PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Top 5 Most Viewed Bugs of 2016

hackerone.com | vulnerability | #bug-bounty | #rce | #hackerone | #disclosure | #vulnerability-reports | #top-5
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne rounds up 2016's most-read public reports: TweetDeck XSS, an Uber RCE via Flask/Jinja2, an AirMax file upload, Wistia DOM XSS and the imgur SSRF that topped the list.
Published
Collected

Related coverage

vulnerability · hackerone.com
Top 5 Most Viewed Reports For Q2 2016
HackerOne's five most-viewed reports of Q2 2016: Uber XSS via Angular template injection ($3K), a Pornhub CMS exposure ($5K), an open SVN repo ($10K), an Imgur file read ($5K) and an Uber OneLogin bypass ($10K).
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
vulnerability · hackerone.com
HackerOne Congratulates the Department of Defense on 11K Vulnerability Reports
Three years after Hack the Pentagon, the US DoD's VDP has logged 11,000 valid vulnerabilities. Director Kris Johnson explains keeping a permanent reporting channel open across all DoD websites.
vulnerability · hackerone.com
Hacktivity Disclosure for Private Programs
HackerOne launched disclosure for private programs, letting reports be shared with fellow participants rather than the whole world. Over 6,000 reports are already disclosed on Hacktivity.
vulnerability · hackerone.com
Top Vulnerability Reports of Third Quarter, 2016
HackerOne's top five vulnerability reports of Q3 2016: an Uber password-reset account takeover ($10K), SQL injection on an Uber .cn domain, an SVG code-execution report, a subdomain takeover, and an XSS in Twitter's SMS service.
Back