PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Spotlight on the Server-Side

hackerone.com | vulnerability | #cloud | #cloud-security | #hackerone | #ssrf | #vulnerability-trends | #snap | #metadata-service
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

SSRF ranks among HackerOne's top-paid vulnerabilities, with 196 reports in April alone. The article explains how cloud metadata services amplify impact, citing the Snapchat ad platform token leak.
Published
Collected

Related coverage

blog · vercel.com
Mitigating Denial of Wallet risks with Vercel
Protect against Denial of Wallet (DoW) attacks with Vercel. DoW exploits cloud scalability to inflate costs. Vercel provides solutions like budget alerts, spend limits, and anomaly detection to safeguard workloads and maintain financial stability.
blog · vercel.com
Introducing Vercel Firewall and Vercel Secure Compute
Vercel Secure Compute and Vercel Firewall for enhanced protection of your applications on the frontend cloud
vulnerability · hackerone.com
This Season, Give the Gift of Data-Driven Insight
HackerOne holiday data shows vulnerability reports rise in the two weeks after Thanksgiving, with XSS surging as online shopping peaks; XSS draws 27.9% of all bounties paid across industries.
vulnerability · bishopfox.com
The State of Vulnerabilities in 2022
An analysis of publicly disclosed bug bounty reports from January–July 2022, surfacing the most frequent vulnerability types, severity trends, and top payouts, including a $29,000 GitLab file read.
vulnerability · bugcrowd.com
Inside the Platform: Bugcrowd’s Vulnerability Trends Report
Bugcrowd's annual Inside the Platform report analyzes 2023 vulnerability submissions: higher P1 rewards and open scopes drove 10x more critical findings, while government submissions surged 151%.
vulnerability · bugcrowd.com
Priority One Report: Bug Bounties Paying out for Deep Testing
Bugcrowd's 2019 Priority One Report finds vulnerabilities and payouts nearly doubled year over year, with findings shifting toward systemic bug classes that automated scanners cannot catch.
Back