Read the researcher's report on HackerOne
No analysis of this report yet. What HackerOne publishes about it is below, with the link to the report. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| Confidential data of users and limited metadata of programs and reports accessible via GraphQL | Not clear from the report | Another user's | A GraphQL caller accessed other users' confidential data and restricted program or report metadata. |
| Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameter | No account | Another user's | A public RPC request accessed another user's personal data and mobile API token by supplying their UUID. |
| The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present | No account | Another user's | A public report representation exposed private attributes of its reporter. |
| Customer private program can disclose email any users through invited via username | A user account | Another user's | An invitation creator retrieved another user's email from a pending invitation record. |
| Access to multiple production Grafana dashboards | No account | No object involved | Unauthenticated access exposed production dashboards and their confidential metrics. |
| Open prod Jenkins instance | A user account | No object involved | A broadly available Google login granted access to Jenkins administrative capabilities. |
| An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name | A user account | The attacker's own | A report collaborator flow exposed an invitee's private email before invitation acceptance. |
| gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be read | A user account | Another user's | An authenticated project user caused upload handling to read server-side files, including files outside their own uploads. |
| Employee's GitHub Token Found In Travis CI Build Logs | No account | Another user's | Publicly accessible build logs exposed a token that granted access to private repositories. |
| JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions | A user account | Another user's | A project commenter obtained Runner tokens from a project they could not access. |
| Partial disclosure of report activity through new "Export as .zip" feature | A user account | Another user's | A limited-disclosure report's visibility boundary was crossed to expose hidden comments through export. |
| Github information leaked | No account | No object involved | Internal-services development test data was exposed through a third-party repository. |