Read the researcher's report on HackerOne
No analysis of this report yet. What HackerOne publishes about it is below, with the link to the report. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| Bruteforce password recovery code | No account | Another user's | The attacker crossed the account recovery boundary by guessing a code to access the account. |
| Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photos | No account | Another user's | Crawlers could index warning pages that exposed links to other users' posted content. |
| Account creation with invalid email addresses / email is accepting % and %0d%0a line termination chars | No account | The attacker's own | Signup validation accepted malformed values and created persistent account records. |
| Hacker.One Subdomain Takeover | No account | No object involved | A third party took control of the organization’s main website by claiming its abandoned hosting resource. |
| Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP | No account | The attacker's own | A third-party marketing iframe accessed contact-form data submitted on the company site. |
| Access Token Smuggling from my.playstation.com via Referer Header | No account | The attacker's own | A victim's authentication token was disclosed to an attacker-controlled site through the Referer header. |
| Unrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/image | Not clear from the report | No object involved | Unclear; no decisive boundary crossing is described. |
| Email Verification bypass on signup | A user account | Another user's | An authenticated inviter used a redeemable invitation to register an account under another person's email address without mailbox access. |
| Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domain | No account | No object involved | A malicious site could obtain authentication tokens across the site-to-application boundary. |
| Wordpress unzip_file path traversal | A user account | No object involved | Archive extraction wrote an entry outside the designated destination directory. |
| IDOR leading to downloading of any attachment | A user account | Another user's | An attachment download request accessed a file belonging to another user. |
| Subdomain takeover on http://fastly.sc-cdn.net/ | No account | No object involved | An external party claimed an organization subdomain through its dangling CDN configuration. |