Double evaluation in .bash_prompt of dotfiles allows a malicious repository to execute arbitrary commands

👉 https://hackerone.com/reports/1785378

🔹 Severity: High | 💰 300 USD
🔹 Reported To: Ian Dunn
🔹 Reported By: #ryotak
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 4:00am (UTC)

CVE-2022-45402: Apache Airflow: Open redirect during login

👉 https://hackerone.com/reports/1782514

🔹 Severity: Medium | 💰 2,400 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #bugra
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 9:41am (UTC)

Calendar name length not validated before writing to database

👉 https://hackerone.com/reports/1596148

🔹 Severity: Low
🔹 Reported To: Nextcloud
🔹 Reported By: #errorx404
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 9:49am (UTC)

Firebase Database Takeover in https://pulseradio.mtn.co.ug/

👉 https://hackerone.com/reports/1447751

🔹 Severity: Critical
🔹 Reported To: MTN Group
🔹 Reported By: #shuvam321
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 10:52am (UTC)

Unprotected Direct Object Reference

👉 https://hackerone.com/reports/1536936

🔹 Severity: Critical
🔹 Reported To: MTN Group
🔹 Reported By: #coyemerald
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 5:24pm (UTC)

Remove Every User, Admin, And Owner Out Of Their Teams on developers.mtn.com via IDOR + Information Disclosure

👉 https://hackerone.com/reports/1448550

🔹 Severity: Critical
🔹 Reported To: MTN Group
🔹 Reported By: #wallotry
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 5:34pm (UTC)

Subdomain Takeover at course.oberlo.com

👉 https://hackerone.com/reports/1690951

🔹 Severity: No Rating
🔹 Reported To: Shopify
🔹 Reported By: #m7mdharoun
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 7:22pm (UTC)

Read/Write arbitrary (non-HttpOnly) cookies on checkout pages via GoogleAnalyticsAdditionalScripts postMessage handler

👉 https://hackerone.com/reports/1081167

🔹 Severity: Medium | 💰 1,600 USD
🔹 Reported To: Shopify
🔹 Reported By: #bored-engineer
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 7:34pm (UTC)

Disconnecting an external login provider does not revoke session

👉 https://hackerone.com/reports/1547684

🔹 Severity: Medium | 💰 1,600 USD
🔹 Reported To: Shopify
🔹 Reported By: #attackerbhai
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 7:50pm (UTC)

Stored XSS in /admin/product and /admin/collections

👉 https://hackerone.com/reports/1147433

🔹 Severity: Medium | 💰 5,300 USD
🔹 Reported To: Shopify
🔹 Reported By: #ashketchum
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 10:44pm (UTC)

Authentication bypass in https://nin.mtn.ng

👉 https://hackerone.com/reports/1747146

🔹 Severity: Critical
🔹 Reported To: MTN Group
🔹 Reported By: #roland_hack
🔹 State: 🟢 Resolved
🔹 Disclosed: December 2, 2022, 1:00pm (UTC)

XSS in Acronis Cloud Manager Admin Portal

👉 https://hackerone.com/reports/1388788

🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: Acronis
🔹 Reported By: #mooimacow
🔹 State: 🟢 Resolved
🔹 Disclosed: December 2, 2022, 7:48pm (UTC)

POST following PUT confusion

👉 https://hackerone.com/reports/1752146

🔹 Severity: Medium | 💰 2,400 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #robbotic
🔹 State: 🟢 Resolved
🔹 Disclosed: December 2, 2022, 9:03pm (UTC)

Exposed Cortex API at https://cortex-ingest.shopifycloud.com/

👉 https://hackerone.com/reports/1258871

🔹 Severity: Medium | 💰 6,300 USD
🔹 Reported To: Shopify
🔹 Reported By: #ian
🔹 State: 🟢 Resolved
🔹 Disclosed: December 2, 2022, 10:25pm (UTC)

CVE-2022-35260: .netrc parser out-of-bounds access

👉 https://hackerone.com/reports/1753224

🔹 Severity: Low | 💰 480 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #kurohiro
🔹 State: 🟢 Resolved
🔹 Disclosed: December 3, 2022, 12:20am (UTC)

IDOR in Stats API Endpoint Allows Viewing Equity or Net Profit of Any MT Account

👉 https://hackerone.com/reports/1644436

🔹 Severity: No Rating | 💰 1,000 USD
🔹 Reported To: EXNESS
🔹 Reported By: #ashwarya
🔹 State: 🟢 Resolved
🔹 Disclosed: December 5, 2022, 3:50pm (UTC)

[Splatoon 3] Kick other players with NplnLogin message

🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nintendo
🔹 Reported By: alzxk11
🔹 State: 🟢 Resolved
🔹 Disclosed: July 2, 2026, 1:25am (UTC)

A vulnerability was discovered that allowed players to kick other players from a Splatoon 3 game using an NplnLogin message.

👉 Read full report

admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removed

🔹 Severity: None
🔹 Reported To: Shopify
🔹 Reported By: abahack
🔹 State: ⚪️ Informative
🔹 Disclosed: July 3, 2026, 6:50pm (UTC)

👉 Read full report

Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivity

🔹 Severity: Medium | 💰 287 USD
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Basecamp
🔹 Reported By: zerodaysec_xyz
🔹 State: 🟢 Resolved
🔹 Disclosed: July 4, 2026, 11:05am (UTC)

A vulnerability was discovered in the Basecamp Android app that allowed any installed app to force immediate logout and persistent denial-of-service of authenticated Basecamp sessions. The vulnerability was due to the `com.basecamp.bc4.app.main.start.StartActivity` being declared as exported without any permission guard. This allowed any app to launch it with an explicit intent, terminating the current session and…

👉 Read full report

OS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE)

🔹 Severity: High
🔹 Weakness: OS Command Injection
🔹 Reported To: AWS VDP
🔹 Reported By: kaporia
🔹 State: 🟢 Resolved
🔹 Disclosed: July 6, 2026, 5:48pm (UTC)

A vulnerability was discovered in the "aws-cdk-lib" NodejsFunction that allowed for OS command injection through the unsanitized "OsCommand" helper. The vulnerability was caused by the lack of proper escaping of user-controlled data when constructing shell commands during Docker-based bundling. This could have potentially led to arbitrary code execution within the Docker container, which had access to the host…

👉 Read full report

Kiro IDE Stores Auth Tokens with World-Readable Permissions (0644)

🔹 Severity: Medium
🔹 Weakness: Incorrect Default Permissions
🔹 Reported To: AWS VDP
🔹 Reported By: mistercloudsec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 9, 2026, 3:31pm (UTC)

The Kiro IDE (version 0.11.107) wrote authentication tokens (access token and refresh token) to a file with world-readable permissions (0644). The file contained sensitive information, including the access token, refresh token, and profile ARN. This exposed the credentials to potential unauthorized access by local processes or users.

👉 Read full report