🎯 New Report #2971572: Stored Cross-Site Scripting found in custom integration app on https://admin.b360.autodesk.com.
🔺Severity: Medium
👽 Reporter: the-white-evil
💼 Team: Autodesk
💵 Bounty: null
⏰ Disclosed: 2025-03-14 15:01:56.725Z
📝 Summary: Stored Cross-Site Scripting was found in custom integration app on https://admin.b360.autodesk.com. The vulnerability could have allowed an attacker to inject malicious JavaScript code when viewed by users. The issue was fixed by Autodesk.
@hackeronereports
🔺Severity: Medium
👽 Reporter: the-white-evil
💼 Team: Autodesk
💵 Bounty: null
⏰ Disclosed: 2025-03-14 15:01:56.725Z
📝 Summary: Stored Cross-Site Scripting was found in custom integration app on https://admin.b360.autodesk.com. The vulnerability could have allowed an attacker to inject malicious JavaScript code when viewed by users. The issue was fixed by Autodesk.
@hackeronereports
🎯 New Report #2677306: Spamming highly nested JSON RPC requests cause node to disconnect from p2p network
🔺Severity: null
👽 Reporter: asurar0
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2024-08-22
⏰ Disclosed: 2025-04-23 12:05:28
📝 Summary: The vulnerability allowed an attacker to remotely lock monerod from syncing with the rest of the p2p network by forging a highly nested JSON payload and spamming it through a restricted RPC interface. The Epee JSON parser was found to allow duplicated fields and set a recursion limit that was too high, enabling the creation of a JSON RPC payload that caused CPU-intensive parsing operations. This vulnerability was discovered in the monerod master branch a1dc85c.
@hackeronereports
🔺Severity: null
👽 Reporter: asurar0
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2024-08-22
⏰ Disclosed: 2025-04-23 12:05:28
📝 Summary: The vulnerability allowed an attacker to remotely lock monerod from syncing with the rest of the p2p network by forging a highly nested JSON payload and spamming it through a restricted RPC interface. The Epee JSON parser was found to allow duplicated fields and set a recursion limit that was too high, enabling the creation of a JSON RPC payload that caused CPU-intensive parsing operations. This vulnerability was discovered in the monerod master branch a1dc85c.
@hackeronereports
🎯 New Report #2912194: Remote memory exhaustion in Epee RPC stack under zero Receive Window
🔺Severity: High
👽 Reporter: sagewilder2022
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2024-12-23
⏰ Disclosed: 2025-04-23 13:53:57
📝 Summary: The Epee RPC stack in Monero was vulnerable to memory exhaustion attacks. Delayed ACK or zero Receive Window advertisements could cause the server to keep responses in the send queue until memory was exhausted. This could lead to remote crashes of Monero nodes that exposed their RPC interfaces.
@hackeronereports
🔺Severity: High
👽 Reporter: sagewilder2022
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2024-12-23
⏰ Disclosed: 2025-04-23 13:53:57
📝 Summary: The Epee RPC stack in Monero was vulnerable to memory exhaustion attacks. Delayed ACK or zero Receive Window advertisements could cause the server to keep responses in the send queue until memory was exhausted. This could lead to remote crashes of Monero nodes that exposed their RPC interfaces.
@hackeronereports
🎯 New Report #2693786: A peer can remotely fill the pending block queue to an extremely high size, with blocks that will never leave the queue.
🔺Severity: null
👽 Reporter: boog900
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2024-09-01
⏰ Disclosed: 2025-04-23 15:05:22
📝 Summary: The pending block queue in the Monero cryptocurrency protocol could be remotely filled to an extremely high size, up to approximately 54 GB, with blocks that would never leave the queue. This was possible due to lax rules in the synchronization code that allowed the queue size limit to be bypassed under certain circumstances. Additionally, the protocol did not properly validate the relationship between blocks added to the queue, allowing unrelated blocks to be added. This vulnerability could have been exploited to effectively disrupt the operation of Monero nodes.
@hackeronereports
🔺Severity: null
👽 Reporter: boog900
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2024-09-01
⏰ Disclosed: 2025-04-23 15:05:22
📝 Summary: The pending block queue in the Monero cryptocurrency protocol could be remotely filled to an extremely high size, up to approximately 54 GB, with blocks that would never leave the queue. This was possible due to lax rules in the synchronization code that allowed the queue size limit to be bypassed under certain circumstances. Additionally, the protocol did not properly validate the relationship between blocks added to the queue, allowing unrelated blocks to be added. This vulnerability could have been exploited to effectively disrupt the operation of Monero nodes.
@hackeronereports
🎯 New Report #3101858: Unauthorized Table Creation by Member
🔺Severity: Medium
👽 Reporter: mous haxk
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-20
⏰ Disclosed: 2025-04-23 19:06:06
📝 Summary: The member user was able to create tables inside restricted company data spaces, despite the UI indicating that only workspace builders (admins) should be allowed. The "Add Data" button appeared disabled in the UI, but it was still interactable and functional, allowing the member to successfully create and save a new table.
@hackeronereports
🔺Severity: Medium
👽 Reporter: mous haxk
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-20
⏰ Disclosed: 2025-04-23 19:06:06
📝 Summary: The member user was able to create tables inside restricted company data spaces, despite the UI indicating that only workspace builders (admins) should be allowed. The "Add Data" button appeared disabled in the UI, but it was still interactable and functional, allowing the member to successfully create and save a new table.
@hackeronereports
🎯 New Report #2315026: Transactions in invalid blocks are kept in tx-pool without undergoing certain checks.
🔺Severity: null
👽 Reporter: boog900
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2024-01-13
⏰ Disclosed: 2025-04-23 18:26:38
📝 Summary: The transactions in invalid blocks were kept in the tx-pool without undergoing certain checks. When adding blocks to the blockchain, monerod first added the transactions to the tx pool with
@hackeronereports
🔺Severity: null
👽 Reporter: boog900
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2024-01-13
⏰ Disclosed: 2025-04-23 18:26:38
📝 Summary: The transactions in invalid blocks were kept in the tx-pool without undergoing certain checks. When adding blocks to the blockchain, monerod first added the transactions to the tx pool with
relay method::block, which allowed the tx-pool to skip certain checks like fee and extra field size. However, if the block turned out to be invalid, the transactions were kept in the pool and did not undergo the regular relay checks. This was problematic because the input validity check was also skipped for relay method::block transactions, allowing the creation of blocks with completely invalid transactions.@hackeronereports
🎯 New Report #3101986: UI flaw allows unauthorized users to add documents to restricted folders
🔺Severity: Medium
👽 Reporter: qatada
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-20
⏰ Disclosed: 2025-04-23 19:26:44
📝 Summary: The UI flaw allowed unauthorized users to add documents to restricted folders. The vulnerability bypassed intended permissions and could lead to unauthorized access or data integrity issues.
@hackeronereports
🔺Severity: Medium
👽 Reporter: qatada
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-20
⏰ Disclosed: 2025-04-23 19:26:44
📝 Summary: The UI flaw allowed unauthorized users to add documents to restricted folders. The vulnerability bypassed intended permissions and could lead to unauthorized access or data integrity issues.
@hackeronereports
🎯 New Report #3018307: Groups module can halt chain when handling a proposal with malicious group weights
🔺Severity: High
👽 Reporter: vakzz
💼 Team: Cosmos
💵 Bounty: 15000
🕐 Submitted: 2025-02-28
⏰ Disclosed: 2025-04-23 23:00:29
📝 Summary: The Cosmos SDK's groups module contained a vulnerability that could cause a chain to halt when handling a proposal with malicious group weights. The issue was triggered by a division operation that could fail due to the exponent of the resulting value being out of range, leading to a panic and chain halt. This was possible because there were no limits on group member weights, allowing the creation of malicious weights that could trigger the vulnerability.
@hackeronereports
🔺Severity: High
👽 Reporter: vakzz
💼 Team: Cosmos
💵 Bounty: 15000
🕐 Submitted: 2025-02-28
⏰ Disclosed: 2025-04-23 23:00:29
📝 Summary: The Cosmos SDK's groups module contained a vulnerability that could cause a chain to halt when handling a proposal with malicious group weights. The issue was triggered by a division operation that could fail due to the exponent of the resulting value being out of range, leading to a panic and chain halt. This was possible because there were no limits on group member weights, allowing the creation of malicious weights that could trigger the vulnerability.
@hackeronereports
🎯 New Report #2926361: Non-Production API Endpoints for the ssm Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
🔺Severity: Medium
👽 Reporter: nick frichette dd
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2025-01-07
⏰ Disclosed: 2025-04-24 01:39:40
📝 Summary: The non-production API endpoints for the ssm service were found to fail to log to CloudTrail, resulting in silent permission enumeration. Eighteen non-production endpoints were identified that can be used with standard IAM credentials without generating CloudTrail logs.
@hackeronereports
🔺Severity: Medium
👽 Reporter: nick frichette dd
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2025-01-07
⏰ Disclosed: 2025-04-24 01:39:40
📝 Summary: The non-production API endpoints for the ssm service were found to fail to log to CloudTrail, resulting in silent permission enumeration. Eighteen non-production endpoints were identified that can be used with standard IAM credentials without generating CloudTrail logs.
@hackeronereports
🎯 New Report #3103755: Privilege Escalation in Edit and Create Secret Endpoints Leads to Unauthorized Secret Modification
🔺Severity: High
👽 Reporter: 0xsom3a
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-22
⏰ Disclosed: 2025-04-24 06:43:15
📝 Summary: A vulnerability was discovered where a user with the Builder role could list all existing secret names, create new secrets, and overwrite existing secrets by using the same name. This behavior violated permission boundaries and led to privilege escalation, potentially enabling unauthorized access to sensitive data.
@hackeronereports
🔺Severity: High
👽 Reporter: 0xsom3a
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-22
⏰ Disclosed: 2025-04-24 06:43:15
📝 Summary: A vulnerability was discovered where a user with the Builder role could list all existing secret names, create new secrets, and overwrite existing secrets by using the same name. This behavior violated permission boundaries and led to privilege escalation, potentially enabling unauthorized access to sensitive data.
@hackeronereports
🎯 New Report #3021451: Non-Production API Endpoint for the ElastiCache Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
🔺Severity: Medium
👽 Reporter: nick frichette dd
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2025-03-03
⏰ Disclosed: 2025-04-25 16:23:03
📝 Summary: The ElastiCache service contains a non-production API endpoint that allows for permission enumeration without logging to CloudTrail. This could enable an adversary with compromised credentials to silently test the permissions of the credentials.
@hackeronereports
🔺Severity: Medium
👽 Reporter: nick frichette dd
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2025-03-03
⏰ Disclosed: 2025-04-25 16:23:03
📝 Summary: The ElastiCache service contains a non-production API endpoint that allows for permission enumeration without logging to CloudTrail. This could enable an adversary with compromised credentials to silently test the permissions of the credentials.
@hackeronereports
🎯 New Report #2972435: Non-Production API Endpoints for the cloudwatch Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
🔺Severity: Medium
👽 Reporter: nick frichette dd
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2025-02-03
⏰ Disclosed: 2025-04-25 16:22:10
📝 Summary: The vulnerability allows adversaries to silently enumerate permissions of compromised AWS credentials for the CloudWatch service without generating logs in CloudTrail. Two non-production API endpoints were identified that can be accessed with standard IAM credentials but do not log the activity. This could enable stealthy permission discovery by adversaries.
@hackeronereports
🔺Severity: Medium
👽 Reporter: nick frichette dd
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2025-02-03
⏰ Disclosed: 2025-04-25 16:22:10
📝 Summary: The vulnerability allows adversaries to silently enumerate permissions of compromised AWS credentials for the CloudWatch service without generating logs in CloudTrail. Two non-production API endpoints were identified that can be accessed with standard IAM credentials but do not log the activity. This could enable stealthy permission discovery by adversaries.
@hackeronereports
🎯 New Report #3031512: Non-Production API Endpoints for the Glue Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
🔺Severity: Medium
👽 Reporter: nick frichette dd
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2025-03-11
⏰ Disclosed: 2025-04-25 16:21:40
📝 Summary: The AWS Glue service was found to have 12 non-production API endpoints that could be accessed using standard IAM credentials without generating any CloudTrail logs. This allowed for silent permission enumeration, where an adversary could determine the permissions of compromised credentials without leaving any trace.
@hackeronereports
🔺Severity: Medium
👽 Reporter: nick frichette dd
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2025-03-11
⏰ Disclosed: 2025-04-25 16:21:40
📝 Summary: The AWS Glue service was found to have 12 non-production API endpoints that could be accessed using standard IAM credentials without generating any CloudTrail logs. This allowed for silent permission enumeration, where an adversary could determine the permissions of compromised credentials without leaving any trace.
@hackeronereports
🎯 New Report #2974850: CVE-2025-0725: Heap overflow in curl with Content-Encoding gzip and old libz versions
🔺Severity: Low
👽 Reporter: z2
💼 Team: Internet Bug Bounty
💵 Bounty: null
🕐 Submitted: 2025-02-05
⏰ Disclosed: 2025-04-27 13:53:37
📝 Summary: A vulnerability was reported in the curl project, where a heap overflow could be triggered by a malicious HTTP server serving abnormally large gzip headers. The vulnerability was caused by an integer overflow in curl's support for old libz versions when the
@hackeronereports
🔺Severity: Low
👽 Reporter: z2
💼 Team: Internet Bug Bounty
💵 Bounty: null
🕐 Submitted: 2025-02-05
⏰ Disclosed: 2025-04-27 13:53:37
📝 Summary: A vulnerability was reported in the curl project, where a heap overflow could be triggered by a malicious HTTP server serving abnormally large gzip headers. The vulnerability was caused by an integer overflow in curl's support for old libz versions when the
Content-Encoding: gzip header was used. The vulnerability was assigned the CVE identifier CVE-2025-0725 and was classified as low severity.@hackeronereports
🎯 New Report #2987782: Possible DoS by memory exhaustion in net/imap
🔺Severity: Medium
👽 Reporter: manun
💼 Team: Internet Bug Bounty
💵 Bounty: null
🕐 Submitted: 2025-02-11
⏰ Disclosed: 2025-04-27 13:45:48
📝 Summary: The net-imap gem implemented an IMAP client in Ruby. Versions prior to 0.3.8, 0.4.19, and 0.5.6 contained a vulnerability that could lead to denial of service by memory exhaustion. The vulnerability was caused by the response parser using
@hackeronereports
🔺Severity: Medium
👽 Reporter: manun
💼 Team: Internet Bug Bounty
💵 Bounty: null
🕐 Submitted: 2025-02-11
⏰ Disclosed: 2025-04-27 13:45:48
📝 Summary: The net-imap gem implemented an IMAP client in Ruby. Versions prior to 0.3.8, 0.4.19, and 0.5.6 contained a vulnerability that could lead to denial of service by memory exhaustion. The vulnerability was caused by the response parser using
Range#to a to convert uid-set data without limiting the expanded size of the ranges. This vulnerability has been assigned the CVE identifier CVE-2025-25186.@hackeronereports
🎯 New Report #3108869: Denial of Service by memory exhaustion in net/imap
🔺Severity: Medium
👽 Reporter: masamune
💼 Team: Internet Bug Bounty
💵 Bounty: null
🕐 Submitted: 2025-04-26
⏰ Disclosed: 2025-04-27 15:10:47
📝 Summary: A vulnerability was discovered in the net-imap library that allowed denial of service by memory exhaustion. The vulnerability was caused by the library automatically reading and allocating memory for the size of "literal" strings sent by the server, without any limit on the size. This could be exploited by a malicious server to cause the program to crash or system instability.
@hackeronereports
🔺Severity: Medium
👽 Reporter: masamune
💼 Team: Internet Bug Bounty
💵 Bounty: null
🕐 Submitted: 2025-04-26
⏰ Disclosed: 2025-04-27 15:10:47
📝 Summary: A vulnerability was discovered in the net-imap library that allowed denial of service by memory exhaustion. The vulnerability was caused by the library automatically reading and allocating memory for the size of "literal" strings sent by the server, without any limit on the size. This could be exploited by a malicious server to cause the program to crash or system instability.
@hackeronereports
🎯 New Report #3031518: CVE-2025-24813: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet
🔺Severity: High
👽 Reporter: sw0rd1ight
💼 Team: Internet Bug Bounty
💵 Bounty: 4323
🕐 Submitted: 2025-03-11
⏰ Disclosed: 2025-04-27 14:53:24
📝 Summary: The Apache Tomcat vulnerability CVE-2025-24813 allowed remote code execution and information disclosure. The vulnerability was caused by a combination of features, including writes enabled for the default servlet, support for partial PUT requests, and the use of Tomcat's file-based session persistence with the default storage location. If these conditions were met, a malicious user could have taken advantage of the vulnerability.
@hackeronereports
🔺Severity: High
👽 Reporter: sw0rd1ight
💼 Team: Internet Bug Bounty
💵 Bounty: 4323
🕐 Submitted: 2025-03-11
⏰ Disclosed: 2025-04-27 14:53:24
📝 Summary: The Apache Tomcat vulnerability CVE-2025-24813 allowed remote code execution and information disclosure. The vulnerability was caused by a combination of features, including writes enabled for the default servlet, support for partial PUT requests, and the use of Tomcat's file-based session persistence with the default storage location. If these conditions were met, a malicious user could have taken advantage of the vulnerability.
@hackeronereports
🎯 New Report #3013913: [CVE-2025-27219 Denial of Service in CGI::Cookie.parse](https://hackerone.com/reports/3013913)
🔺Severity: Medium
👽 Reporter: lio346
💼 Team: Internet Bug Bounty
💵 Bounty: null
🕐 Submitted: 2025-02-26
⏰ Disclosed: 2025-04-27 14:27:52
📝 Summary: A denial-of-service vulnerability was discovered in the
@hackeronereports
🔺Severity: Medium
👽 Reporter: lio346
💼 Team: Internet Bug Bounty
💵 Bounty: null
🕐 Submitted: 2025-02-26
⏰ Disclosed: 2025-04-27 14:27:52
📝 Summary: A denial-of-service vulnerability was discovered in the
CGI::Cookie.parse method of the Ruby cgi gem. The vulnerability was caused by the method taking super-linear time to parse a maliciously crafted cookie string. This could have led to service disruptions. The vulnerability was assigned the CVE identifier CVE-2025-27219.@hackeronereports
🎯 New Report #3094406: Heap‑based buffer overflow in curl -K <config file> allows arbitrary write .
🔺Severity: High
👽 Reporter: bsr13
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-04-15
⏰ Disclosed: 2025-04-27 16:00:11
📝 Summary: null
@hackeronereports
🔺Severity: High
👽 Reporter: bsr13
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-04-15
⏰ Disclosed: 2025-04-27 16:00:11
📝 Summary: null
@hackeronereports
🎯 New Report #3002543: CVE-2024-43398: DoS vulnerability in REXML
🔺Severity: Low
👽 Reporter: l33thaxor
💼 Team: Internet Bug Bounty
💵 Bounty: 505
🕐 Submitted: 2025-02-19
⏰ Disclosed: 2025-04-27 16:57:59
📝 Summary: The CVE-2024-43398 vulnerability was a denial-of-service issue in the REXML library due to poor performance when parsing specially crafted XML. This vulnerability was addressed with a patch released by the Ruby team.
@hackeronereports
🔺Severity: Low
👽 Reporter: l33thaxor
💼 Team: Internet Bug Bounty
💵 Bounty: 505
🕐 Submitted: 2025-02-19
⏰ Disclosed: 2025-04-27 16:57:59
📝 Summary: The CVE-2024-43398 vulnerability was a denial-of-service issue in the REXML library due to poor performance when parsing specially crafted XML. This vulnerability was addressed with a patch released by the Ruby team.
@hackeronereports
🎯 New Report #3082917: Possible Sensitive Session Information Leak in Active Storage
🔺Severity: High
👽 Reporter: tyage
💼 Team: Internet Bug Bounty
💵 Bounty: 4323
🕐 Submitted: 2025-04-08
⏰ Disclosed: 2025-04-27 22:55:36
📝 Summary: There was a possible sensitive session information leak in Active Storage. Active Storage incorrectly sent the user's session cookie along with a Cache-Control: public header when serving files (blobs). This allowed certain caching proxies to cache the response, including the Set-Cookie header, potentially exposing the original user's session cookie to unrelated users.
@hackeronereports
🔺Severity: High
👽 Reporter: tyage
💼 Team: Internet Bug Bounty
💵 Bounty: 4323
🕐 Submitted: 2025-04-08
⏰ Disclosed: 2025-04-27 22:55:36
📝 Summary: There was a possible sensitive session information leak in Active Storage. Active Storage incorrectly sent the user's session cookie along with a Cache-Control: public header when serving files (blobs). This allowed certain caching proxies to cache the response, including the Set-Cookie header, potentially exposing the original user's session cookie to unrelated users.
@hackeronereports