🎯 New Report #3160210: Improper Authentication Throttling Allows Attacker-Controlled Account Lockouts
🔺Severity: Medium
👽 Reporter: closec4ll
💼 Team: Lichess
💵 Bounty: null
🕐 Submitted: 2025-05-23
⏰ Disclosed: 2025-06-13 06:25:39
📝 Summary: null
@hackeronereports

🎯 New Report #2105808: DOS of RSKJ server
🔺Severity: High
👽 Reporter: spacewasp
💼 Team: Rootstock Labs
💵 Bounty: 5000
🕐 Submitted: 2023-08-10
⏰ Disclosed: 2025-06-13 14:23:25
📝 Summary: The RSKJ server was vulnerable to a Denial of Service (DoS) attack. The vulnerability was due to a flaw in the RLP (Recursive Length Prefix) decoding function, which could return a negative value, leading to a length of 0. This caused the server to process only one UDP packet forever, preventing it from processing other incoming packets. The vulnerability could cause the server to crash due to Out of Memory issues.
@hackeronereports

🎯 New Report #2412583: Crafted smart contract can take 8 minutes to execute due to bug in modexp precompile.
🔺Severity: High
👽 Reporter: guido
💼 Team: Rootstock Labs
💵 Bounty: null
🕐 Submitted: 2024-03-11
⏰ Disclosed: 2025-06-13 17:02:36
📝 Summary: A bug in the modexp precompile of an Ethereum-based blockchain can cause long stalls in the execution of crafted smart contracts. The issue was reported and could have potentially stalled the network.
@hackeronereports

🎯 New Report #3096384: [20.98.103.245 Cross-Site Scripting (XSS) via /ssl-vpn/getconfig.esp at GlobalProtect VPN Portal](https://hackerone.com/reports/3096384)
🔺Severity: High
👽 Reporter: xbow
💼 Team: Informatica
💵 Bounty: null
🕐 Submitted: 2025-04-16
⏰ Disclosed: 2025-06-13 18:35:09
📝 Summary: A Cross-Site Scripting (XSS) vulnerability was discovered in the GlobalProtect VPN portal's getconfig.esp endpoint. The vulnerability existed because the application reflected user input from the 'user' parameter in an XML response without proper sanitization. An attacker could have injected SVG elements with JavaScript event handlers that executed when the XML document was rendered in a browser.
@hackeronereports

🎯 New Report #2054283: Improper HTTP header block termination in llhttp
🔺Severity: Medium
👽 Reporter: kenballus
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2023-07-07
⏰ Disclosed: 2025-06-13 21:37:06
📝 Summary: The vulnerability in Node.js 20's HTTP parser allowed improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enabled request smuggling. The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.
@hackeronereports

🎯 New Report #3129421: EXIF metadata not stripped from profile image
🔺Severity: Medium
👽 Reporter: growler09
💼 Team: Informatica
💵 Bounty: null
🕐 Submitted: 2025-05-06
⏰ Disclosed: 2025-06-18 09:46:25
📝 Summary: The EXIF metadata was not stripped from the profile images uploaded to the platform. This could have resulted in the disclosure of location or other personal information associated with the uploaded images.
@hackeronereports

🎯 New Report #3211126: Sensitive information disclosure with malicious netrc file
🔺Severity: Medium
👽 Reporter: z2
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-06-19
⏰ Disclosed: 2025-06-22 10:55:55
📝 Summary: null
@hackeronereports

🎯 New Report #3211973: Credential leak on redirect due to improper state clearing when parsing macdef in netrc.c
🔺Severity: Low
👽 Reporter: oxghostly
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-06-20
⏰ Disclosed: 2025-06-22 16:26:30
📝 Summary: null
@hackeronereports

🎯 New Report #3198980: Woocommerce SQL Injection in WC Report Coupon Usage
🔺Severity: Medium
👽 Reporter: q5ca
💼 Team: Automattic
💵 Bounty: null
🕐 Submitted: 2025-06-13
⏰ Disclosed: 2025-06-24 04:18:01
📝 Summary: A SQL injection vulnerability was found in the WooCommerce plugin version 9.9.3. The vulnerable parameter was 'coupon codes' in the '/wp-admin/admin.php?page=wc-reports

🎯 New Report #2209750: Exposed trip no in WebSocket Responses Leading to Excessive information Disclosure
🔺Severity: Medium
👽 Reporter: mrrhacker
💼 Team: Bykea
💵 Bounty: null
🕐 Submitted: 2023-10-15
⏰ Disclosed: 2025-06-26 10:13:41
📝 Summary: The vulnerability in Bykea's WebSocket implementation exposed the trip no identifier to drivers before a bid was accepted. This identifier could be used to access customer tracking URLs, revealing Personally Identifiable Information (PII) such as names, addresses, and contact details. The issue was resolved by masking sensitive identifiers in WebSocket responses and introducing hashing in tracking URLs to prevent unauthorized access.
@hackeronereports

🎯 New Report #2867022: Improper Access Control Allows Trip Hijacking and Passenger/Driver PII Disclosure
🔺Severity: Medium
👽 Reporter: grassye
💼 Team: Bykea
💵 Bounty: null
🕐 Submitted: 2024-11-27
⏰ Disclosed: 2025-06-26 11:35:56
📝 Summary: The vulnerability discovered allowed improper access control, enabling an attacker to hijack trips and disclose passenger and driver personally identifiable information. The /acknowledged the offer and /accept endpoints failed to properly validate the ownership of the trip id, allowing an attacker to substitute a victim's ID and force them into a ride or compel a driver to accept a trip they had cancelled or gone offline from.
@hackeronereports

🎯 New Report #469997: NEX: Stack overflow in UnicodeToUtf8
🔺Severity: None
👽 Reporter: kinnay
💼 Team: Nintendo
💵 Bounty: null
🕐 Submitted: 2018-12-19
⏰ Disclosed: 2025-06-27 05:03:47
📝 Summary: null
@hackeronereports

🎯 New Report #3180396: Failure to strip Proxy-Authorization header on change in origin
🔺Severity: Medium
👽 Reporter: grahamcampbell
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-06-06
⏰ Disclosed: 2025-06-27 09:48:04
📝 Summary: null
@hackeronereports

🎯 New Report #3183957: Arbitrary File Read via Unsanitized curl Usage Results in Sensitive File Exposure
🔺Severity: None
👽 Reporter: ednaq
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-06-09
⏰ Disclosed: 2025-06-27 09:47:49
📝 Summary: null
@hackeronereports

🎯 New Report #2819573: Mutation Based Stored XSS on Trix Editor version latest (2.1.8)
🔺Severity: Critical
👽 Reporter: sudi
💼 Team: Basecamp
💵 Bounty: 6000
🕐 Submitted: 2024-11-04
⏰ Disclosed: 2025-06-27 12:55:01
📝 Summary: A vulnerability was discovered in the Trix Editor version 2.1.8 where a mutation-based stored cross-site scripting (XSS) attack was possible. The vulnerability could be exploited by crafting a malicious payload that, when copied and pasted into the editor, would trigger the execution of arbitrary JavaScript code.
@hackeronereports

🎯 New Report #2921830: Unauthorized Access to Private Video Description via Translation API for Private Accounts
🔺Severity: Low
👽 Reporter: z3phyrus
💼 Team: TikTok
💵 Bounty: null
🕐 Submitted: 2025-01-04
⏰ Disclosed: 2025-06-27 20:24:33
📝 Summary: A vulnerability was discovered in the TikTok translation API endpoint that could have allowed unauthorized access to video descriptions contained in private accounts.
@hackeronereports

🎯 New Report #3153971: Stack Buffer Overflow in curl's OpenSSL Provider Handling
🔺Severity: Medium
👽 Reporter: oblivionsage
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-05-20
⏰ Disclosed: 2025-06-28 12:40:36
📝 Summary: null
@hackeronereports

🎯 New Report #3225565: OS Command Injection in scripts/firefox-db2pem.sh via untrusted certificate nicknames
🔺Severity: High
👽 Reporter: behindtheblackwall
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-06-26
⏰ Disclosed: 2025-06-28 12:19:19
📝 Summary: null
@hackeronereports

🎯 New Report #3125820: HTTP/2 CONTINUATION Flood Vulnerability
🔺Severity: High
👽 Reporter: evilginx1
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-05-04
⏰ Disclosed: 2025-06-28 21:13:12
📝 Summary: null
@hackeronereports

🎯 New Report #3100073: Path Traversal Vulnerability in curl via Unsanitized IPFS PATH Environment Variable
🔺Severity: High
👽 Reporter: ziad616
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-04-18
⏰ Disclosed: 2025-06-28 21:11:42
📝 Summary: null
@hackeronereports

🎯 New Report #3101127: Buffer Overflow in curl MQTT Test Server (tests/server/mqttd.c) via Malicious CONNECT Packet
🔺Severity: Critical
👽 Reporter: deep-hackerone
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-04-19
⏰ Disclosed: 2025-06-28 21:11:25
📝 Summary: null
@hackeronereports