🎯 New Report #3094406: Heap‑based buffer overflow in curl -K <config file> allows arbitrary write .
🔺Severity: High
👽 Reporter: bsr13
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-04-15
⏰ Disclosed: 2025-04-27 16:00:11
📝 Summary: null
@hackeronereports
🔺Severity: High
👽 Reporter: bsr13
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-04-15
⏰ Disclosed: 2025-04-27 16:00:11
📝 Summary: null
@hackeronereports
🎯 New Report #3002543: CVE-2024-43398: DoS vulnerability in REXML
🔺Severity: Low
👽 Reporter: l33thaxor
💼 Team: Internet Bug Bounty
💵 Bounty: 505
🕐 Submitted: 2025-02-19
⏰ Disclosed: 2025-04-27 16:57:59
📝 Summary: The CVE-2024-43398 vulnerability was a denial-of-service issue in the REXML library due to poor performance when parsing specially crafted XML. This vulnerability was addressed with a patch released by the Ruby team.
@hackeronereports
🔺Severity: Low
👽 Reporter: l33thaxor
💼 Team: Internet Bug Bounty
💵 Bounty: 505
🕐 Submitted: 2025-02-19
⏰ Disclosed: 2025-04-27 16:57:59
📝 Summary: The CVE-2024-43398 vulnerability was a denial-of-service issue in the REXML library due to poor performance when parsing specially crafted XML. This vulnerability was addressed with a patch released by the Ruby team.
@hackeronereports
🎯 New Report #3082917: Possible Sensitive Session Information Leak in Active Storage
🔺Severity: High
👽 Reporter: tyage
💼 Team: Internet Bug Bounty
💵 Bounty: 4323
🕐 Submitted: 2025-04-08
⏰ Disclosed: 2025-04-27 22:55:36
📝 Summary: There was a possible sensitive session information leak in Active Storage. Active Storage incorrectly sent the user's session cookie along with a Cache-Control: public header when serving files (blobs). This allowed certain caching proxies to cache the response, including the Set-Cookie header, potentially exposing the original user's session cookie to unrelated users.
@hackeronereports
🔺Severity: High
👽 Reporter: tyage
💼 Team: Internet Bug Bounty
💵 Bounty: 4323
🕐 Submitted: 2025-04-08
⏰ Disclosed: 2025-04-27 22:55:36
📝 Summary: There was a possible sensitive session information leak in Active Storage. Active Storage incorrectly sent the user's session cookie along with a Cache-Control: public header when serving files (blobs). This allowed certain caching proxies to cache the response, including the Set-Cookie header, potentially exposing the original user's session cookie to unrelated users.
@hackeronereports
🎯 New Report #3103849: Privilege Escalation leads to Unauthorized Access to Private Conversations By any Regular user [Read , Edit and Delete](https://hackerone.com/reports/3103849)
🔺Severity: Critical
👽 Reporter: 0xsom3a
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-22
⏰ Disclosed: 2025-04-29 11:01:20
📝 Summary: null
@hackeronereports
🔺Severity: Critical
👽 Reporter: 0xsom3a
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-22
⏰ Disclosed: 2025-04-29 11:01:20
📝 Summary: null
@hackeronereports
🎯 New Report #3102890: User Limit Bypass via Pending Invitations in Workspace System
🔺Severity: Medium
👽 Reporter: qatada
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-21
⏰ Disclosed: 2025-04-29 10:21:07
📝 Summary: The platform's workspace user limit was found to be vulnerable to bypass through the use of pending invitations. Users were able to join a workspace by signing up with an invited email, even after the workspace had reached its user limit for the current subscription tier. This allowed an unlimited number of users to be added to a restricted workspace, potentially impacting the platform's revenue model.
@hackeronereports
🔺Severity: Medium
👽 Reporter: qatada
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-21
⏰ Disclosed: 2025-04-29 10:21:07
📝 Summary: The platform's workspace user limit was found to be vulnerable to bypass through the use of pending invitations. Users were able to join a workspace by signing up with an invited email, even after the workspace had reached its user limit for the current subscription tier. This allowed an unlimited number of users to be added to a restricted workspace, potentially impacting the platform's revenue model.
@hackeronereports
🎯 New Report #3104355: Race Condition in Folder Creation Allows Bypassing Folder Limit
🔺Severity: Medium
👽 Reporter: 0xsom3a
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-22
⏰ Disclosed: 2025-04-29 10:17:40
📝 Summary: The application enforced a hard limit of 10 folders per user under a specific space. However, due to a race condition, it was possible to bypass this limit by sending multiple folder creation requests simultaneously after deleting one folder. This allowed creating more than 10 folders, breaking the intended restriction.
@hackeronereports
🔺Severity: Medium
👽 Reporter: 0xsom3a
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-22
⏰ Disclosed: 2025-04-29 10:17:40
📝 Summary: The application enforced a hard limit of 10 folders per user under a specific space. However, due to a race condition, it was possible to bypass this limit by sending multiple folder creation requests simultaneously after deleting one folder. This allowed creating more than 10 folders, breaking the intended restriction.
@hackeronereports
🎯 New Report #3114132: Broken Access Control Exposes Email Verification Status and Privacy Settings via API Endpoint
🔺Severity: Low
👽 Reporter: ctrl cipher
💼 Team: WakaTime
💵 Bounty: null
🕐 Submitted: 2025-04-26
⏰ Disclosed: 2025-04-29 12:45:03
📝 Summary: The /api/v1/users/{username} endpoint leaked sensitive email-related metadata, such as the user's email confirmation status and privacy settings, without proper authorization checks. This allowed attackers to determine whether an account's email address was confirmed and the user's email privacy preferences, even if the email itself was hidden.
@hackeronereports
🔺Severity: Low
👽 Reporter: ctrl cipher
💼 Team: WakaTime
💵 Bounty: null
🕐 Submitted: 2025-04-26
⏰ Disclosed: 2025-04-29 12:45:03
📝 Summary: The /api/v1/users/{username} endpoint leaked sensitive email-related metadata, such as the user's email confirmation status and privacy settings, without proper authorization checks. This allowed attackers to determine whether an account's email address was confirmed and the user's email privacy preferences, even if the email itself was hidden.
@hackeronereports
🎯 New Report #3051155: Information disclosure on IBM training service endpoint
🔺Severity: null
👽 Reporter: thpless
💼 Team: IBM
💵 Bounty: null
🕐 Submitted: 2025-04-09
⏰ Disclosed: 2025-04-29 14:57:05
📝 Summary: The IBM training service endpoint had an information disclosure vulnerability that was reported to IBM, analyzed, and remediated. The vulnerability was discovered and reported by an external researcher.
@hackeronereports
🔺Severity: null
👽 Reporter: thpless
💼 Team: IBM
💵 Bounty: null
🕐 Submitted: 2025-04-09
⏰ Disclosed: 2025-04-29 14:57:05
📝 Summary: The IBM training service endpoint had an information disclosure vulnerability that was reported to IBM, analyzed, and remediated. The vulnerability was discovered and reported by an external researcher.
@hackeronereports
🎯 New Report #3117697: Double Free Vulnerability in `libcurl` Cookie Management (`cookie.c`)
🔺Severity: null
👽 Reporter: tannicarcher
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-04-29
⏰ Disclosed: 2025-04-29 21:16:18
📝 Summary: null
@hackeronereports
🔺Severity: null
👽 Reporter: tannicarcher
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-04-29
⏰ Disclosed: 2025-04-29 21:16:18
📝 Summary: null
@hackeronereports
🎯 New Report #3116935: Use of a Broken or Risky Cryptographic Algorithm (CWE-327) in libcurl
🔺Severity: null
👽 Reporter: tannicarcher
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-04-29
⏰ Disclosed: 2025-04-29 21:16:05
📝 Summary: null
@hackeronereports
🔺Severity: null
👽 Reporter: tannicarcher
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-04-29
⏰ Disclosed: 2025-04-29 21:16:05
📝 Summary: null
@hackeronereports
🎯 New Report #3114554: Privilege Persistence via Cloned Agent
🔺Severity: Medium
👽 Reporter: yoyomiski
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-27
⏰ Disclosed: 2025-04-30 07:07:43
📝 Summary: The vulnerability allowed a member to clone an agent managed by the admin by modifying the agent's unique identifier (sid). This resulted in the admin being unable to effectively disable the agent, as the cloned version could still be used by the member even after the original agent was disabled.
@hackeronereports
🔺Severity: Medium
👽 Reporter: yoyomiski
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-27
⏰ Disclosed: 2025-04-30 07:07:43
📝 Summary: The vulnerability allowed a member to clone an agent managed by the admin by modifying the agent's unique identifier (sid). This resulted in the admin being unable to effectively disable the agent, as the cloned version could still be used by the member even after the original agent was disabled.
@hackeronereports
🎯 New Report #3120790: Session Replay Attack Allows Authentication Bypass via Captured Login Responses Allowing Bypass of 429 Too many attempts for Multiple Failed Logins
🔺Severity: High
👽 Reporter: ctrl cipher
💼 Team: WakaTime
💵 Bounty: null
🕐 Submitted: 2025-05-01
⏰ Disclosed: 2025-05-01 19:33:10
📝 Summary: null
@hackeronereports
🔺Severity: High
👽 Reporter: ctrl cipher
💼 Team: WakaTime
💵 Bounty: null
🕐 Submitted: 2025-05-01
⏰ Disclosed: 2025-05-01 19:33:10
📝 Summary: null
@hackeronereports
🎯 New Report #3115705: Stored XSS in File Upload Leads to Privilege Escalation and Full Workspace Takeover
🔺Severity: High
👽 Reporter: sjalu
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-28
⏰ Disclosed: 2025-05-02 12:01:14
📝 Summary: A stored cross-site scripting (XSS) vulnerability was discovered in the Dust platform's file upload functionality. An attacker could upload a malicious HTML file to a conversation. When another user, including an admin, visited the uploaded file, JavaScript was executed in their authenticated browser session. This allowed the attacker to issue authenticated API requests on behalf of the victim, including promoting their own account to admin, downgrading or removing legitimate admins, accessing and deleting secrets, and gaining full control over the workspace.
@hackeronereports
🔺Severity: High
👽 Reporter: sjalu
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-28
⏰ Disclosed: 2025-05-02 12:01:14
📝 Summary: A stored cross-site scripting (XSS) vulnerability was discovered in the Dust platform's file upload functionality. An attacker could upload a malicious HTML file to a conversation. When another user, including an admin, visited the uploaded file, JavaScript was executed in their authenticated browser session. This allowed the attacker to issue authenticated API requests on behalf of the victim, including promoting their own account to admin, downgrading or removing legitimate admins, accessing and deleting secrets, and gaining full control over the workspace.
@hackeronereports
🎯 New Report #3088290: Middleware Authentication Bypass on IBM Portal
🔺Severity: Critical
👽 Reporter: muhammadwaseem3
💼 Team: IBM
💵 Bounty: null
🕐 Submitted: 2025-04-11
⏰ Disclosed: 2025-05-02 14:58:27
📝 Summary: The vulnerability of middleware authentication bypass on the IBM Portal endpoint was reported, analyzed, and remediated. The discovery was reported by an external researcher.
@hackeronereports
🔺Severity: Critical
👽 Reporter: muhammadwaseem3
💼 Team: IBM
💵 Bounty: null
🕐 Submitted: 2025-04-11
⏰ Disclosed: 2025-05-02 14:58:27
📝 Summary: The vulnerability of middleware authentication bypass on the IBM Portal endpoint was reported, analyzed, and remediated. The discovery was reported by an external researcher.
@hackeronereports
🎯 New Report #2265413: Open Redirect on https://api.fastly.com/
🔺Severity: Low
👽 Reporter: hasn0x
💼 Team: Fastly VDP
💵 Bounty: null
🕐 Submitted: 2023-11-27
⏰ Disclosed: 2025-05-02 19:10:10
📝 Summary: The open redirect vulnerability on https://api.fastly.com/ was discovered. The vulnerability allowed user redirection to a malicious website by modifying the "redirect url" parameter. The issue was identified through the steps provided in the report.
@hackeronereports
🔺Severity: Low
👽 Reporter: hasn0x
💼 Team: Fastly VDP
💵 Bounty: null
🕐 Submitted: 2023-11-27
⏰ Disclosed: 2025-05-02 19:10:10
📝 Summary: The open redirect vulnerability on https://api.fastly.com/ was discovered. The vulnerability allowed user redirection to a malicious website by modifying the "redirect url" parameter. The issue was identified through the steps provided in the report.
@hackeronereports
🎯 New Report #3097900: `/names.nsf` and all `/names*` files route to public API on rubygems.org
🔺Severity: None
👽 Reporter: jagat-singh
💼 Team: RubyGems
💵 Bounty: null
🕐 Submitted: 2025-04-16
⏰ Disclosed: 2025-05-03 16:00:09
📝 Summary: null
@hackeronereports
🔺Severity: None
👽 Reporter: jagat-singh
💼 Team: RubyGems
💵 Bounty: null
🕐 Submitted: 2025-04-16
⏰ Disclosed: 2025-05-03 16:00:09
📝 Summary: null
@hackeronereports
🎯 New Report #3125832: HTTP/3 Stream Dependency Cycle Exploit
🔺Severity: High
👽 Reporter: evilginx
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-05-04
⏰ Disclosed: 2025-05-04 15:52:29
📝 Summary: null
@hackeronereports
🔺Severity: High
👽 Reporter: evilginx
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-05-04
⏰ Disclosed: 2025-05-04 15:52:29
📝 Summary: null
@hackeronereports
🎯 New Report #3112106: BAC – Bypass chatbot restrictions via unauthorized mention injection
🔺Severity: Medium
👽 Reporter: yoyomiski
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-25
⏰ Disclosed: 2025-05-06 14:24:05
📝 Summary: The Gemini chatbot was found to have a vulnerability that allowed unauthorized users to bypass permission restrictions and interact with the chatbot. The vulnerability was discovered when a user manually edited the request by changing the "mention" and "configurationId" fields, which allowed them to communicate with the disabled Gemini chatbot despite not having the proper permissions.
@hackeronereports
🔺Severity: Medium
👽 Reporter: yoyomiski
💼 Team: Dust
💵 Bounty: null
🕐 Submitted: 2025-04-25
⏰ Disclosed: 2025-05-06 14:24:05
📝 Summary: The Gemini chatbot was found to have a vulnerability that allowed unauthorized users to bypass permission restrictions and interact with the chatbot. The vulnerability was discovered when a user manually edited the request by changing the "mention" and "configurationId" fields, which allowed them to communicate with the disabled Gemini chatbot despite not having the proper permissions.
@hackeronereports
🎯 New Report #3079966: HTML Injection in LinkedIn Premium Support Chat
🔺Severity: Low
👽 Reporter: nagu123
💼 Team: LinkedIn
💵 Bounty: null
🕐 Submitted: 2025-04-06
⏰ Disclosed: 2025-05-07 07:53:59
📝 Summary: The vulnerability exists in the LinkedIn Premium support chat interface where unsanitized HTML input was rendered directly in the chat window. An attacker could have exploited this by injecting malicious HTML such as clickable links, potentially leading to phishing or redirection attacks on LinkedIn support staff. The observed behavior was that HTML, such as
@hackeronereports
🔺Severity: Low
👽 Reporter: nagu123
💼 Team: LinkedIn
💵 Bounty: null
🕐 Submitted: 2025-04-06
⏰ Disclosed: 2025-05-07 07:53:59
📝 Summary: The vulnerability exists in the LinkedIn Premium support chat interface where unsanitized HTML input was rendered directly in the chat window. An attacker could have exploited this by injecting malicious HTML such as clickable links, potentially leading to phishing or redirection attacks on LinkedIn support staff. The observed behavior was that HTML, such as
<a> tags, was rendered in the chat and appeared clickable to support agents. The expected behavior was that user input in chat should have been sanitized and rendered as plain text without interpreting any HTML or tags.@hackeronereports
🎯 New Report #3060373: Path Traversal Vulnerability found on IBM Cloud
🔺Severity: Critical
👽 Reporter: 0x4bdo
💼 Team: IBM
💵 Bounty: null
🕐 Submitted: 2025-03-26
⏰ Disclosed: 2025-05-07 17:43:20
📝 Summary: The path traversal vulnerability on IBM Cloud was reported by an external researcher, analyzed, and remediated. The vulnerability has been addressed.
@hackeronereports
🔺Severity: Critical
👽 Reporter: 0x4bdo
💼 Team: IBM
💵 Bounty: null
🕐 Submitted: 2025-03-26
⏰ Disclosed: 2025-05-07 17:43:20
📝 Summary: The path traversal vulnerability on IBM Cloud was reported by an external researcher, analyzed, and remediated. The vulnerability has been addressed.
@hackeronereports
🎯 New Report #3080597: Unauthorized Account Access via Leaked Credentials in URL Format (Account Takeover )
🔺Severity: Critical
👽 Reporter: firec4t
💼 Team: Khan Academy
💵 Bounty: null
🕐 Submitted: 2025-04-07
⏰ Disclosed: 2025-05-07 23:08:32
📝 Summary: The vulnerability allowed attackers to access user accounts on khanAcademy.com using leaked credentials that were publicly available. The credentials were found in clear text format on a third-party website. By entering the email and password, the attacker could perform an account takeover without the user's knowledge or any secondary verification.
@hackeronereports
🔺Severity: Critical
👽 Reporter: firec4t
💼 Team: Khan Academy
💵 Bounty: null
🕐 Submitted: 2025-04-07
⏰ Disclosed: 2025-05-07 23:08:32
📝 Summary: The vulnerability allowed attackers to access user accounts on khanAcademy.com using leaked credentials that were publicly available. The credentials were found in clear text format on a third-party website. By entering the email and password, the attacker could perform an account takeover without the user's knowledge or any secondary verification.
@hackeronereports