🎯 New Report #3378635: Unauthorized Password Reset Allows Account Takeover Across Tenant Boundaries
🔺Severity: High
👽 Reporter: mcdave
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: lemlist
💵 Bounty: null
🕐 Submitted: 2025-10-10
⏰ Disclosed: 2025-11-07 09:33:24
📝 Summary: An authorization issue was discovered in the application that allowed a tenant admin to change the password of another user within the same tenant, including invited agency accounts. The victim had to first accept the invitation before the attacker could proceed. The issue could allow unintended account access within a shared tenant environment, but multi-factor authentication successfully prevented logins when enabled. The issue was reported to the vendor and addressed to ensure stricter access controls for user credential changes.
📂 Report JSON File: 3378635
@hackeronereports

🎯 New Report #3414088: SMTP CRLF Command Injection in CURLOPT MAIL FROM and CURLOPT MAIL RCPT
🔺Severity: Medium
👽 Reporter: bau1u
⭐️ Reputation: 116
🛠 State: duplicate
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-11-06
⏰ Disclosed: 2025-11-10 10:39:03
📝 Summary: null
📂 Report JSON File: 3414088
@hackeronereports

🎯 New Report #3417428: libcurl MQTT `CURLOPT POSTFIELDSIZE LARGE` overflow leads to immediate DoS
🔺Severity: Medium
👽 Reporter: jiyong
⭐️ Reputation: 100
🛠 State: informative
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-11-09
⏰ Disclosed: 2025-11-10 15:00:34
📝 Summary: null
📂 Report JSON File: 3417428
@hackeronereports

🎯 New Report #3079738: Two click Account Takeover
🔺Severity: High
👽 Reporter: fr4via
⭐️ Reputation: 11240
🛠 State: resolved
💼 Team: Basecamp
💵 Bounty: null
🕐 Submitted: 2025-04-06
⏰ Disclosed: 2025-11-11 09:14:15
📝 Summary: A vulnerability was discovered in the HEY Email Android application that allowed for a two-click account takeover. Improper handling of incoming deeplinks led to the application's authorization bearer token being sent to an attacker-controlled server if the user could be tricked into clicking a link and then performing an Undo action.
📂 Report JSON File: 3079738
@hackeronereports

🎯 New Report #3419636: Authentication Token Theft via Open Redirect in Callback URL Parameter
🔺Severity: Critical
👽 Reporter: sle3pyhead
⭐️ Reputation: 96
🛠 State: resolved
💼 Team: lemlist
💵 Bounty: null
🕐 Submitted: 2025-11-11
⏰ Disclosed: 2025-11-14 15:26:16
📝 Summary: A vulnerability was identified in the email signup flow of a website that enabled authentication token theft through manipulation of the callback URL parameter. The vulnerability occurred when an attacker modified the callbackUrl parameter during the email signup process to point to an attacker-controlled domain. When a victim completed the email verification process by clicking the verification link, they were redirected to the malicious domain along with their authentication tokens. The redirection happened automatically as part of the normal signup flow. The vulnerability was caused by insufficient validation of the callback URL parameter and leveraged the trust users place in legitimate verification emails.
📂 Report JSON File: 3419636
@hackeronereports

🎯 New Report #3382796: Responsible disclosure - public S3 bucket exposing JSON/config files
🔺Severity: Low
👽 Reporter: xtawb
⭐️ Reputation: 29
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2025-10-14
⏰ Disclosed: 2025-11-14 19:25:28
📝 Summary: A publicly listable S3 bucket was discovered, exposing various JSON and configuration files. The bucket listing and file metadata were retrievable without authentication.
📂 Report JSON File: 3382796
@hackeronereports

🎯 New Report #3427670: Double-free vulnerability in libcurl with rustls via NoServerCertVerifier condition leads to application crash
🔺Severity: null
👽 Reporter: xkernel
⭐️ Reputation: 100
🛠 State: informative
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-11-16
⏰ Disclosed: 2025-11-16 22:40:20
📝 Summary: null
📂 Report JSON File: 3427670
@hackeronereports

🎯 New Report #3417162: Authentication Bypass in Subscription Management Endpoint
🔺Severity: Critical
👽 Reporter: 0hmz
⭐️ Reputation: 135
🛠 State: resolved
💼 Team: lemlist
💵 Bounty: null
🕐 Submitted: 2025-11-09
⏰ Disclosed: 2025-11-17 13:08:04
📝 Summary: A vulnerability was identified in the subscription management functionality that allowed unauthorized access to customer billing information. The issue stemmed from insufficient authentication and authorization controls on an API endpoint. The vulnerability was classified as an Insecure Direct Object Reference (IDOR) vulnerability, where customer identifiers could be manipulated to access other users' data. The vulnerability has been promptly addressed and fixed by the development team.
📂 Report JSON File: 3417162
@hackeronereports

🎯 New Report #3027461: Bypass of Cloudflare's Cache Keys and WAF via header overflow
🔺Severity: High
👽 Reporter: david96
⭐️ Reputation: 3516
🛠 State: resolved
💼 Team: Cloudflare Public Bug Bounty
💵 Bounty: null
🕐 Submitted: 2025-03-12
⏰ Disclosed: 2025-11-18 08:08:43
📝 Summary: A limitation in the HTTP request header parsing in Front Line (FL) processing enabled attackers to bypass defined rulesets. The maximum amount of headers being parsed by openresty was 100 HTTP headers including internal ones. This problem applied to any ruleset on HTTP headers. Attackers were able to bypass WAF rules and perform cache forcing/poisoning. A global rule was implemented to block when too many headers were provided, which was recommended to be enabled. The length problem of parsed HTTP headers was mitigated with the rollout of the new Front Line implementation.
📂 Report JSON File: 3027461
@hackeronereports

🎯 New Report #3431180: Double free in tool ssls load()
🔺Severity: null
👽 Reporter: xkernel
⭐️ Reputation: 100
🛠 State: informative
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-11-18
⏰ Disclosed: 2025-11-18 23:32:00
📝 Summary: null
📂 Report JSON File: 3431180
@hackeronereports

🎯 New Report #3404968: Stored-XSS in Banner Name field
🔺Severity: Low
👽 Reporter: yoyomiski
⭐️ Reputation: 303
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-30
⏰ Disclosed: 2025-11-19 09:36:35
📝 Summary: null
📂 Report JSON File: 3404968
@hackeronereports

🎯 New Report #3403727: Reflected XSS in /admin/banner-zone.php (v6.0.0 )
🔺Severity: Medium
👽 Reporter: vidang04
⭐️ Reputation: 121
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-29
⏰ Disclosed: 2025-11-19 09:36:08
📝 Summary: null
📂 Report JSON File: 3403727
@hackeronereports

🎯 New Report #3403450: Information Disclosure via Verbose Error Messages
🔺Severity: Medium
👽 Reporter: yoyomiski
⭐️ Reputation: 303
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-29
⏰ Disclosed: 2025-11-19 09:35:34
📝 Summary: null
📂 Report JSON File: 3403450
@hackeronereports

🎯 New Report #3401612: IDOR Vulnerability in Banner Deletion
🔺Severity: High
👽 Reporter: cyberjoker
⭐️ Reputation: 142
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-27
⏰ Disclosed: 2025-11-19 09:35:06
📝 Summary: null
📂 Report JSON File: 3401612
@hackeronereports

🎯 New Report #3401464: Information Disclosure via “Add user” lookup in Account Management (User Access)
🔺Severity: Medium
👽 Reporter: yoyomiski
⭐️ Reputation: 303
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-27
⏰ Disclosed: 2025-11-19 09:34:36
📝 Summary: null
📂 Report JSON File: 3401464
@hackeronereports

🎯 New Report #3400506: Stored XSS in Conversion Statistics via Tracker Name
🔺Severity: High
👽 Reporter: cyberjoker
⭐️ Reputation: 142
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-26
⏰ Disclosed: 2025-11-19 09:33:37
📝 Summary: null
📂 Report JSON File: 3400506
@hackeronereports

🎯 New Report #3399809: Stored XSS on inventory-retrieve.php
🔺Severity: Low
👽 Reporter: lu3ky-13
⭐️ Reputation: 17159
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-25
⏰ Disclosed: 2025-11-19 09:33:09
📝 Summary: A Cross-site Scripting (XSS) vulnerability was discovered on the inventory-retrieve.php and campaign-edit.php pages. The vulnerability allowed an attacker to inject malicious code that would be executed when the page was loaded.
📂 Report JSON File: 3399809
@hackeronereports

🎯 New Report #3399218: Improper sanitisation of input in the settings could cause DoS
🔺Severity: Low
👽 Reporter: lu3ky-13
⭐️ Reputation: 17159
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-25
⏰ Disclosed: 2025-11-19 09:32:50
📝 Summary: A vulnerability was found in the settings functionality of the application where attacker-controlled values in the email fromName and email fromCompany fields were persisted and later rendered to pages without proper output encoding. This could have led to the execution of arbitrary JavaScript in the context of the application, potentially disrupting or replacing the page UI and effectively disabling the site for affected users.
📂 Report JSON File: 3399218
@hackeronereports

🎯 New Report #3399191: Reflected XSS in account-preferences-plugin.php
🔺Severity: Medium
👽 Reporter: lu3ky-13
⭐️ Reputation: 17159
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-25
⏰ Disclosed: 2025-11-19 09:32:33
📝 Summary: A reflected cross-site scripting (XSS) vulnerability was discovered in the account-preferences-plugin.php file of the Revive Adserver 6.0.1 application. Untrusted input from the "group" query parameter was reflected without proper output encoding or context-aware escaping, allowing the injection of malicious JavaScript code into the resulting page.
📂 Report JSON File: 3399191
@hackeronereports

🎯 New Report #3398283: Authorization bypass allows changing email address of other users
🔺Severity: High
👽 Reporter: yoyomiski
⭐️ Reputation: 303
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-24
⏰ Disclosed: 2025-11-19 09:32:13
📝 Summary: The Revive Adserver 6.0.0 was found to have an authorization bypass vulnerability that allowed changing the email address of other users without requiring the account password. The vulnerability was present in the admin panel endpoint /admin/agency-user.php, which accepted a POST request that updated a user's email without re-authentication.
📂 Report JSON File: 3398283
@hackeronereports

🎯 New Report #3413890: Unrestricted setPerPage allows huge result sets / resource exhaustion / mass log retrieval
🔺Severity: Medium
👽 Reporter: vidang04
⭐️ Reputation: 121
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-11-06
⏰ Disclosed: 2025-11-19 13:00:00
📝 Summary: null
📂 Report JSON File: 3413890
@hackeronereports