🎯 New Report #3384150: Arbitrary File Write
🔺Severity: High
👽 Reporter: newby99
⭐️ Reputation: 178
🛠 State: resolved
💼 Team: arkadiyt-projects
💵 Bounty: null
🕐 Submitted: 2025-10-14
⏰ Disclosed: 2025-10-19 21:19:02
📝 Summary: A path traversal vulnerability was discovered in the protodump tool. The vulnerability allowed for arbitrary file writes outside the intended output directory due to insufficient validation of the go package option extracted from embedded protobuf descriptors. The Filename() function extracted the go package option without sanitization, enabling an attacker to create a malicious binary with a crafted go package value containing path traversal sequences. When the user ran protodump on this binary, the tool wrote the extracted proto file to an arbitrary location on the filesystem.
📂 Report JSON File: 3384150
@hackeronereports

🎯 New Report #3329361: 2FA bypass possible on https://authsvc.singlestore.com
🔺Severity: Medium
👽 Reporter: axolot23
⭐️ Reputation: 113
🛠 State: resolved
💼 Team: SingleStore
💵 Bounty: null
🕐 Submitted: 2025-09-06
⏰ Disclosed: 2025-10-22 06:44:27
📝 Summary: A vulnerability was discovered that allowed the 2FA authentication mechanism to be bypassed completely. An attacker could access the victim's account by only knowing the email address and password, without requiring the 2FA code.
📂 Report JSON File: 3329361
@hackeronereports

🎯 New Report #3091390: Reflected Cross-Site Scripting (XSS) in Revive Adserver 5.5.2
🔺Severity: Medium
👽 Reporter: env bak
⭐️ Reputation: 104
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-04-14
⏰ Disclosed: 2025-10-22 09:54:05
📝 Summary: null
📂 Report JSON File: 3091390
@hackeronereports

🎯 New Report #3393539: Memory leak in Curl auth create ntlm type3 message
🔺Severity: Low
👽 Reporter: tjbecker theori
⭐️ Reputation: 100
🛠 State: informative
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-10-21
⏰ Disclosed: 2025-10-28 14:48:40
📝 Summary: null
📂 Report JSON File: 3393539
@hackeronereports

🎯 New Report #268221: No Confirmation Email For Email Change
🔺Severity: Low
👽 Reporter: craxermgr
⭐️ Reputation: 105
🛠 State: informative
💼 Team: Hiro
💵 Bounty: null
🕐 Submitted: 2017-09-14
⏰ Disclosed: 2025-10-31 17:38:56
📝 Summary: null
📂 Report JSON File: 268221
@hackeronereports

🎯 New Report #268224: Information Disclosure
🔺Severity: Medium
👽 Reporter: craxermgr
⭐️ Reputation: 105
🛠 State: informative
💼 Team: Hiro
💵 Bounty: null
🕐 Submitted: 2017-09-14
⏰ Disclosed: 2025-10-31 17:34:26
📝 Summary: null
📂 Report JSON File: 268224
@hackeronereports

🎯 New Report #300164: REDIRECTION VULNERABILITY/HOST HEADER INJECTION VULNERABILITY
🔺Severity: Medium
👽 Reporter: vyshnav nk
⭐️ Reputation: 50
🛠 State: informative
💼 Team: Hiro
💵 Bounty: null
🕐 Submitted: 2017-12-23
⏰ Disclosed: 2025-10-31 17:33:52
📝 Summary: null
📂 Report JSON File: 300164
@hackeronereports

🎯 New Report #304073: Missing restriction on string size of Full Name at browser.blockstack.org
🔺Severity: null
👽 Reporter: myskar
⭐️ Reputation: 1094
🛠 State: informative
💼 Team: Hiro
💵 Bounty: null
🕐 Submitted: 2018-01-11
⏰ Disclosed: 2025-10-31 17:33:31
📝 Summary: null
📂 Report JSON File: 304073
@hackeronereports

🎯 New Report #377565: Can view all username leaked in https://core.blockstack.org
🔺Severity: null
👽 Reporter: myskar
⭐️ Reputation: 1094
🛠 State: informative
💼 Team: Hiro
💵 Bounty: null
🕐 Submitted: 2018-07-05
⏰ Disclosed: 2025-10-31 17:32:59
📝 Summary: null
📂 Report JSON File: 377565
@hackeronereports

🎯 New Report #716647: Invalidate active sessions after password change
🔺Severity: Low
👽 Reporter: droop3r
⭐️ Reputation: 251
🛠 State: informative
💼 Team: Hiro
💵 Bounty: null
🕐 Submitted: 2019-10-17
⏰ Disclosed: 2025-10-31 17:32:49
📝 Summary: null
📂 Report JSON File: 716647
@hackeronereports

🎯 New Report #910732: blockstack.org - is vulnerable to (CVE-2016-2183, CVE-2016-6329)
🔺Severity: None
👽 Reporter: 0x1 aulia
⭐️ Reputation: 93
🛠 State: informative
💼 Team: Hiro
💵 Bounty: null
🕐 Submitted: 2020-06-29
⏰ Disclosed: 2025-10-31 17:32:21
📝 Summary: null
📂 Report JSON File: 910732
@hackeronereports

🎯 New Report #541760: Blockstack Browser For Mac leaks "Core API Password" to 3rd parties
🔺Severity: Low
👽 Reporter: frozensolid
⭐️ Reputation: 673
🛠 State: informative
💼 Team: Hiro
💵 Bounty: null
🕐 Submitted: 2019-04-18
⏰ Disclosed: 2025-10-31 17:32:08
📝 Summary: null
📂 Report JSON File: 541760
@hackeronereports

🎯 New Report #3062299: Logout Bypass Vulnerability in Hiro.so
🔺Severity: Medium
👽 Reporter: anonymous--1000
⭐️ Reputation: 97
🛠 State: informative
💼 Team: Hiro
💵 Bounty: 150
🕐 Submitted: 2025-03-27
⏰ Disclosed: 2025-10-31 17:31:10
📝 Summary: null
📂 Report JSON File: 3062299
@hackeronereports

🎯 New Report #3243860: Microsoft `x-apikey` Exposed in Mozilla CI Public Logs
🔺Severity: Medium
👽 Reporter: xhacking z
⭐️ Reputation: 358
🛠 State: resolved
💼 Team: Mozilla
💵 Bounty: 200
🕐 Submitted: 2025-07-09
⏰ Disclosed: 2025-11-03 10:34:21
📝 Summary: A Microsoft telemetry API key (x-apikey) was found exposed in publicly accessible Mozilla CI logs. The key appeared in HTTP POST requests sent to Microsoft's telemetry endpoint during automated Firefox testing and was captured via mitmproxy logs. The security impact was considered minimal as the telemetry API key had limited functionality. The report was accepted and a bonus was paid as recognition of the reporter's efforts.
📂 Report JSON File: 3243860
@hackeronereports

🎯 New Report #3371414: Improper Authorization Leads to Editor can toggle admin-only workspace features (Lovable Cloud)
🔺Severity: Low
👽 Reporter: d0maxploit
⭐️ Reputation: 114
🛠 State: resolved
💼 Team: Lovable VDP
💵 Bounty: null
🕐 Submitted: 2025-10-05
⏰ Disclosed: 2025-11-04 20:32:59
📝 Summary: A vulnerability was discovered where an account with the Editor role could call an API endpoint that disabled workspace-wide admin-only features. This was due to a lack of server-side role checks, allowing a vertical privilege escalation.
📂 Report JSON File: 3371414
@hackeronereports

🎯 New Report #3371448: Improper Authorization Leads to Editor can toggle admin-only workspace features (Lovable AI)
🔺Severity: Low
👽 Reporter: d0maxploit
⭐️ Reputation: 114
🛠 State: resolved
💼 Team: Lovable VDP
💵 Bounty: null
🕐 Submitted: 2025-10-05
⏰ Disclosed: 2025-11-04 22:54:23
📝 Summary: The API endpoint /workspaces/<WORKSPACE ID>/tool-preferences/ai gateway/enable did not enforce proper authorization checks. As a result, an account with the Editor role was able to disable the workspace-wide admin-only Lovable AI feature, which powers key AI functionalities across the workspace.
📂 Report JSON File: 3371448
@hackeronereports

🎯 New Report #3355218: CVE-2025-10966: missing SFTP host verification with wolfSSH
🔺Severity: Low
👽 Reporter: giant anteater
⭐️ Reputation: 123
🛠 State: resolved
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-09-23
⏰ Disclosed: 2025-11-05 21:57:54
📝 Summary: null
📂 Report JSON File: 3355218
@hackeronereports

🎯 New Report #3335709: SQL Injection in Django ORM via Unvalidated ` connector` in Q Objects
🔺Severity: Critical
👽 Reporter: cyberstan
⭐️ Reputation: 92
🛠 State: resolved
💼 Team: Django
💵 Bounty: null
🕐 Submitted: 2025-09-12
⏰ Disclosed: 2025-11-06 21:09:42
📝 Summary: A critical SQL injection vulnerability was discovered in the Django ORM's handling of Q objects. The internal WhereNode.as sql method used unsafe string formatting to inject the query connector, which could be controlled by an attacker through the connector key when creating a Q object. This allowed arbitrary SQL to be injected into the WHERE clause, bypassing the ORM's parameterization safeguards.
📂 Report JSON File: 3335709
@hackeronereports

🎯 New Report #3369843: Low-privileged user can enable or disable Lovable AI for new projects in workspace
🔺Severity: Low
👽 Reporter: anxioussick
⭐️ Reputation: 129
🛠 State: resolved
💼 Team: Lovable VDP
💵 Bounty: null
🕐 Submitted: 2025-10-03
⏰ Disclosed: 2025-11-07 03:52:10
📝 Summary: A vulnerability was discovered that allowed low-privileged users to enable or disable Lovable AI for new projects in a workspace. The vulnerability was caused by improper authorization, which enabled low-privileged users to modify the Lovable AI settings by replaying certain API endpoints.
📂 Report JSON File: 3369843
@hackeronereports

🎯 New Report #3378635: Unauthorized Password Reset Allows Account Takeover Across Tenant Boundaries
🔺Severity: High
👽 Reporter: mcdave
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: lemlist
💵 Bounty: null
🕐 Submitted: 2025-10-10
⏰ Disclosed: 2025-11-07 09:33:24
📝 Summary: An authorization issue was discovered in the application that allowed a tenant admin to change the password of another user within the same tenant, including invited agency accounts. The victim had to first accept the invitation before the attacker could proceed. The issue could allow unintended account access within a shared tenant environment, but multi-factor authentication successfully prevented logins when enabled. The issue was reported to the vendor and addressed to ensure stricter access controls for user credential changes.
📂 Report JSON File: 3378635
@hackeronereports

🎯 New Report #3414088: SMTP CRLF Command Injection in CURLOPT MAIL FROM and CURLOPT MAIL RCPT
🔺Severity: Medium
👽 Reporter: bau1u
⭐️ Reputation: 116
🛠 State: duplicate
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-11-06
⏰ Disclosed: 2025-11-10 10:39:03
📝 Summary: null
📂 Report JSON File: 3414088
@hackeronereports