H1 Disclosed - Public Disclosures

⚡ Fail-Open in set_tlsext_servername_callback on pyopenssl via unhandled exceptions leads to securi... 👨🏻‍💻 uv3doble ➟ Python Cryptographic Authority 🟨 Low 💰 None 🔗 hackerone.com/reports/3558277 #bugbounty #bugbountytips #cybersecurity #infosec

⚡ [Privilege Escalation] User can Pin|Unpin Any Comment on Any Project or Locale 👨🏻‍💻 adilnbabras ➟ Mozilla 🟨 Low 💰 None 🔗 hackerone.com/reports/3025797 #bugbounty #bugbountytips #cybersecurity #infosec

⚡ Exposed .git/config File Leading to Potential Sensitive Information Disclosure 👨🏻‍💻 zoroo2 ➟ curl 🟨 Low 💰 None 🔗 hackerone.com/reports/3612891 #bugbounty #bugbountytips #cybersecurity #infosec

⚡ Add labels to arbitrary issues/prs & compromise github actions label checks 👨🏻‍💻 @ahacker1_h1 ➟ GitHub 🟧 Medium 💰 None 🔗 hackerone.com/reports/3527771 #bugbounty #bugbountytips #cybersecurity #infosec

⚡ PATs without the required scope can leak issues 👨🏻‍💻 s3rdz0 ➟ GitHub 🟧 Medium 💰 None 🔗 hackerone.com/reports/3522254 #bugbounty #bugbountytips #cybersecurity #infosec

Introducing bountymeter.com 🚀 A daily journal + progress tracker for bug bounty hunters. Set your yearly goal, log daily progress, track findings & stay consistent with a live countdown to your target. Build discipline. Track growth. Hunt smarter. 🎯 #bugbountytips

⚡ Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse 👨🏻‍💻 theokeen ➟ HackerOne 🟨 Low 💰 None 🔗 hackerone.com/reports/3378540 #bugbounty #bugbountytips #cybersecurity #infosec

🚨Attention !!🚨 Just dropped XSPulse - a fast Go-based XSS assessment toolkit for bug hunters. It supports reflected XSS, blind XSS callbacks, DOM heuristics, JS library detection, WAF fingerprinting,crawling, fuzzing, & more. github.com/rohsec/xspulse #bugbounty #bugbountytips

⚡ HSTS accepted from HTTP origin behind HTTPS proxy 👨🏻‍💻 lg_oled77c5pua ➟ curl ⬜ None 💰 None 🔗 hackerone.com/reports/3609505 #bugbounty #bugbountytips #cybersecurity #infosec

⚡ Unescaped username in SASL DIGEST-MD5 response allows injection 👨🏻‍💻 am-perip ➟ curl 🟨 Low 💰 None 🔗 hackerone.com/reports/3608522 #bugbounty #bugbountytips #cybersecurity #infosec

⚡ Session Cookie Leakage via Static Header Field in WebViewerFragment 👨🏻‍💻 @dphoeniixx ➟ LinkedIn 🟥 High 💰 None 🔗 hackerone.com/reports/3475626 #bugbounty #bugbountytips #cybersecurity #infosec

⚡ Business Logic Bypass Allows Setting “Read Access” Role Without Pro Plan Subscription 👨🏻‍💻 ziadmomen ➟ Lovable VDP 🟧 Medium 💰 None 🔗 hackerone.com/reports/3591764 #bugbounty #bugbountytips #cybersecurity #infosec

⚡ SMB READ_ANDX DataOffset not validated 👨🏻‍💻 tavro ➟ curl 🟥 High 💰 None 🔗 hackerone.com/reports/3603300 #bugbounty #bugbountytips #cybersecurity #infosec

⚡ Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to informat... 👨🏻‍💻 perxibes ➟ Basecamp 🟨 Low 💰 $100 🔗 hackerone.com/reports/3467641 #bugbounty #bugbountytips #cybersecurity #infosec

⚡ In curl's SASL OAUTHBEARER authentication, including the SOH character (0x01) in the username cor... 👨🏻‍💻 y_security ➟ curl 🟧 Medium 💰 None 🔗 hackerone.com/reports/3584865 #bugbounty #bugbountytips #cybersecurity #infosec

⚡ LM Challenge-Response Hash Always Sent in SMB Authentication 👨🏻‍💻 brewm4ster ➟ curl 🟧 Medium 💰 None 🔗 hackerone.com/reports/3584491 #bugbounty #bugbountytips #cybersecurity #infosec

⚡ Users can change project visibility which requires high subscription by just changing request body 👨🏻‍💻 hossam25 ➟ Lovable VDP 🟧 Medium 💰 None 🔗 hackerone.com/reports/3370430 #bugbounty #bugbountytips #cybersecurity #infosec

⚡ Arbitrary Code Execution via Scanner Bypass in **aws-diagram-mcp-server** `exec()` Namespace 👨🏻‍💻 @locus_x64 ➟ AWS VDP ⬜ None 💰 None 🔗 hackerone.com/reports/3557138 #bugbounty #bugbountytips #cybersecurity #infosec

⚡ CURLOPT_UNRESTRICTED_AUTH Dangerous Default Documentation Gap 👨🏻‍💻 sabari_n ➟ curl 🟨 Low 💰 None 🔗 hackerone.com/reports/3595764 #bugbounty #bugbountytips #cybersecurity #infosec

⚡ Connection Reuse Ignores OAuth Bearer Token Mismatch 👨🏻‍💻 sabari_n ➟ curl 🟧 Medium 💰 None 🔗 hackerone.com/reports/3595753 #bugbounty #bugbountytips #cybersecurity #infosec