Read the researcher's report on HackerOne
No analysis of this report yet. What HackerOne publishes about it is below, with the link to the report. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| DoS on PayPal via web cache poisoning | No account | No object involved | A malformed request caused shared cached JavaScript assets to be replaced with error responses. |
| profile-picture name parameter with large value lead to DoS for other users and programs on the platform | A user account | The attacker's own | Other report participants' page loads were affected when they viewed a report containing the attacker's profile. |
| Denial of service to WP-JSON API by cache poisoning the CORS allow origin header | No account | No object involved | A shared cache served one origin's CORS response to clients from another origin. |
| [Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailable | No account | No object involved | An unauthenticated party invalidated a shared client token, disrupting service for other users. |
| Denial of service via cache poisoning | No account | No object involved | A request with attacker-controlled forwarding headers poisoned shared cache behavior for subsequent visitors. |
| Static files on HackerOne.com can be made inaccessible through Cache Poisoning attack | No account | No object involved | A request-controlled header influenced a shared CDN cache entry served to other visitors. |
| Uploading large payload on domain instructions causes server-side DoS | A user account | The attacker's own | Repeated oversized scope-creation requests exhausted shared server resources, disrupting service for other users. |
| Bypass password reset rate limit protection at moneybird.com/passwords | No account | No object involved | Client-controlled header values bypassed the web application's rate-limit boundary. |
| Node disk DOS by writing to container /etc/hosts | A user account | No object involved | A pod process wrote to host-backed metadata storage, consuming node disk space. |
| Enable 2FA without verifying the email | No account | Another user's | Email ownership verification was bypassed before enabling an account-level login factor. |
| DoS on the Issue page by exploiting Mermaid. | A user account | The attacker's own | A commenter caused resource exhaustion for other users viewing the same issue. |
| url that twitter mobile site can not load | A user account | No object involved | A user-generated URL in a message or tweet disrupted rendering for viewers of that content. |