PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Top Vulnerability Reports of Third Quarter, 2016

hackerone.com | vulnerability | #ai-security | #bug-bounty | #xss | #vulnerability-reports | #twitter | #uber | #quarterly
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne's top five vulnerability reports of Q3 2016: an Uber password-reset account takeover ($10K), SQL injection on an Uber .cn domain, an SVG code-execution report, a subdomain takeover, and an XSS in Twitter's SMS service.
Published
Collected

Related coverage

vulnerability · hackerone.com
Top 5 Most Viewed Reports For Q2 2016
HackerOne's five most-viewed reports of Q2 2016: Uber XSS via Angular template injection ($3K), a Pornhub CMS exposure ($5K), an open SVN repo ($10K), an Imgur file read ($5K) and an Uber OneLogin bypass ($10K).
vulnerability · hackerone.com
HackerOne Congratulates the Department of Defense on 11K Vulnerability Reports
Three years after Hack the Pentagon, the US DoD's VDP has logged 11,000 valid vulnerabilities. Director Kris Johnson explains keeping a permanent reporting channel open across all DoD websites.
vulnerability · hackerone.com
Introducing Report Templates
HackerOne introduces configurable Report Templates: security teams can pre-load a Markdown template into the submission form to prompt hackers for the details needed to validate issues.
vulnerability · hackerone.com
Top 5 Most Viewed Bugs of 2016
HackerOne rounds up 2016's most-read public reports: TweetDeck XSS, an Uber RCE via Flask/Jinja2, an AirMax file upload, Wistia DOM XSS and the imgur SSRF that topped the list.
vulnerability · bishopfox.com
Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)
CVE-2026-58113 is a zero-interaction XSS in Siemens Teamcenter’s login redirect that let Bishop Fox silently reassign workflow delegation on a victim’s…
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
Back