PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

8 High-Impact Bugs and How HackerOne Customers Avoided a Breach: Information Disclosure

hackerone.com | research | #information-disclosure | #owasp | #hackerone | #cwe-200 | #hacktivity | #vulnerability-series
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

This series entry covers information disclosure (CWE 200), third most rewarded on HackerOne, and shows the company dogfooding its own public bounty and disclosure policy to illustrate the risk type.
Published
Collected

Related coverage

vulnerability · hackerone.com
8 High-impact Bugs and How HackerOne Customers Avoided a Breach: SQL Injection
This series entry covers SQL injection, fifth most rewarded on HackerOne, with disclosed Starbucks and US DoD reports showing how verbose errors and XML upload endpoints lead to database compromise.
vulnerability · hackerone.com
8 High-Impact Bugs and How HackerOne Customers Avoided a Breach: Privilege Escalation
This series opener explains privilege escalation—vertical versus horizontal per OWASP—ranked fourth most rewarded on HackerOne, with disclosed reports illustrating its potential business impact.
research · portswigger.net
Finding that one weird endpoint, with Bambdas
Bambdas find one weird endpoint in a 20GB project of website homepages: large redirect bodies, duplicate HTML tags and wrong Content-Length headers flagged real disclosures and source leaks.
research · portswigger.net
Responsible denial of service with web cache poisoning
James Kettle shows how web cache poisoning can take down websites with a single request without collateral damage, earning bounties from Tesla and HackerOne along the way.
research · aretiq.ai
CVE-2026-48827 — Apache MINA SSHD sshd-git Path Traversal Info Disclosure
CVE-2026-48827: path traversal in Apache MINA SSHD's sshd-git module lets authenticated users escape the Git root via ../ to read from or push to arbitrary repositories.
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
Back