🎯 New Report #1874836: Rails Debug Mode Enabled On ( https://44.208.145.207/testrail/files.md5 )
🔺Severity: Low
👽 Reporter: tarun sec
⭐️ Reputation: 286
🛠 State: resolved
💼 Team: Malwarebytes
💵 Bounty: null
🕐 Submitted: 2023-02-15
⏰ Disclosed: 2025-08-15 14:24:06
📝 Summary: Summary:
A Ruby on Rails web application running in development mode was identified on a Malwarebytes server. This exposed sensitive system information, including details about middleware components and application root paths, which should not have been accessible in a production environment.
📂 Report JSON File: 1874836
@hackeronereports
🔺Severity: Low
👽 Reporter: tarun sec
⭐️ Reputation: 286
🛠 State: resolved
💼 Team: Malwarebytes
💵 Bounty: null
🕐 Submitted: 2023-02-15
⏰ Disclosed: 2025-08-15 14:24:06
📝 Summary: Summary:
A Ruby on Rails web application running in development mode was identified on a Malwarebytes server. This exposed sensitive system information, including details about middleware components and application root paths, which should not have been accessible in a production environment.
📂 Report JSON File: 1874836
@hackeronereports
🎯 New Report #1030042: No SPF/DMARC records on mb-cosmos.com
🔺Severity: Medium
👽 Reporter: assassin marcos
⭐️ Reputation: 3549
🛠 State: resolved
💼 Team: Malwarebytes
💵 Bounty: null
🕐 Submitted: 2020-11-09
⏰ Disclosed: 2025-08-18 13:58:49
📝 Summary: The domain mb-cosmos.com lacked SPF and DMARC records, allowing email spoofing. Emails appeared to originate from the domain without authentication. This vulnerability was reported as a security issue.
📂 Report JSON File: 1030042
@hackeronereports
🔺Severity: Medium
👽 Reporter: assassin marcos
⭐️ Reputation: 3549
🛠 State: resolved
💼 Team: Malwarebytes
💵 Bounty: null
🕐 Submitted: 2020-11-09
⏰ Disclosed: 2025-08-18 13:58:49
📝 Summary: The domain mb-cosmos.com lacked SPF and DMARC records, allowing email spoofing. Emails appeared to originate from the domain without authentication. This vulnerability was reported as a security issue.
📂 Report JSON File: 1030042
@hackeronereports
🌚1
🎯 New Report #2718253: Email verification bypass via request to endpoint "accounts.insightly.com/signup/provisionuser"
🔺Severity: Critical
👽 Reporter: akostak
⭐️ Reputation: 163
🛠 State: resolved
💼 Team: Insightly
💵 Bounty: null
🕐 Submitted: 2024-09-15
⏰ Disclosed: 2025-08-18 19:55:35
📝 Summary: The vulnerability allowed bypassing email verification when creating a new Insightly account. The vulnerability existed in the "EmailAddress" parameter of the member creation endpoint. By modifying the parameter, an attacker could create a new account using any email address, including those of existing users, effectively taking over their accounts.
📂 Report JSON File: 2718253
@hackeronereports
🔺Severity: Critical
👽 Reporter: akostak
⭐️ Reputation: 163
🛠 State: resolved
💼 Team: Insightly
💵 Bounty: null
🕐 Submitted: 2024-09-15
⏰ Disclosed: 2025-08-18 19:55:35
📝 Summary: The vulnerability allowed bypassing email verification when creating a new Insightly account. The vulnerability existed in the "EmailAddress" parameter of the member creation endpoint. By modifying the parameter, an attacker could create a new account using any email address, including those of existing users, effectively taking over their accounts.
📂 Report JSON File: 2718253
@hackeronereports
🔥1
🎯 New Report #3304704: Invalid
🔺Severity: Low
👽 Reporter: pashaaaaaaaa
⭐️ Reputation: 95
🛠 State: informative
💼 Team: WakaTime
💵 Bounty: null
🕐 Submitted: 2025-08-19
⏰ Disclosed: 2025-08-19 23:05:09
📝 Summary: null
📂 Report JSON File: 3304704
@hackeronereports
🔺Severity: Low
👽 Reporter: pashaaaaaaaa
⭐️ Reputation: 95
🛠 State: informative
💼 Team: WakaTime
💵 Bounty: null
🕐 Submitted: 2025-08-19
⏰ Disclosed: 2025-08-19 23:05:09
📝 Summary: null
📂 Report JSON File: 3304704
@hackeronereports
🎯 New Report #3086301: Prompt Injection via GitHub Patch in Brave AI Chat (Leo)
🔺Severity: High
👽 Reporter: stellersjay
⭐️ Reputation: 152
🛠 State: informative
💼 Team: Brave Software
💵 Bounty: null
🕐 Submitted: 2025-04-09
⏰ Disclosed: 2025-08-22 20:33:25
📝 Summary: null
📂 Report JSON File: 3086301
@hackeronereports
🔺Severity: High
👽 Reporter: stellersjay
⭐️ Reputation: 152
🛠 State: informative
💼 Team: Brave Software
💵 Bounty: null
🕐 Submitted: 2025-04-09
⏰ Disclosed: 2025-08-22 20:33:25
📝 Summary: null
📂 Report JSON File: 3086301
@hackeronereports
💩1
🎯 New Report #3008066: Stored XSS in AREA tutorials
🔺Severity: High
👽 Reporter: who am i
⭐️ Reputation: 103
🛠 State: resolved
💼 Team: Autodesk
💵 Bounty: null
🕐 Submitted: 2025-02-23
⏰ Disclosed: 2025-08-25 12:39:06
📝 Summary: A stored cross-site scripting (XSS) vulnerability was discovered in the AREA tutorials feature. The vulnerability could have allowed an attacker to inject malicious JavaScript code when publishing a tutorial. The vulnerability was reported and fixed by Autodesk.
📂 Report JSON File: 3008066
@hackeronereports
🔺Severity: High
👽 Reporter: who am i
⭐️ Reputation: 103
🛠 State: resolved
💼 Team: Autodesk
💵 Bounty: null
🕐 Submitted: 2025-02-23
⏰ Disclosed: 2025-08-25 12:39:06
📝 Summary: A stored cross-site scripting (XSS) vulnerability was discovered in the AREA tutorials feature. The vulnerability could have allowed an attacker to inject malicious JavaScript code when publishing a tutorial. The vulnerability was reported and fixed by Autodesk.
📂 Report JSON File: 3008066
@hackeronereports
🎯 New Report #3287396: AWS | Self Registration Internal LibreChat : Access to internal/proprietary LLMs
🔺Severity: Low
👽 Reporter: notnotnotveg
⭐️ Reputation: 422
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2025-08-05
⏰ Disclosed: 2025-08-25 23:54:59
📝 Summary: null
📂 Report JSON File: 3287396
@hackeronereports
🔺Severity: Low
👽 Reporter: notnotnotveg
⭐️ Reputation: 422
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2025-08-05
⏰ Disclosed: 2025-08-25 23:54:59
📝 Summary: null
📂 Report JSON File: 3287396
@hackeronereports
🎯 New Report #3302484: CWE-195 in ExternalMemoryAccounter::Increase()
🔺Severity: null
👽 Reporter: codingthunder
⭐️ Reputation: 100
🛠 State: informative
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2025-08-18
⏰ Disclosed: 2025-08-26 06:11:30
📝 Summary: null
📂 Report JSON File: 3302484
@hackeronereports
🔺Severity: null
👽 Reporter: codingthunder
⭐️ Reputation: 100
🛠 State: informative
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2025-08-18
⏰ Disclosed: 2025-08-26 06:11:30
📝 Summary: null
📂 Report JSON File: 3302484
@hackeronereports
🎯 New Report #2855610: Staff with Restricted Permissions Could Access Customer Data After Company Removal
🔺Severity: Medium
👽 Reporter: sahill chavda
⭐️ Reputation: 213
🛠 State: resolved
💼 Team: Shopify
💵 Bounty: null
🕐 Submitted: 2024-11-20
⏰ Disclosed: 2025-08-15 02:58:21
📝 Summary: The report describes a vulnerability in Shopify's admin interface where staff members with restricted company permissions could access and update customer information even after the customer had been removed from a specific company. The issue arose when a customer, initially associated with a company and having placed an order, was later removed from that company. Despite the removal, staff with limited permissions could still view and manage the customer's personal information, including updated shipping addresses.
📂 Report JSON File: 2855610
@hackeronereports
🔺Severity: Medium
👽 Reporter: sahill chavda
⭐️ Reputation: 213
🛠 State: resolved
💼 Team: Shopify
💵 Bounty: null
🕐 Submitted: 2024-11-20
⏰ Disclosed: 2025-08-15 02:58:21
📝 Summary: The report describes a vulnerability in Shopify's admin interface where staff members with restricted company permissions could access and update customer information even after the customer had been removed from a specific company. The issue arose when a customer, initially associated with a company and having placed an order, was later removed from that company. Despite the removal, staff with limited permissions could still view and manage the customer's personal information, including updated shipping addresses.
📂 Report JSON File: 2855610
@hackeronereports
🎯 New Report #2130385: Unauthorized Blogs Creation
🔺Severity: Low
👽 Reporter: albetisi
⭐️ Reputation: 570
🛠 State: resolved
💼 Team: Lichess
💵 Bounty: null
🕐 Submitted: 2023-08-31
⏰ Disclosed: 2025-09-02 10:30:26
📝 Summary: A vulnerability was identified on the lichess.org website that allowed unauthorized blog creation. By manipulating certain requests and leveraging the session cookies of a different account, an attacker could bypass account-specific limitations and create a blog post on an account that was not yet eligible to do so.
📂 Report JSON File: 2130385
@hackeronereports
🔺Severity: Low
👽 Reporter: albetisi
⭐️ Reputation: 570
🛠 State: resolved
💼 Team: Lichess
💵 Bounty: null
🕐 Submitted: 2023-08-31
⏰ Disclosed: 2025-09-02 10:30:26
📝 Summary: A vulnerability was identified on the lichess.org website that allowed unauthorized blog creation. By manipulating certain requests and leveraging the session cookies of a different account, an attacker could bypass account-specific limitations and create a blog post on an account that was not yet eligible to do so.
📂 Report JSON File: 2130385
@hackeronereports
🎯 New Report #3185001: Order More Than Maximum Allowed Quantity
🔺Severity: null
👽 Reporter: blackbird azar
⭐️ Reputation: 102
🛠 State: resolved
💼 Team: Mars
💵 Bounty: null
🕐 Submitted: 2025-06-09
⏰ Disclosed: 2025-09-02 15:13:03
📝 Summary: The business logic vulnerability allowed users to bypass the product quantity limits (1-20 items) through parameter manipulation. While the user interface enforced these limits, the necessary server-side validation was missing.
📂 Report JSON File: 3185001
@hackeronereports
🔺Severity: null
👽 Reporter: blackbird azar
⭐️ Reputation: 102
🛠 State: resolved
💼 Team: Mars
💵 Bounty: null
🕐 Submitted: 2025-06-09
⏰ Disclosed: 2025-09-02 15:13:03
📝 Summary: The business logic vulnerability allowed users to bypass the product quantity limits (1-20 items) through parameter manipulation. While the user interface enforced these limits, the necessary server-side validation was missing.
📂 Report JSON File: 3185001
@hackeronereports
🎯 New Report #3228888: Account Takeover in Password Reset Function
🔺Severity: Critical
👽 Reporter: egsec
⭐️ Reputation: 158
🛠 State: resolved
💼 Team: Mars
💵 Bounty: null
🕐 Submitted: 2025-06-28
⏰ Disclosed: 2025-09-02 15:08:31
📝 Summary: A critical authentication bypass vulnerability was present in the password reset functionality of the website. The vulnerability allowed attackers to take over any user account without requiring access to the victim's phone number or one-time password. The security flaw existed in the implementation of the "Forgot Password" feature, where the system relied on client-side responses to determine the success of OTP verification. An attacker could intercept the server response and manipulate it to bypass the OTP verification step entirely, allowing them to set a new password for the victim's account.
📂 Report JSON File: 3228888
@hackeronereports
🔺Severity: Critical
👽 Reporter: egsec
⭐️ Reputation: 158
🛠 State: resolved
💼 Team: Mars
💵 Bounty: null
🕐 Submitted: 2025-06-28
⏰ Disclosed: 2025-09-02 15:08:31
📝 Summary: A critical authentication bypass vulnerability was present in the password reset functionality of the website. The vulnerability allowed attackers to take over any user account without requiring access to the victim's phone number or one-time password. The security flaw existed in the implementation of the "Forgot Password" feature, where the system relied on client-side responses to determine the success of OTP verification. An attacker could intercept the server response and manipulate it to bypass the OTP verification step entirely, allowing them to set a new password for the victim's account.
📂 Report JSON File: 3228888
@hackeronereports
🎯 New Report #1452774: Unauthenticated Sensitive Information Disclosure on █████████ CVE-2021-38314
🔺Severity: Medium
👽 Reporter: kuriyama
⭐️ Reputation: 7514
🛠 State: resolved
💼 Team: Mars
💵 Bounty: null
🕐 Submitted: 2022-01-18
⏰ Disclosed: 2025-09-02 15:43:20
📝 Summary: The Gutenberg Template Library
🔺Severity: Medium
👽 Reporter: kuriyama
⭐️ Reputation: 7514
🛠 State: resolved
💼 Team: Mars
💵 Bounty: null
🕐 Submitted: 2022-01-18
⏰ Disclosed: 2025-09-02 15:43:20
📝 Summary: The Gutenberg Template Library
🎯 New Report #1851895: Bug Report #23JAN136 (subdomain takeover via shopify )
🔺Severity: High
👽 Reporter: kuriyama
⭐️ Reputation: 7514
🛠 State: resolved
💼 Team: Mars
💵 Bounty: null
🕐 Submitted: 2023-01-30
⏰ Disclosed: 2025-09-02 15:30:58
📝 Summary: A subdomain takeover vulnerability was identified on the domain █████████, where the subdomain pointed to an unclaimed Shopify instance. The vulnerability was successfully exploited by the researcher, who created a Shopify account, added the custom domain █████████, and demonstrated control over the subdomain by setting up a password-protected page.
📂 Report JSON File: 1851895
@hackeronereports
🔺Severity: High
👽 Reporter: kuriyama
⭐️ Reputation: 7514
🛠 State: resolved
💼 Team: Mars
💵 Bounty: null
🕐 Submitted: 2023-01-30
⏰ Disclosed: 2025-09-02 15:30:58
📝 Summary: A subdomain takeover vulnerability was identified on the domain █████████, where the subdomain pointed to an unclaimed Shopify instance. The vulnerability was successfully exploited by the researcher, who created a Shopify account, added the custom domain █████████, and demonstrated control over the subdomain by setting up a password-protected page.
📂 Report JSON File: 1851895
@hackeronereports
🎯 New Report #1851886: Bug Report #23JAN135 (subdomain takeover via shopify )
🔺Severity: High
👽 Reporter: kuriyama
⭐️ Reputation: 7514
🛠 State: resolved
💼 Team: Mars
💵 Bounty: null
🕐 Submitted: 2023-01-30
⏰ Disclosed: 2025-09-02 15:23:47
📝 Summary: The researcher discovered a subdomain takeover vulnerability affecting ██████████, which was pointing to an unclaimed Shopify instance. The researcher successfully demonstrated the takeover by claiming the subdomain and setting up a proof-of-concept storefront.
📂 Report JSON File: 1851886
@hackeronereports
🔺Severity: High
👽 Reporter: kuriyama
⭐️ Reputation: 7514
🛠 State: resolved
💼 Team: Mars
💵 Bounty: null
🕐 Submitted: 2023-01-30
⏰ Disclosed: 2025-09-02 15:23:47
📝 Summary: The researcher discovered a subdomain takeover vulnerability affecting ██████████, which was pointing to an unclaimed Shopify instance. The researcher successfully demonstrated the takeover by claiming the subdomain and setting up a proof-of-concept storefront.
📂 Report JSON File: 1851886
@hackeronereports
🎯 New Report #3255473: Business Logic Error – Bypass of OTP Verification During Signup on hover.com
🔺Severity: Medium
👽 Reporter: c0rvuz
⭐️ Reputation: 113
🛠 State: resolved
💼 Team: Tucows (VDP)
💵 Bounty: null
🕐 Submitted: 2025-07-16
⏰ Disclosed: 2025-09-02 18:24:16
📝 Summary: The Business Logic Error – Bypass of OTP Verification During Signup on hover.com was a vulnerability that allowed an attacker to register an account on www.hover.com using any email address without passing the required OTP verification. The vulnerability was caused by the ability to omit the code parameter entirely from the signup request, which resulted in the backend completing the registration and returning a valid session, effectively bypassing the OTP verification mechanism.
📂 Report JSON File: 3255473
@hackeronereports
🔺Severity: Medium
👽 Reporter: c0rvuz
⭐️ Reputation: 113
🛠 State: resolved
💼 Team: Tucows (VDP)
💵 Bounty: null
🕐 Submitted: 2025-07-16
⏰ Disclosed: 2025-09-02 18:24:16
📝 Summary: The Business Logic Error – Bypass of OTP Verification During Signup on hover.com was a vulnerability that allowed an attacker to register an account on www.hover.com using any email address without passing the required OTP verification. The vulnerability was caused by the ability to omit the code parameter entirely from the signup request, which resulted in the backend completing the registration and returning a valid session, effectively bypassing the OTP verification mechanism.
📂 Report JSON File: 3255473
@hackeronereports
🎯 New Report #2189797: RXSS on stores on *█████████/visitorRegistration.pml via destination parameter
🔺Severity: Medium
👽 Reporter: kuriyama
⭐️ Reputation: 7514
🛠 State: resolved
💼 Team: Mars
💵 Bounty: null
🕐 Submitted: 2023-10-02
⏰ Disclosed: 2025-09-02 15:18:10
📝 Summary: The vulnerability involved a reflected XSS in the destination parameter of the visitorRegistration.pml endpoint across all stores under ██████████. A working proof of concept was provided demonstrating JavaScript execution via URL parameter injection.
📂 Report JSON File: 2189797
@hackeronereports
🔺Severity: Medium
👽 Reporter: kuriyama
⭐️ Reputation: 7514
🛠 State: resolved
💼 Team: Mars
💵 Bounty: null
🕐 Submitted: 2023-10-02
⏰ Disclosed: 2025-09-02 15:18:10
📝 Summary: The vulnerability involved a reflected XSS in the destination parameter of the visitorRegistration.pml endpoint across all stores under ██████████. A working proof of concept was provided demonstrating JavaScript execution via URL parameter injection.
📂 Report JSON File: 2189797
@hackeronereports
🎯 New Report #3324190: Heap-buffer-overflow (Out-of-Bounds Read) in DoH hostname encoding
🔺Severity: None
👽 Reporter: reporascal 1
⭐️ Reputation: 131
🛠 State: informative
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-09-02
⏰ Disclosed: 2025-09-04 06:10:43
📝 Summary: null
📂 Report JSON File: 3324190
@hackeronereports
🔺Severity: None
👽 Reporter: reporascal 1
⭐️ Reputation: 131
🛠 State: informative
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-09-02
⏰ Disclosed: 2025-09-04 06:10:43
📝 Summary: null
📂 Report JSON File: 3324190
@hackeronereports
🎯 New Report #3161827: Session Persistence Designed to Keep Users Logged In Across Multiple Devices (Intended Behaviour)
🔺Severity: None
👽 Reporter: naveenventure
⭐️ Reputation: 52
🛠 State: informative
💼 Team: Shopify
💵 Bounty: null
🕐 Submitted: 2025-05-25
⏰ Disclosed: 2025-09-04 20:18:24
📝 Summary: null
📂 Report JSON File: 3161827
@hackeronereports
🔺Severity: None
👽 Reporter: naveenventure
⭐️ Reputation: 52
🛠 State: informative
💼 Team: Shopify
💵 Bounty: null
🕐 Submitted: 2025-05-25
⏰ Disclosed: 2025-09-04 20:18:24
📝 Summary: null
📂 Report JSON File: 3161827
@hackeronereports
🎯 New Report #3294999: CVE-2025-9086: Out of bounds read for cookie path
🔺Severity: Low
👽 Reporter: bigsleep
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-08-11
⏰ Disclosed: 2025-09-10 06:05:13
📝 Summary: null
📂 Report JSON File: 3294999
@hackeronereports
🔺Severity: Low
👽 Reporter: bigsleep
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-08-11
⏰ Disclosed: 2025-09-10 06:05:13
📝 Summary: null
📂 Report JSON File: 3294999
@hackeronereports
🎯 New Report #3330839: CVE-2025-10148: predictable WebSocket mask
🔺Severity: Low
👽 Reporter: cruocco
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-09-08
⏰ Disclosed: 2025-09-10 06:05:01
📝 Summary: null
📂 Report JSON File: 3330839
@hackeronereports
🔺Severity: Low
👽 Reporter: cruocco
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-09-08
⏰ Disclosed: 2025-09-10 06:05:01
📝 Summary: null
📂 Report JSON File: 3330839
@hackeronereports