolved 254869, https://hackerone.com/reports/254869, Device confirmation Flaw, informative 254895, https://hackerone.com/reports/254895, SSL BREACH attack (CVE-2013-3587), informative 254927, https://hackerone.com/reports/254927, Lack of input validation in e-mail & user name, job title, company name field, informative 255020, https://hackerone.com/reports/255020, Password Reset page Session Fixation, not-applicable 255025, https://hackerone.com/reports/255025, Create Api Key is not working, informative 255026, https://hackerone.com/reports/255026, [UX] Notify user on likely email address typo, resolved 255034, https://hackerone.com/reports/255034, Failure to check password history, not-applicable 255041, https://hackerone.com/reports/255041, LUCKY13 (CVE-2013-0169) effects legalrobot.com, informative 255098, https://hackerone.com/reports/255098, Unable to change profile picture, informative 255100, https://hackerone.com/reports/255100, No error or notification on Reset password page, resolved 255125, https://hackerone.com/reports/255125, Null Byte Injection in all fields of Profile, informative 255132, https://hackerone.com/reports/255132, Credential gets exposed, informative 255474, https://hackerone.com/reports/255474, Profile fields validation bypass, resolved 255481, https://hackerone.com/reports/255481, app.legalrobot.com opens FireFox but not in FireFox ESR, resolved 255510, https://hackerone.com/reports/255510, При передаче в ID сообщения нулевого байта, происходит вывод какого-то буфера., resolved 255587, https://hackerone.com/reports/255587, CVE-2017-1000101: cURL: URL globbing out of bounds read, resolved 255627, https://hackerone.com/reports/255627, SSH backdated version open port, resolved 255651, https://hackerone.com/reports/255651, Unauthorized update of merchants' information via /php/merchant_details.php, resolved 255679, https://hackerone.com/reports/255679, Change password logic inversion, resolved 255685, https://hackerone.com/reports/255685, [New Relic Infrastructure] Restricted User can still integrate with AWS via forced browsing (plus, a few other bugs), resolved 255708, https://hackerone.com/reports/255708, Password Functionality not working correctly, informative 255822, https://hackerone.com/reports/255822, WebDAV Empty Property search leads to full CPU usage, resolved 255978, https://hackerone.com/reports/255978, Non-Cloudflare IPs allowed to access origin servers, resolved 255991, https://hackerone.com/reports/255991, URL Spoof / Brave Shield Bypass, resolved 256152, https://hackerone.com/reports/256152, Possibility to inject a malicious JavaScript code in any file on tags.tiqcdn.com results in a stored XSS on any page in most Uber domains, resolved 256647, https://hackerone.com/reports/256647, Simple CSS line-height identifies platform, resolved 256649, https://hackerone.com/reports/256649, Mixed Content over HTTPS, resolved 256663, https://hackerone.com/reports/256663, Weak Password, informative 256665, https://hackerone.com/reports/256665, Violation of secure design principle, informative 257035, https://hackerone.com/reports/257035, User enumeration from failed login error message, resolved 257106, https://hackerone.com/reports/257106, This is not the security issue., informative 257119, https://hackerone.com/reports/257119, Impersonation of Wakatime user using Invitation functionality., resolved 257194, https://hackerone.com/reports/257194, Weak Bithdate Validation Implemented on Sign Up, informative 257207, https://hackerone.com/reports/257207, Code injection, resolved 257237, https://hackerone.com/reports/257237, CSRF Token, informative 257276, https://hackerone.com/reports/257276, Open aws s3 bucket s3://rubyci, not-applicable 257305, https://hackerone.com/reports/257305, [www.boozt.com] - Authentication bypass, resolved 257331, https://hackerone.com/reports/257331, Sub domain take over in gratipay.com, informative 257335, https://hackerone.com/reports/257335, ssh: unprivileged users may hijack due to backdated ssh version open port found(███.unikrn.com), resolved 257376, https://hackerone.com/reports/257376, Missing Restriction On String Size, resolved 257384, https://hackerone.com/reports/257384, No rate limit or captcha to identify humans, resolved 257942, https://hackerone.com/reports/257942, languagechange event fires simultaneously on all tabs, resolved 258084, https://hackerone.com/reports/258084, Access to all files of remote user through shared file, resolved 258117, https://hackerone.com/reports/258117, RCE/LFI on test Jenkins instance due to improper authentication flow, resolved 258198, https://hackerone.com/reports/258198, The Custom Emoji Page has a Reflected XSS, resolved 258201, https://hackerone.com/reports/258201, Overwrite Drafts of Everyone , resolved 258260, https://hackerone.com/reports/258260, Accessing Private Files Shared in message of other users, resolved 258283, https://hackerone.com/reports/258283, Clickjacking - https://mercantile.wordpress.org/, resolved 258317, https://hackerone.com/reports/258317, Reflected XSS in https://e.mail.ru/, resolved 258410, https://hackerone.com/reports/258410, Gateway information leakage, resolved 258573, https://hackerone.com/reports/258573, Able to view Backend Database dur to improper authentication, resolved 258578, https://hackerone.com/reports/258578, application/x-brave-tab should not be readable., resolved 258582, https://hackerone.com/reports/258582, [www.zomato.com] Union SQLi + Waf Bypass, resolved 258585, https://hackerone.com/reports/258585, OS username disclosure, resolved 258596, https://hackerone.com/reports/258596, Отраженная XSS на cloud.mail.ru в URL в функционале создания и редактировании презентации., resolved 258630, https://hackerone.com/reports/258630, Access to local file system using javascript, resolved 258632, https://hackerone.com/reports/258632, owncloud.com open redirect, informative 258710, https://hackerone.com/reports/258710, Download attribute allows downloading local files, resolved 258876, https://hackerone.com/reports/258876, XSS when clicking "Share to Twitter" at quora.com/widgets/embed_iframe?path=..., resolved 258879, https://hackerone.com/reports/258879, No password length restriction, informative 259100, https://hackerone.com/reports/259100, XSS through `__e2e_action_id` delivered by JSONP, resolved 259390, https://hackerone.com/reports/259390, Use-after-free in XML::LibXML::Node::replaceChild, resolved 259400, https://hackerone.com/reports/259400, Issues with Forgot password Error Handling , resolved 259415, https://hackerone.com/reports/259415, Lengthy manual entry of 2FA secret, resolved 259416, https://hackerone.com/reports/259416, Incorrect email content when disabling 2FA, resolved 259555, https://hackerone.com/reports/259555, heap-buffer-overflow (WRITE of size 8) in Perl_pp_reverse(), resolved 259742, https://hackerone.com/reports/259742, Incorrect error message, resolved 259913, https://hackerone.com/reports/259913, File Upload Restriction Bypass, resolved 260005, https://hackerone.com/reports/260005, RCE via ssh:// URIs in multiple VCS , resolved 260221, https://hackerone.com/reports/260221, Information Exposure Through Directory Listing, informative 260239, https://hackerone.com/reports/260239, Tampering the mail id on chatbox, informative 260278, https://hackerone.com/reports/260278, TabNabbing issue (due to taget=_blank), resolved 260299, https://hackerone.com/reports/260299, observer.com URL should HTTPS, resolved 260316, https://hackerone.com/reports/260316, Profile fields validation mismatch, resolved 260390, https://hackerone.com/reports/260390, 2FA manual entry uses wrong encoding, resolved 260414, https://hackerone.com/reports/260414, CVE-2017-12858: Heap UAF in _zip_buffer_free() / Double free in _zip_dirent_read(), resolved 260468, https://hackerone.com/reports/260468, first name and last name restrictions bypass, resolved 260491, https://hackerone.com/reports/260491, 2FA manual entry uses wrong encoding, resolved 260492, https://hackerone.com/reports/260492, Invalid Email Verification, informative 260591, https://hackerone.com/reports/260591, Futureoflife organization URL should be HTTPS, resolved 260604, https://hackerone.com/reports/260604, Update any profile, resolved 260632, https://hackerone.com/reports/260632, Improper validation of parameters while creating issues, resolved 260645, https://hackerone.com/reports/260645, Information Discloser, informative 260648, https://hackerone.com/reports/260648, CSP script-src includes "unsafe-inline", resolved 260662, https://hackerone.com/reports/260662, No length limit in invite_code can cause server degradation, resolved 260689, https://hackerone.com/reports/260689, Weak Cryptography for Passwords, informative 260697, https://hackerone.com/reports/260697, CSRF-tokens on pages without no-cache headers, resulting in ATO when using CloudFlare proxy (Web Cache Deception), resolved 260751, https://hackerone.com/reports/260751, Change password session fixed, spam 260755, https://hackerone.com/reports/260755, https://secure.gravatar.com, resolved 260838, https://hackerone.com/reports/260838, Special characters are not filtered out on profile fields , informative 260928, https://hackerone.com/reports/260928, Missing Certificate Authority Authorization rule, informative 260938, https://hackerone.com/reports/260938, Homograph IDNs displayed in Description, resolved 260941, https://hackerone.com/reports/260941, UX: JS error on Password Safety link, resolved 261138, https://hackerone.com/reports/261138, Stored XSS in OAuth redirect URI , resolved 261221, https://hackerone.com/reports/261221, Participation of expired account holders in Projects can occure financial loss to Mavenlink , resolved 261285, https://hackerone.com/reports/261285, Privilege Escalation to Admin-level Account, resolved 261297, https://hackerone.com/reports/261297, Disabled user can reset their password , resolved 261335, https://hackerone.com/reports/261335, Heap Use After Free Read in unserialize(), resolved 261336, https://hackerone.com/reports/261336, Out of Bounds Memory Read in unserialize(), resolved 261338, https://hackerone.com/reports/261338, Heap Use After Free in unserialize(), resolved 261571, https://hackerone.com/reports/261571, dom based xss in http://www.rockstargames.com/GTAOnline/ (Fix bypass), resolved 261592, https://hackerone.com/reports/261592, Open Redirection Found in users.whisper.sh, resolved 261643, https://hackerone.com/reports/261643, [beta.tracker.my.com] XSS Request-URI, resolved 261652, https://hackerone.com/reports/261652, Clickjacking Full account takeover and editing the personal information at [account.my.com], resolved 261654, https://hackerone.com/reports/261654, [new.wf.mail.ru] XSS Request-URI, resolved 261706, https://hackerone.com/reports/261706, Missing Certificate Authority Authorization rule, duplicate 261734, https://hackerone.com/reports/261734, Индексация почты/логинов пользователей, resolved 261764, https://hackerone.com/reports/261764, Просмотр Участников ЧАСТНОЙ встречи , resolved 261817, https://hackerone.com/reports/261817, Information disclosure, informative 261966, https://hackerone.com/reports/261966, XSS в колбек апи в сообществах , resolved 262004, https://hackerone.com/reports/262004, HTML injection in email in unikrn.com, resolved 262005, https://hackerone.com/reports/262005, xss , not-applicable 262010, https://hackerone.com/reports/262010, XSS в названии сервера, resolved 262088, https://hackerone.com/reports/262088, Show hide privacy giving receiving on my website , informative 262109, https://hackerone.com/reports/262109, UX: JS error on Password Safety link, resolved 262140, https://hackerone.com/reports/262140, Password Restriction On Change, informative 262230, https://hackerone.com/reports/262230, Tinymce 2.4.0, resolved 262262, https://hackerone.com/reports/262262, app.mixmax.com Information Discloure on cal.mixmax.com and Not Signing out after Removing information grant access from Google, resolved 262620, https://hackerone.com/reports/262620, Gratipay rails secret token (secret_key_base) publicly exposed in GitHub, resolved 262661, https://hackerone.com/reports/262661, IDOR on HackerOne Feedback Review, resolved 262665, https://hackerone.com/reports/262665, CVE-2017-5969: libxml2 when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference), resolved 262830, https://hackerone.com/reports/262830, Rate-limit protection get executed in the last stage of the registration process, allowing enumeration of existing account., resolved 262852, https://hackerone.com/reports/262852, Reflected XSS - gratipay.com, resolved 263010, https://hackerone.com/reports/263010, Improper validation at Phone verification (possible cost increase + SMS SPAM attack), resolved 263109, https://hackerone.com/reports/263109, Buddypress 2.9.1 - Exceeding the maximum upload size - XSS leading to potential RCE. , resolved 263169, https://hackerone.com/reports/263169, Internal Ports Scanning via Blind SSRF, resolved 263191, https://hackerone.com/reports/263191, Stored XSS with CRLF injection via post message to user feed, resolved 263196, https://hackerone.com/reports/263196, Name can't be numbers or email, informative 263498, https://hackerone.com/reports/263498, CSRF to change Account Security Keys on secure.login.gov, resolved 263508, https://hackerone.com/reports/263508, Server Side Misconfiguration (EMAIL SPOOFING) , not-applicable 263512, https://hackerone.com/reports/263512, CSRF in generating a new Personal Key, duplicate 263535, https://hackerone.com/reports/263535, [www.zomato.com] Unauthenticated access to Internal Sales Data of Zomato through an unrestricted endpoint, resolved 263542, https://hackerone.com/reports/263542, Subdomain take-over of {REDACTED}.18f.gov, resolved 263553, https://hackerone.com/reports/263553, federalist.18f.gov vulnerable to Sweet32 attack, informative 263589, https://hackerone.com/reports/263589, Email Length Verification , spam 263662, https://hackerone.com/reports/263662, Cross-Site Request Forgery on the Federalist API (all endpoints), using Flash file on the attacker's host, resolved 263672, https://hackerone.com/reports/263672, previous token seems to work even though it does not verify email, resolved 263681, https://hackerone.com/reports/263681, Improper error message, informative 263684, https://hackerone.com/reports/263684, [qiwi.com] XSS on payment form, resolved 263718, https://hackerone.com/reports/263718, Wordpress 4.8.1 - Rogue editor leads to RCE. And the risks of same origin frame scripting in general, informative 263728, https://hackerone.com/reports/263728, Password Complexity , not-applicable 263743, https://hackerone.com/reports/263743, I cant login to my account, informative 263760, https://hackerone.com/reports/263760, Opportunity to obtain private tweets through search widget preview caches, resolved 263780, https://hackerone.com/reports/263780, Direct URL access to PDF files, informative 263866, https://hackerone.com/reports/263866, Error Page Content Spoofing or Text Injection, duplicate 263873, https://hackerone.com/reports/263873, Improper Session management can cause account takeover[https://micropurchase.18f.gov], resolved 263902, https://hackerone.com/reports/263902, {REDACTED}.data.gov subdomain takeover., resolved 263913, https://hackerone.com/reports/263913, Content injection via URL parameter., duplicate 264002, https://hackerone.com/reports/264002, Stored XSS on member post feed, resolved 264023, https://hackerone.com/reports/264023, Coding error ! , duplicate 264101, https://hackerone.com/reports/264101, design issue exists on login page , spam 264125, https://hackerone.com/reports/264125, Clickjacking mercantile.wordpress.org, resolved 264405, https://hackerone.com/reports/264405, Header Injection In app.legalrobot.com, informative 264426, https://hackerone.com/reports/264426, Nextcloud logs ldap passwords, resolved 264445, https://hackerone.com/reports/264445, XSS в комментариях от имени сообщества , resolved 264481, https://hackerone.com/reports/264481, Stack overflow in UnbindFromTree (browser can be crashed remotely), informative 264754, https://hackerone.com/reports/264754, [www.zomato.com] IDOR - Delete/Deactivate ANY/ALL Promos through a Post Request at **clients/promoDataHandler.php**, resolved 264832, https://hackerone.com/reports/264832, xss filter bypass [polldaddy], resolved 264919, https://hackerone.com/reports/264919, [www.zomato.com] IDOR - Delete/Deactivate any special menu of any Restaurants from Zomato, resolved 264934, https://hackerone.com/reports/264934, Application allowing old password to be set as new password | hosted.weblate.org, resolved 265160, https://hackerone.com/reports/265160, TabNabbing issue (due to taget=_blank), resolved 265161, https://hackerone.com/reports/265161, Monero Website & Kovri on your policy are returning 404 not found., resolved 265232, https://hackerone.com/reports/265232, Unsecure: Bypass alerts of Little Flocker / Little Snitch / HandsOff! / BlockBlock (same concept can be applied to other security tools), resolved 265258, https://hackerone.com/reports/265258, IDOR to cancel any table booking and leak sensitive information such as email,mobile number,uuid, resolved 265274, https://hackerone.com/reports/265274, Stored XSS on support.rockstargames.com, resolved 265284, https://hackerone.com/reports/265284, 'cnvID' parameter vulnerable to Insecure Direct Object References, resolved 265384, https://hackerone.com/reports/265384, Stored XSS on support.rockstargames.com, resolved 265441, https://hackerone.com/reports/265441, Error the message with already e-mail , informative 265619, https://hackerone.com/reports/265619, No alert in verify email address with wrong input, informative 265696, https://hackerone.com/reports/265696, Gitlab is vulnerable to impersonation attacks due to broken links, resolved 265701, https://hackerone.com/reports/265701, Security: Publicly accessible x.509 Public and Private Key of Ubiquiti Networks., resolved 265740, https://hackerone.com/reports/265740, [Cross Domain Referrer Leakage] Password Reset Token Leaking to Third party Sites., resolved 265749, https://hackerone.com/reports/265749, Bypass email verification when register new account, not-applicable 265775, https://hackerone.com/reports/265775, Password reset token issue, resolved 265863, https://hackerone.com/reports/265863, Wrong password validation message, resolved 265930, https://hackerone.com/reports/265930, No notification of change email feature, resolved 265931, https://hackerone.com/reports/265931, Logic issue in email change process, resolved 265987, https://hackerone.com/reports/265987, Add another email address without verification, resolved 266017, https://hackerone.com/reports/266017, Logic issue in email change process, resolved 266030, https://hackerone.com/reports/266030, Add arbitrary value in reset password cookie, informative 266072, https://hackerone.com/reports/266072, Хранимая XSS в группе VK, resolved 266090, https://hackerone.com/reports/266090, Possible to join any class without coache's knowledge & Little Information Disclosure, resolved 266288, https://hackerone.com/reports/266288, New Device Confirmation Bug, informative 266449, https://hackerone.com/reports/266449, [api.data.gov] Leak Valid API With out Verification -, informative 266454, https://hackerone.com/reports/266454, IDNs displayed in unicode, informative 266766, https://hackerone.com/reports/266766, Access Grab_Road BigData Database via Open Presto coordinator, resolved 266801, https://hackerone.com/reports/266801, [marketplace.informatica.com]-Reflected XSS , resolved 266908, https://hackerone.com/reports/266908, Impersonation attack via Broken Link in Resellers Page, resolved 267075, https://hackerone.com/reports/267075, Clickjacking irclogs.wordpress.org, informative 267161, https://hackerone.com/reports/267161, Unsecured Elasticsearch Instance, resolved 267177, https://hackerone.com/reports/267177, stored xss in invited team member via email parameter, resolved 267189, https://hackerone.com/reports/267189, clickjacking on https://gratipay.com/on/npm/[text], informative 267206, https://hackerone.com/reports/267206, Reflected XSS , resolved 267212, https://hackerone.com/reports/267212, 400 Bad Request [Use a third-party provider to sign in or create an account on Gratipay], not-applicable 267213, https://hackerone.com/reports/267213, Information Disclosure on inside.gratipay.com, informative 267356, https://hackerone.com/reports/267356, Autocomplete feature , resolved 267473, https://hackerone.com/reports/267473, XSS in OLX.pl ("title" in new advertisement), resolved 267570, https://hackerone.com/reports/267570, Stored XSS through Facebook Page Connection, resolved 267636, https://hackerone.com/reports/267636, [NR Synthetics] (IDOR) Ability to see full name associated with other New Relic accounts through workaround of #255894, resolved 267643, https://hackerone.com/reports/267643, Possibility to insert stored XSS inside tag, resolved 267865, https://hackerone.com/reports/267865, Add movie or series CSRF, not-applicable 267867, https://hackerone.com/reports/267867, Logout CSRF, not-applicable 267922, https://hackerone.com/reports/267922, Sql query disclosure,, informative 268113, https://hackerone.com/reports/268113, Uncloaking hidden services and hidden service users, informative 268167, https://hackerone.com/reports/268167, Insecure Direct Object Reference (IDOR) Allowing me to claim other user's photos (driving license and selfies) as mine, resolved 268382, https://hackerone.com/reports/268382, Nginx misconfiguration leading to direct PHP source code download, resolved 268612, https://hackerone.com/reports/268612, Venturebeat.com URL should be HTTPS, resolved 268622, https://hackerone.com/reports/268622, booztfashion.com URL should HTTPS, resolved 268629, https://hackerone.com/reports/268629, Failed OutLink on Terms of Service, resolved 268679, https://hackerone.com/reports/268679, Homo graphs attack , informative 268794, https://hackerone.com/reports/268794, all private tokens are leaked to an unauthenticated attacker, resolved 268803, https://hackerone.com/reports/268803, CVE-2017-12985: The IPv6 parser in tcpdump before 4.9.2 has a buffer over-read in ip6_print(), resolved 268804, https://hackerone.com/reports/268804, CVE-2017-12986 The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print()., resolved 268805, https://hackerone.com/reports/268805, CVE-2017-13008 The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_11.c:parse_elements()., resolved 268806, https://hackerone.com/reports/268806, CVE-2017-13009 The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_print()., resolved 268807, https://hackerone.com/reports/268807, CVE-2017-13010 The BEEP parser in tcpdump before 4.9.2 has a buffer over-read in print-beep.c:l_strnstart()., resolved 268808, https://hackerone.com/reports/268808, CVE-2017-13038 The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:handle_mlppp()., resolved 268888, https://hackerone.com/reports/268888, Sensitive Information Disclosure https://cards-dev.twitter.com, resolved 268981, https://hackerone.com/reports/268981, Missing homograph filter character, resolved 269047, https://hackerone.com/reports/269047, Clickjacking https://blockstack.org/, informative 269066, https://hackerone.com/reports/269066, Remote Code Execution at http://tw.corp.ubnt.com, resolved 269109, https://hackerone.com/reports/269109, Subdomain Takeover via unclaimed UserVoice domain, resolved 269184, https://hackerone.com/reports/269184, Weak crossdomain.xml, informative 269196, https://hackerone.com/reports/269196, Cross site request forgery, informative 269230, https://hackerone.com/reports/269230, Emails of invited collaborators are disclosed in full in payload for report participants, resolved 269279, https://hackerone.com/reports/269279, SQL injection in partner id field on https://www.teavana.com (Sign-up form), resolved 269288, https://hackerone.com/reports/269288, External links to be in HTTP, resolved 269318, https://hackerone.com/reports/269318, Bypass of Rate limiting in secure_session endpoint's password input will lead to user password disclosure , resolved 269449, https://hackerone.com/reports/269449, Banner Grabbing - Apache Server Version Disclousure, informative 269467, https://hackerone.com/reports/269467, Banner Grabbing - Apache Server Version Disclousure, resolved 269479, https://hackerone.com/reports/269479, Report Private Links Leaks to Google Analytics via Query String Param, resolved 269568, https://hackerone.com/reports/269568, Optionsbleed / CVE-2017-9798, resolved 269705, https://hackerone.com/reports/269705, WordPress < 4.8.2 vulnerable to multiple attacks, resolved 269831, https://hackerone.com/reports/269831, Keys, resolved 269937, https://hackerone.com/reports/269937, [www.zomato.com] IDOR - Leaking all Personal Details of all Zomato Users through an endpoint, resolved 269940, https://hackerone.com/reports/269940, XSS в приглашении в группу, resolved 270059, https://hackerone.com/reports/270059, Denial of service in libxml2, using malicious lzma file to consume available system memory, resolved 270068, https://hackerone.com/reports/270068, Installer can modify other gems if gem name is specially crafted, resolved 270072, https://hackerone.com/reports/270072, Unpacker improperly validates symlinks, allowing gems writes to arbitrary locations, resolved 270119, https://hackerone.com/reports/270119, Узнаем название и аватарку частной группы, по ID приложения., resolved 270454, https://hackerone.com/reports/270454, Clickjacking in Legalrobot app, resolved 270695, https://hackerone.com/reports/270695, [marketplace.informatica.com] - Sensitive Data Exposure , resolved 270981, https://hackerone.com/reports/270981, Shopify admin authentication bypass using partners.shopify.com, resolved 271176, https://hackerone.com/reports/271176, Bypassing one-time checkout router page (revealing payment information), resolved 271224, https://hackerone.com/reports/271224, SSRF in https://www.zomato.com████ allows reading local files and website source code, resolved 271253, https://hackerone.com/reports/271253, NextCloud is also Accepting OCTET-STREAM Type of Documents instead of jpg or Imge Files Only, duplicate 271324, https://hackerone.com/reports/271324, Homograph fix Bypass , resolved 271330, https://hackerone.com/reports/271330, Format string implementation vulnerability, resulting in code execution, resolved 271355, https://hackerone.com/reports/271355, [avito.ru] ImageMagick uninitialized image palette, resolved 271360, https://hackerone.com/reports/271360, [avito.ru] Утекают креды от платежных провайдеров, resolved 271391, https://hackerone.com/reports/271391, Potential server misconfiguration leads to disclosure of vendor/ directory, resolved 271393, https://hackerone.com/reports/271393, NR Internal_API call allows me to read the events/violations/policies/messages of ANY New Relic account (AND pull data from infrastructure), resolved 271407, https://hackerone.com/reports/271407, Admin Access to a domain used for development and admin access to internal dashboards on that domain, resolved 271506, https://hackerone.com/reports/271506, Banned researcher gets email updates on a private program., resolved 271533, https://hackerone.com/reports/271533, Bruteforcing password reset tokens, could lead to account takeover, resolved 271700, https://hackerone.com/reports/271700, Leak IP internal, resolved 271765, https://hackerone.com/reports/271765, Stored XSS in partners dashboard, resolved 271861, https://hackerone.com/reports/271861, Bypass of my two other reports #267636 + #255894 - (IDOR) Ability to see full name associated with other New Relic accounts, resolved 271928, https://hackerone.com/reports/271928, facebook button URL should be HTTPS, resolved 271950, https://hackerone.com/reports/271950, Improper Implementation of Password strength checker, resolved 271960, https://hackerone.com/reports/271960, Client-side Template Injection in Search, user email/token leak and maybe sandbox escape, resolved 272044, https://hackerone.com/reports/272044, Android - Access of some not exported content providers , resolved 272095, https://hackerone.com/reports/272095, SSRF/XSPA in labs.data.gov/dashboard/validate, resolved 272097, https://hackerone.com/reports/272097, Interger overflow in eval trigger write out of bound, informative 272221, https://hackerone.com/reports/272221, Arbitrary local code execution via DLL hijacking from executable installer, duplicate 272231, https://hackerone.com/reports/272231, Download of (later executed) .NET installer over insecure channel, informative 272272, https://hackerone.com/reports/272272, Export vault feature is vulnerable to CSV injection, informative 272357, https://hackerone.com/reports/272357, Mailgun misconfiguration on email.bitwarden.com, resolved 272379, https://hackerone.com/reports/272379, Password reset token leak on third party website via Referer header, resolved 272387, https://hackerone.com/reports/272387, aspen | clickjacking, not-applicable 272426, https://hackerone.com/reports/272426, Server Path Disclosure , informative 272432, https://hackerone.com/reports/272432, Cross-origin resource sharing (CORS), not-applicable 272497, https://hackerone.com/reports/272497, Perl $ENV Key Stack Buffer Overflow, resolved 272506, https://hackerone.com/reports/272506, SQL injections, resolved 272570, https://hackerone.com/reports/272570, Organization Admin Privilege Escalation To Owner, resolved 272578, https://hackerone.com/reports/272578, Unauthenticated LFI revealing log information, resolved 272588, https://hackerone.com/reports/272588, CSRF in Raffles Ticket Purchasing, resolved 272596, https://hackerone.com/reports/272596, No Rate Limit (Leads to huge email flooding/email bombing), not-applicable 272824, https://hackerone.com/reports/272824, client_secret Token disclosure , resolved 272832, https://hackerone.com/reports/272832, Bruteforce Unlimited number of password attempts, not-applicable 272839, https://hackerone.com/reports/272839, Weak Session ID Implementation - No Session change on Password change, resolved 272863, https://hackerone.com/reports/272863, External links should be served in HTTPS., informative 272979, https://hackerone.com/reports/272979, 2 vulnerabilities of arbitrary code in ████████ - CVE-2017-5929, resolved 272982, https://hackerone.com/reports/272982, Information leakage on django.aspen.io, not-applicable 272997, https://hackerone.com/reports/272997, Stored XSS via Send crew invite, resolved 273365, https://hackerone.com/reports/273365, XSS в товарах, resolved 273449, https://hackerone.com/reports/273449, Authenticated RCE in ToughSwitch, resolved 273560, https://hackerone.com/reports/273560, Validation of Password reset tokens, informative 273630, https://hackerone.com/reports/273630, Leaking sensitive information lead to compromise employer API keys, resolved 273698, https://hackerone.com/reports/273698, Unauthorized Access to Protected Tweets via niche.co API, resolved 273726, https://hackerone.com/reports/273726, Information / sensitive data disclosure on some endpoints, resolved 273805, https://hackerone.com/reports/273805, Improper access control lead To delete anyone comment, resolved 273881, https://hackerone.com/reports/273881, Invalidate session after password reset on https://polldaddy.com, informative 273960, https://hackerone.com/reports/273960, Хранимая XSS на странице "Виджет для авторизации", resolved 273998, https://hackerone.com/reports/273998, CSRF token does not valided during blog comment, resolved 274013, https://hackerone.com/reports/274013, Allowance of Meta/Null characters, duplicate 274112, https://hackerone.com/reports/274112, Хранимая XSS в функционале добавления аудио в WYSIWYG, resolved 274264, https://hackerone.com/reports/274264, Your support community suffers from angularjs injection and must be fixed immediately [CRITICAL], resolved 274267, https://hackerone.com/reports/274267, Request Hijacking Vulnerability in RubyGems 2.6.13 and earlier, informative 274324, https://hackerone.com/reports/274324, cross site web socket hijacking, duplicate 274336, https://hackerone.com/reports/274336, Subdomain Takeover via Unclaimed WordPress site, resolved 274443, https://hackerone.com/reports/274443, stored xss in comments : driver exam , resolved 274541, https://hackerone.com/reports/274541, Invited user to a Author profile can remove the owner of that Author, resolved 274594, https://hackerone.com/reports/274594, Unupdated ImageMagic leads to uninitialized server memory disclosure , resolved 274868, https://hackerone.com/reports/274868, Xss on community.imgur.com, resolved 274997, https://hackerone.com/reports/274997, Use of uninitialized value in memarea_strdup (src/common/memarea.c:369), informative 275186, https://hackerone.com/reports/275186, Get all instacart emails - missing rate limit on /accounts/register, resolved 275242, https://hackerone.com/reports/275242, password token validation, informative 275245, https://hackerone.com/reports/275245, Can link to websites from profile, informative 275269, https://hackerone.com/reports/275269, Gem signature forgery, resolved 275274, https://hackerone.com/reports/275274, touch.mail.ru/messages - Stored XSS, resolved 275293, https://hackerone.com/reports/275293, Pending member invitations are not revoked on program name change, informative 275303, https://hackerone.com/reports/275303, Account Restore / Reactivating an old email via old reset link, resolved 275386, https://hackerone.com/reports/275386, Stored XSS Using Media, resolved 275443, https://hackerone.com/reports/275443, Missing robots exclusion header for user uploads, resolved 275515, https://hackerone.com/reports/275515, Stored XSS in dev-ucrm-billing-demo.ubnt.com In Client Custom Attribute , resolved 275518, https://hackerone.com/reports/275518, Blind XSS in Mobpub Marketplace Admin Production | Sentry via demand.mopub.com (User-Agent), resolved 275668, https://hackerone.com/reports/275668, Stored XSS using SVG on subdomain infra.mail.ru, resolved 275714, https://hackerone.com/reports/275714, Subdomain takeover on developer.openapi.starbucks.com, resolved 276031, https://hackerone.com/reports/276031, Remote Code Execution in Rocket.Chat Desktop, resolved 276041, https://hackerone.com/reports/276041, Secret API Key Leakage via Query String, resolved 276105, https://hackerone.com/reports/276105, Stored XSS in WordPress, informative 276123, https://hackerone.com/reports/276123, Password Complexity Not Enforced On Password Change, resolved 276174, https://hackerone.com/reports/276174, [NR Infrastructure] Bypass of #200576 through GraphQL query abuse - allows restricted user access to root account license key, resolved 276244, https://hackerone.com/reports/276244, Broken links for stale domains may be leveraged for Phishing, Misinformation, Defaming, resolved 276253, https://hackerone.com/reports/276253, Use of uninitialized value in networkstatus_parse_vote_from_string (src/or/routerparse.c:3533), informative 276255, https://hackerone.com/reports/276255, Use of unitialized value in token_check_object (src/or/parsecommon.c:224), duplicate 276269, https://hackerone.com/reports/276269, Multiple Subdomain takeovers via unclaimed instances, resolved 276276, https://hackerone.com/reports/276276, Blind XXE on my.mail.ru, resolved 276427, https://hackerone.com/reports/276427, Legal Robot, spam 276614, https://hackerone.com/reports/276614, Email Spoofing, duplicate 276634, https://hackerone.com/reports/276634, XSS на e.mail.ru в мобильном приложении!, resolved 276714, https://hackerone.com/reports/276714, reflected XSS on healt.mail.ru, resolved 276747, https://hackerone.com/reports/276747, CSS injection in avito.ru via IE11 , resolved 276816, https://hackerone.com/reports/276816, No password confirmation on changing primary email address, informative 276976, https://hackerone.com/reports/276976, Information Disclosure and Privilege Escalation in app.goodhire.com/member/developers/api-settings, resolved 277078, https://hackerone.com/reports/277078, Goodhire Open Redirect, duplicate 277138, https://hackerone.com/reports/277138, Privilege Escalation: Read-Only to Admin, resolved 277192, https://hackerone.com/reports/277192, Host Header Injection and Cache Poisoning, duplicate 277197, https://hackerone.com/reports/277197, xss flash on http://presentatie.werkenbijmcdonalds.nl/, resolved 277213, https://hackerone.com/reports/277213, Two accounts can be made with same password, informative 277259, https://hackerone.com/reports/277259, [marketplace.informatica.com] - Stored XSS, resolved 277262, https://hackerone.com/reports/277262, Newrelic s3 bucket is writeable and deleteable by authorized AWS users, informative 277300, https://hackerone.com/reports/277300, Captcha Bypass on SignUp Form, resolved 277341, https://hackerone.com/reports/277341, blind XXE when uploading avatar in mymail phone app, resolved 277354, https://hackerone.com/reports/277354, HTTP Host Header Injection on app.goodhire.com, duplicate 277377, https://hackerone.com/reports/277377, Amount Manipulation Buy Unlimited Credits in just $1.00, duplicate 277407, https://hackerone.com/reports/277407, Email abuse and Referral Abuse, informative 277431, https://hackerone.com/reports/277431, XSS on app.legalrobot.com, not-applicable 277525, https://hackerone.com/reports/277525, Formula injection via CSV exports in WordCamp Talks plugin, resolved 277534, https://hackerone.com/reports/277534, Timing Attack in Google Authenticator - Per User Prompt, informative 277664, https://hackerone.com/reports/277664, [lk-cdn.3igames.mail.ru] apc.php, resolved 278095, https://hackerone.com/reports/278095, Invalid Host detection at https://hackerone.com/redirect, resolved 278151, https://hackerone.com/reports/278151, Content Spoofing @ https://irclogs.wordpress.org/, resolved 278182, https://hackerone.com/reports/278182, Dropbox employee benefits documents are available in a test Dropbox folder, resolved 278191, https://hackerone.com/reports/278191, Listing of Amazon S3 Bucket accessible to any amazon authenticated user (metrics.pscp.tv), resolved 278220, https://hackerone.com/reports/278220, Limited arbitrary text inclusion in user invite emails, informative 278225, https://hackerone.com/reports/278225, If the developer forgets to remove the built in controller welcome.php it helps the attacker to identify that the site is built with Codeigniter, not-applicable 278231, https://hackerone.com/reports/278231, Out of bounds read in libcurl's IMAP FETCH response parser, resolved 278718, https://hackerone.com/reports/278718, Improper validation of unicode characters , resolved 279351, https://hackerone.com/reports/279351, Broken link for stale DNS entry may be leveraged for Phishing, Misinformation, Serving Malware, informative 279717, https://hackerone.com/reports/279717, Broken link for wrong domain entry may be leveraged for Phishing, Misinformation, Serving Malware, resolved 279914, https://hackerone.com/reports/279914, Issue with password change in Disabled Account, informative 279932, https://hackerone.com/reports/279932, Users Unable to login using Gmail/Facebook on https://boozt-stage1.booztx.com/login, resolved 279935, https://hackerone.com/reports/279935, Malicious callback url can be set while creating application in identity, resolved 279945, https://hackerone.com/reports/279945, Improper validation of unicode characters#2, informative 280282, https://hackerone.com/reports/280282, Enforce minimum master password complexity, not-applicable 280304, https://hackerone.com/reports/280304, No Confirmation During Email Change, duplicate 280389, https://hackerone.com/reports/280389, No Rate limit on Password Reset Function, resolved 280408, https://hackerone.com/reports/280408, SPF Misconfiguration, resolved 280495, https://hackerone.com/reports/280495, Stored Cross-Site scripting in the infographics using links, resolved 280500, https://hackerone.com/reports/280500, Tabnabbing via window.opener, resolved 280503, https://hackerone.com/reports/280503, Stored Cross-Site scripting in the infographics using Data Objects links, resolved 280504, https://hackerone.com/reports/280504, Weak Password Policy on Signup, resolved 280509, https://hackerone.com/reports/280509, User Enumeration, resolved 280511, https://hackerone.com/reports/280511, Server Side Request Forgery on JSON Feed, resolved 280519, https://hackerone.com/reports/280519, Email notification is not being sent while changing passwords, resolved 280529, https://hackerone.com/reports/280529, Incorrect Functionality of Password reset links, resolved 280534, https://hackerone.com/reports/280534, No Rate Limit on account deletion request(Leads to huge email flooding/email bombing), resolved 280585, https://hackerone.com/reports/280585, No Session change on Password change, duplicate 280770, https://hackerone.com/reports/280770, Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query page, resolved 280803, https://hackerone.com/reports/280803, Fake mailing reports using mail service on [URL : mail-txn.identity.com], resolved 280826, https://hackerone.com/reports/280826, Stored self-XSS pubg.mail.ru в нескольких местах, resolved 280865, https://hackerone.com/reports/280865, Non Critical Code Quality Bug / Self XSS on Map Editor, resolved 280912, https://hackerone.com/reports/280912, apache access.log leakage via long request on https://rapida.ru/, resolved 280914, https://hackerone.com/reports/280914, Business Logic Flaw allowing Privilege Escalation, informative 281274, https://hackerone.com/reports/281274, Non-HTTPS link on blog, resolved 281283, https://hackerone.com/reports/281283, XSS on partners.uber.com due to no user input sanitisation , resolved 281296, https://hackerone.com/reports/281296, IDOR in merchant.rbmonkey.com allows deleting eShops of another user, resolved 281336, https://hackerone.com/reports/281336, Negative size in tar header causes infinite loop, resolved 281344, https://hackerone.com/reports/281344, No rate limiting on https://biz.uber.com/confirm allowed an attacker to join arbitrary business.uber.com accounts, resolved 281387, https://hackerone.com/reports/281387, xss, informative 281449, https://hackerone.com/reports/281449, Limited Account Takeover via Backup codes , duplicate 281472, https://hackerone.com/reports/281472, Unsubscribe Any User, informative 281575, https://hackerone.com/reports/281575, Password reset link injection allows redirect to malicious URL, resolved 281597, https://hackerone.com/reports/281597, Preferred language option fingerprinting issue in Tor Browser, informative 281682, https://hackerone.com/reports/281682, Crashes/Buffer at 0x2C0086,name=PBrowser::Msg_Destroy , informative 281850, https://hackerone.com/reports/281850, Provide a security sistem most fit to our team, not-applicable 281851, https://hackerone.com/reports/281851, XSS в личных сообщениях, resolved 281942, https://hackerone.com/reports/281942, Bugs, spam 281950, https://hackerone.com/reports/281950, Internal Ports Scanning via Blind SSRF, resolved 282176, https://hackerone.com/reports/282176, Unauthenticated hidden groups disclosure via Ajax groups search, resolved 282209, https://hackerone.com/reports/282209, Stored XSS in the Custom Logo link (non-Basic plan required), resolved 282339, https://hackerone.com/reports/282339, Cross-domain linkability when system time changed in Tor Browser, informative 282363, https://hackerone.com/reports/282363, Outdated jQuery Version, resolved 282475, https://hackerone.com/reports/282475, Sensitive information is publicly available , resolved 282490, https://hackerone.com/reports/282490, Application Vulnerable to CSRF - Remove Invited user, resolved 282535, https://hackerone.com/reports/282535, XSS on Report Classic, resolved 282564, https://hackerone.com/reports/282564, User enumeration via forgot password error message, duplicate 282570, https://hackerone.com/reports/282570, No notification on Password Change, duplicate 282572, https://hackerone.com/reports/282572, No Confirmation or Notification During Email Change which can leads to account takeover, duplicate 282588, https://hackerone.com/reports/282588, Take back my all data from limfuimay@gmail.com, spam 282604, https://hackerone.com/reports/282604, Stored XSS on profile page via Steam display name, resolved 282628, https://hackerone.com/reports/282628, OS Command Execution on User's PC via CSV Injection, informative 282748, https://hackerone.com/reports/282748, Detecting Tor Browser UI Language, resolved 282772, https://hackerone.com/reports/282772, no notification send to victim if attacker hacks/accesses his victims WebLate account., resolved 282843, https://hackerone.com/reports/282843, UnResolved ChangeSet are Visible to Public That also Causes Information Disclosure, informative 282909, https://hackerone.com/reports/282909, Report Design Critical Stored DOM XSS Vulnerability , resolved 283014, https://hackerone.com/reports/283014, View Any Program's Team Members through GET https://hackerone.com/invitations/, resolved 283058, https://hackerone.com/reports/283058, [IRCCloud Android] Opening arbitrary URLs/XSS in SAMLAuthActivity, resolved 283063, https://hackerone.com/reports/283063, [IRCCloud Android] XSS in ImageViewerActivity, resolved 283269, https://hackerone.com/reports/283269, A10 – Unvalidated Redirects and Forwards, informative 283309, https://hackerone.com/reports/283309, Private Program all members disclosed , duplicate 283361, https://hackerone.com/reports/283361, Private partial disclosure of h1 infrastructure , resolved 283407, https://hackerone.com/reports/283407, IDOR exposes receipts of all users., resolved 283419, https://hackerone.com/reports/283419, [app.mavenlink.com] IDOR to view sensitive information, resolved 283460, https://hackerone.com/reports/283460, Open Redirect Protection Bypass, resolved 283482, https://hackerone.com/reports/283482, Login Cross Site Request Forgery , duplicate 283492, https://hackerone.com/reports/283492, [health.mail.ru] Раскрытие SSI сценариев, resolved 283502, https://hackerone.com/reports/283502, XST(Cross Site Tracing), informative 283539, https://hackerone.com/reports/283539, Stored xss в /lead_forms_app.php, resolved 283550, https://hackerone.com/reports/283550, Password Reset Token Not Expired , resolved 283565, https://hackerone.com/reports/283565, XSS on infogram.com, resolved 283644, https://hackerone.com/reports/283644, Out-Of-Bounds Read in timelib_meridian(), resolved 283742, https://hackerone.com/reports/283742, HTML injection , resolved 283786, https://hackerone.com/reports/283786, Host Header Injection or cache poisoning in multiple domains, not-applicable 283821, https://hackerone.com/reports/283821, XSS when Shared, resolved 283825, https://hackerone.com/reports/283825, Multiple xss on infogram templates, resolved 283847, https://hackerone.com/reports/283847, GraphQL sessions aren't immediately invalidated when user password is changed, resolved 283951, https://hackerone.com/reports/283951, Bypassing X-frame options , not-applicable 284082, https://hackerone.com/reports/284082, Javascript Payload reflected Back in Report Embed Code, resolved 284143, https://hackerone.com/reports/284143, Reverse Tabnabbing Vulnerability in Outgoing Links, informative 284155, https://hackerone.com/reports/284155, Uninitialized server memory disclosure via ImageMagick gif parser, resolved 284807, https://hackerone.com/reports/284807, i am The bug, spam 284811, https://hackerone.com/reports/284811, Reflected SQL Execution, spam 284951, https://hackerone.com/reports/284951, Out-of-bounds read when importing corrupt blockchain with monero-blockchain-import, resolved 284963, https://hackerone.com/reports/284963, Insecure Direct Object Reference on API without API key, informative 285153, https://hackerone.com/reports/285153, No Email Verification, informative 285432, https://hackerone.com/reports/285432, IDOR - setAttribute action of user object in API, resolved 285482, https://hackerone.com/reports/285482, Security misconfiguration "weak passwords"., informative 285609, https://hackerone.com/reports/285609, Frameset(Frame) html tag is allowed in html editor.(can lead to clickjacking), resolved 286728, https://hackerone.com/reports/286728, Saying goodbye to HackerOne and Gratipay., resolved 286740, https://hackerone.com/reports/286740, Key Reinstallation Attacks: Breaking WPA2 by forcing nonce reuse, resolved 287245, https://hackerone.com/reports/287245, Blind SSRF in "Integrations" by abusing a bug in Ruby's native resolver., resolved 287378, https://hackerone.com/reports/287378, Possibility to view subdepartments for arbitrary domain, resolved 287382, https://hackerone.com/reports/287382, Self-xss via drag&drop in email form, resolved 287496, https://hackerone.com/reports/287496, Internal Ports Scanning via Blind SSRF (URL Redirection to beat filter), resolved 287562, https://hackerone.com/reports/287562, Stored XSS in content when Graph is created via API, resolved 287666, https://hackerone.com/reports/287666, CVE-2017-13089 wget stack smash, resolved 287667, https://hackerone.com/reports/287667, CVE-2017-13090 wget heap smash, resolved 287688, https://hackerone.com/reports/287688, Stored XSS On Wordpress Infogram plugin, resolved 287758, https://hackerone.com/reports/287758, Bypass insecure password validation, resolved 287789, https://hackerone.com/reports/287789, IDOR to view User Order Information, resolved 287835, https://hackerone.com/reports/287835, Resolv::getaddresses bug that can be abused to bypass security measures. , informative 287837, https://hackerone.com/reports/287837, 217.147.95.145 NFS Exposed with Zeus Server configs, resolved 288219, https://hackerone.com/reports/288219, Open Redirection while saving User account Settings , resolved 288298, https://hackerone.com/reports/288298, LFI in pChart php library, resolved 288353, https://hackerone.com/reports/288353, SMB SSRF in emblem editor exposes taketwo domain credentials, may lead to RCE, resolved 288540, https://hackerone.com/reports/288540, CSRF создание опроса от имени пользователя, зная id приложения. + небольшой флуд сообщениями на стену, resolved 288596, https://hackerone.com/reports/288596, User Profiles Leak PII in HTML Document for Mobile Browser User Agents, resolved 288704, https://hackerone.com/reports/288704, Command injection on Phabricator instance with an evil hg branch name, resolved 288707, https://hackerone.com/reports/288707, Email Spoofing, spam 288846, https://hackerone.com/reports/288846, Bruteforcing Coupons, resolved 288912, https://hackerone.com/reports/288912, Cross-origin resource sharing, informative 288950, https://hackerone.com/reports/288950, Additional bypass allows SSRF for internal netblocks, resolved 288955, https://hackerone.com/reports/288955, [IRCCloud Android] Theft of arbitrary files leading to token leakage, resolved 288966, https://hackerone.com/reports/288966, POODLE SSLv3 bug on multiple twitter smtp servers (mx3.twitter.com,199.59.148.204,199.16.156.108 and 199.59.148.204), resolved 289000, https://hackerone.com/reports/289000, Vulnerable exported broadcast receiver, resolved 289051, https://hackerone.com/reports/289051, Subdomain Takeover, resolved 289085, https://hackerone.com/reports/289085, Stored XSS on urbandictionary.com, resolved 289189, https://hackerone.com/reports/289189, Exposes a series of other private credentials, duplicate 289246, https://hackerone.com/reports/289246, Following links are vulnerable to clickjacking, resolved 289264, https://hackerone.com/reports/289264, Triggering RCE using XSS to bypass CSRF in PowerBeam M5 300, resolved 289330, https://hackerone.com/reports/289330, Reflected XSS vulnerability in Database name field on installation screen, resolved 289568, https://hackerone.com/reports/289568, Program profile metrics endpoint contains mean time to triage, even when turned off, resolved 289823, https://hackerone.com/reports/289823, Improper markup sanitization., resolved 289846, https://hackerone.com/reports/289846, X-XSS-Protection -> Misconfiguration, resolved 290023, https://hackerone.com/reports/290023, CSRF на biz.mail.ru, informative 290794, https://hackerone.com/reports/290794, Persistent XSS in share button, resolved 290889, https://hackerone.com/reports/290889, Session does't get expired after changing the password in https://readthedocs.org, informative 290930, https://hackerone.com/reports/290930, Information Disclosure when /invitations/.json is not yet accepted, resolved 291012, https://hackerone.com/reports/291012, Server-side cache poisoning leads to the http://my.dev.owox.com inaccessibility, resolved 291057, https://hackerone.com/reports/291057, MySQL username and password leaked in developer.valvesoftware.com via source code dislosure, resolved 291200, https://hackerone.com/reports/291200, Hard Coded username and password in registry, resolved 291489, https://hackerone.com/reports/291489, Kovri: potential buffer over-read in garlic clove handling + I2NP message creation, resolved 291531, https://hackerone.com/reports/291531, Introspection query leaks sensitive graphql system information., duplicate 291683, https://hackerone.com/reports/291683, Crafted frame injection leading to form-based UI redressing., resolved 291721, https://hackerone.com/reports/291721, IDOR on Program Visibilty (Revealed / Concealed) against other team members, duplicate 291750, https://hackerone.com/reports/291750, Link filter protection bypass, resolved 291764, https://hackerone.com/reports/291764, SQL Injection found in NextCloud Android App Content Provider, resolved 291822, https://hackerone.com/reports/291822, Shared-channel BETA persists integration after unshare, resolved 291878, https://hackerone.com/reports/291878, Arbitrary file deletion in wp-core - guides towards RCE and information disclosure, resolved 292457, https://hackerone.com/reports/292457, Reflected XSS in www.dota2.com, resolved 292500, https://hackerone.com/reports/292500, User provided values passed to PHP unset() function, informative 292636, https://hackerone.com/reports/292636, session_id is not being validated at email invitation endpoint, resolved 292673, https://hackerone.com/reports/292673, No Password Verification on Changing Email Address Cause Account takeover , resolved 292761, https://hackerone.com/reports/292761, Stealing Private Information in VK Android App through PlayerProxy Port Remotely, resolved 292797, https://hackerone.com/reports/292797, ActionController::Parameters .each returns an unsafe hash, resolved 292825, https://hackerone.com/reports/292825, Possible to redirect to a (non-existing) subdomain after logging in via GitHub (leaking the token), resolved 292997, https://hackerone.com/reports/292997, XSS работающая по всему сайту, где есть упоминания, resolved 293016, https://hackerone.com/reports/293016, CSRF log victim into the attacker account, resolved 293105, https://hackerone.com/reports/293105, XSS в личных сообщениях, resolved 293126, https://hackerone.com/reports/293126, Multiple issues in Libxml2 (2.9.2 - 2.9.5), resolved 293276, https://hackerone.com/reports/293276, Cloudflare does not sufficiently truncate credit card numbers in invoices, resolved 293358, https://hackerone.com/reports/293358, The Microsoft Store Uber App Does Not Implement Certificate Pinning, duplicate 293359, https://hackerone.com/reports/293359, The Uber Promo Customer Endpoint Does Not Implement Multifactor Authentication, Blacklisting or Rate Limiting, informative 293363, https://hackerone.com/reports/293363, The Microsoft Store Uber App Does Not Implement Server-side Token Revocation, informative 293581, https://hackerone.com/reports/293581, self-xss ads_easy_promote vk.com, resolved 293845, https://hackerone.com/reports/293845, [IDOR] Deleting other people's tasks, resolved 293847, https://hackerone.com/reports/293847, SSRF in /appsuite/api/autoconfig , resolved 294048, https://hackerone.com/reports/294048, Stored XSS => community.ubnt.com , resolved 294147, https://hackerone.com/reports/294147, Mercurial git subrepo lead to arbritary command injection, resolved 294201, https://hackerone.com/reports/294201, subdomain takeover at news-static.semrush.com, resolved 294232, https://hackerone.com/reports/294232, Adding external participants to unaccessible appointments, resolved 294334, https://hackerone.com/reports/294334, clickjacking в /lead_forms_app.php, resolved 294364, https://hackerone.com/reports/294364, De-anonymization by visiting specially crafted bookmark., resolved 294462, https://hackerone.com/reports/294462, NET::Ftp allows command injection in filenames, resolved 294464, https://hackerone.com/reports/294464, Verbose error message reveals internal system hostnames, protols and used ports (yrityspalvelu.tapiola.fi), resolved 294505, https://hackerone.com/reports/294505, Cross-site scripting in "Contact customer" form, resolved 294548, https://hackerone.com/reports/294548, Uninitilized server memory disclosure via ImageMagick, resolved 294568, https://hackerone.com/reports/294568, Information Disclosure - Composer.lock, duplicate 294867, https://hackerone.com/reports/294867, Improper Host Detection During Team Up on tweetdeck.twitter.com, resolved 294891, https://hackerone.com/reports/294891, Improper Certificate Validation, informative 294911, https://hackerone.com/reports/294911, Admin Panel Accessed (OAuth Bypassed ) , resolved 295276, https://hackerone.com/reports/295276, heap-use-after-free in OP_RESCUE, resolved 295330, https://hackerone.com/reports/295330, code.wordpress.net subdomain Takeover, resolved 295339, https://hackerone.com/reports/295339, Mailsploit: a sender spoofing bug in over 30 email clients, resolved 295380, https://hackerone.com/reports/295380, heap-buffer-overflow in OP_R_BREAK, resolved 295540, https://hackerone.com/reports/295540, [XSS] Portal Widget Mail, resolved 295680, https://hackerone.com/reports/295680, Invalid read leading to a segfault, resolved 295740, https://hackerone.com/reports/295740, GarlicRust - heartbleed style vulnerability in major I2P C++ router implementations, resolved 295841, https://hackerone.com/reports/295841, Blind SQL injection in Hall of Fap, resolved 295865, https://hackerone.com/reports/295865, Open Redirection on auth.rbk.money, resolved 295900, https://hackerone.com/reports/295900, New team invitation functionality allows extend team without upgrade, resolved 296045, https://hackerone.com/reports/296045, SSRF in VCARD photo upload functionality, resolved 296094, https://hackerone.com/reports/296094, Reflected Cross-site Scripting Vulnerability via JSON Error Message, resolved 296198, https://hackerone.com/reports/296198, SEGV on ary_concat, resolved 296622, https://hackerone.com/reports/296622, Blind XXE on pu.vk.com, resolved 296632, https://hackerone.com/reports/296632, Audit log validation, resolved 296701, https://hackerone.com/reports/296701, SSL-protected Reflected XSS in m.uber.com, duplicate 296706, https://hackerone.com/reports/296706, Open redirect deceive in hackerone.com via another open redirect link., informative 296907, https://hackerone.com/reports/296907, Lack of validation before assigning custom domain names leading to abuse of GitLab pages service, informative 296991, https://hackerone.com/reports/296991, Exim use-after-free vulnerability while reading mail header involving BDAT commands, resolved 296994, https://hackerone.com/reports/296994, Exim handles BDAT data incorrectly and leads to crash/hang, resolved 297181, https://hackerone.com/reports/297181, Common response suggestion is sent to Google Analytics when user accepts duplicate comment Genius suggestion, resolved 297198, https://hackerone.com/reports/297198, Leaking Referrer in Reset Password Link, resolved 297203, https://hackerone.com/reports/297203, Reflected XSS using Header Injection, resolved 297359, https://hackerone.com/reports/297359, No Rate Limit in email leads to huge Mass mailings, resolved 297383, https://hackerone.com/reports/297383, mruby heredoc notation, resolved 297434, https://hackerone.com/reports/297434, Unauthenticated Reflected XSS in admin dashboard, resolved 297478, https://hackerone.com/reports/297478, SQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agent , resolved 297534, https://hackerone.com/reports/297534, [www.zomato.com] Boolean SQLi - /█████.php, resolved 297547, https://hackerone.com/reports/297547, Improper markup sanitisation in Simplenote Android application., resolved 297751, https://hackerone.com/reports/297751, Registered users can change app password permissions for any user, resolved 297803, https://hackerone.com/reports/297803, [crm.unikrn.com] Open Redirect, resolved 297968, https://hackerone.com/reports/297968, Persistent DOM-based XSS in https://help.twitter.com via localStorage, resolved 298028, https://hackerone.com/reports/298028, Clickjacking on https://www.goodhire.com/api, resolved 298176, https://hackerone.com/reports/298176, SQL injection in MilestoneFinder order method, resolved 298218, https://hackerone.com/reports/298218, antispambot does not always escape <, >, &, " and ', informative 298246, https://hackerone.com/reports/298246, controlled buffer under-read in pack_unpack_internal(), resolved 298862, https://hackerone.com/reports/298862, It's possible to view configuration and/or source code on uchat.awscorp.uberinternal.com without , informative 298873, https://hackerone.com/reports/298873, Command injection by overwriting authorized_keys file through GitLab import, resolved 298888, https://hackerone.com/reports/298888, Design Issue at riders.uber.com/profile, informative 298990, https://hackerone.com/reports/298990, Configuration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication , informative 299009, https://hackerone.com/reports/299009, Single Sing On - Clickjacking, resolved 299034, https://hackerone.com/reports/299034, Text manipulation in https://checkout.rbk.money, duplicate 299112, https://hackerone.com/reports/299112, MediaElements XSS, resolved 299130, https://hackerone.com/reports/299130, SSRF - RSS feed, blacklist bypass (IP Formatting), resolved 299135, https://hackerone.com/reports/299135, SSRF - RSS feed, blacklist bypass (301 re-direct), resolved 299241, https://hackerone.com/reports/299241, [marketplace.informatica.com] - Template Injection, resolved 299334, https://hackerone.com/reports/299334, Information disclosure when trying to delete an expense's attachment on m.mavenlink.com , resolved 299403, https://hackerone.com/reports/299403, Domain spoofing in redirect page using RTLO, resolved 299424, https://hackerone.com/reports/299424, Bypass Filter and get Stored Xss , resolved 299460, https://hackerone.com/reports/299460, Fix for self-DoS in Security-txt Chrome Extension., resolved 299466, https://hackerone.com/reports/299466, [XSS] Mail