2023年hackerone报告整理

https://hackerone.com/reports/2007235 insecure storage of information, you can view any file uploaded to the server without authentication and only with a single link

https://hackerone.com/reports/2010530 yelp.com XSS ATO (via login keylogger, link Google account)

https://hackerone.com/reports/1540907 [WiiU/Switch] nullptr dereference in the ENL framework

https://hackerone.com/reports/1848730 Cross-origin resource sharing: arbitrary origin trusted

https://hackerone.com/reports/2012519 CRLF to XSS & Open Redirection

https://hackerone.com/reports/1947924 Insecure Direct Object Reference allows Crew Invite deletion

https://hackerone.com/reports/2035332 RXSS at image.hackerone.live via the `url` parameter

https://hackerone.com/reports/1688309 [MK8DX] Improper metadata parsing

https://hackerone.com/reports/1864188 SSRF in graphQL query (pwapi.ex2b.com)

https://hackerone.com/reports/2018615 HTML injection on newsroom.snap.com/* via search?q=1

https://hackerone.com/reports/2010530 yelp.com XSS ATO (via login keylogger, link Google account)0

https://hackerone.com/reports/2010530 yelp.com XSS ATO (via login keylogger, link Google account)1

https://hackerone.com/reports/2010530 yelp.com XSS ATO (via login keylogger, link Google account)2

https://hackerone.com/reports/2010530 yelp.com XSS ATO (via login keylogger, link Google account)3

https://hackerone.com/reports/2010530 yelp.com XSS ATO (via login keylogger, link Google account)4

https://hackerone.com/reports/2010530 yelp.com XSS ATO (via login keylogger, link Google account)5

https://hackerone.com/reports/2010530 yelp.com XSS ATO (via login keylogger, link Google account)6

https://hackerone.com/reports/2010530 yelp.com XSS ATO (via login keylogger, link Google account)7

https://hackerone.com/reports/2010530 yelp.com XSS ATO (via login keylogger, link Google account)8

https://hackerone.com/reports/2010530 yelp.com XSS ATO (via login keylogger, link Google account)9

https://hackerone.com/reports/1540907 [WiiU/Switch] nullptr dereference in the ENL framework0

https://hackerone.com/reports/1540907 [WiiU/Switch] nullptr dereference in the ENL framework1

https://hackerone.com/reports/1540907 [WiiU/Switch] nullptr dereference in the ENL framework2

https://hackerone.com/reports/1540907 [WiiU/Switch] nullptr dereference in the ENL framework3

https://hackerone.com/reports/1540907 [WiiU/Switch] nullptr dereference in the ENL framework4

https://hackerone.com/reports/1540907 [WiiU/Switch] nullptr dereference in the ENL framework5

https://hackerone.com/reports/1540907 [WiiU/Switch] nullptr dereference in the ENL framework6

https://hackerone.com/reports/1540907 [WiiU/Switch] nullptr dereference in the ENL framework7

https://hackerone.com/reports/1540907 [WiiU/Switch] nullptr dereference in the ENL framework8

https://hackerone.com/reports/1540907 [WiiU/Switch] nullptr dereference in the ENL framework9

https://hackerone.com/reports/1848730 Cross-origin resource sharing: arbitrary origin trusted0

https://hackerone.com/reports/1848730 Cross-origin resource sharing: arbitrary origin trusted1

https://hackerone.com/reports/1848730 Cross-origin resource sharing: arbitrary origin trusted2

https://hackerone.com/reports/1848730 Cross-origin resource sharing: arbitrary origin trusted3

https://hackerone.com/reports/1848730 Cross-origin resource sharing: arbitrary origin trusted4

https://hackerone.com/reports/1848730 Cross-origin resource sharing: arbitrary origin trusted5

https://hackerone.com/reports/1848730 Cross-origin resource sharing: arbitrary origin trusted6

https://hackerone.com/reports/1848730 Cross-origin resource sharing: arbitrary origin trusted7

https://hackerone.com/reports/1848730 Cross-origin resource sharing: arbitrary origin trusted8

https://hackerone.com/reports/1848730 Cross-origin resource sharing: arbitrary origin trusted9

https://hackerone.com/reports/2012519 CRLF to XSS & Open Redirection0

https://hackerone.com/reports/2012519 CRLF to XSS & Open Redirection1

https://hackerone.com/reports/2012519 CRLF to XSS & Open Redirection2

https://hackerone.com/reports/2012519 CRLF to XSS & Open Redirection3

https://hackerone.com/reports/2012519 CRLF to XSS & Open Redirection4

https://hackerone.com/reports/2012519 CRLF to XSS & Open Redirection5

https://hackerone.com/reports/2012519 CRLF to XSS & Open Redirection6

https://hackerone.com/reports/2012519 CRLF to XSS & Open Redirection7

https://hackerone.com/reports/2012519 CRLF to XSS & Open Redirection8

https://hackerone.com/reports/2012519 CRLF to XSS & Open Redirection9

https://hackerone.com/reports/1947924 Insecure Direct Object Reference allows Crew Invite deletion0

https://hackerone.com/reports/1947924 Insecure Direct Object Reference allows Crew Invite deletion1

https://hackerone.com/reports/1947924 Insecure Direct Object Reference allows Crew Invite deletion2

https://hackerone.com/reports/1947924 Insecure Direct Object Reference allows Crew Invite deletion3

https://hackerone.com/reports/1947924 Insecure Direct Object Reference allows Crew Invite deletion4

https://hackerone.com/reports/1947924 Insecure Direct Object Reference allows Crew Invite deletion5

https://hackerone.com/reports/1947924 Insecure Direct Object Reference allows Crew Invite deletion6

https://hackerone.com/reports/1947924 Insecure Direct Object Reference allows Crew Invite deletion7

https://hackerone.com/reports/1947924 Insecure Direct Object Reference allows Crew Invite deletion8

https://hackerone.com/reports/1947924 Insecure Direct Object Reference allows Crew Invite deletion9

https://hackerone.com/reports/2035332 RXSS at image.hackerone.live via the `url` parameter0

https://hackerone.com/reports/2035332 RXSS at image.hackerone.live via the `url` parameter1

https://hackerone.com/reports/2035332 RXSS at image.hackerone.live via the `url` parameter2

https://hackerone.com/reports/2035332 RXSS at image.hackerone.live via the `url` parameter3

https://hackerone.com/reports/2035332 RXSS at image.hackerone.live via the `url` parameter4

https://hackerone.com/reports/2035332 RXSS at image.hackerone.live via the `url` parameter5

https://hackerone.com/reports/2035332 RXSS at image.hackerone.live via the `url` parameter6

https://hackerone.com/reports/2035332 RXSS at image.hackerone.live via the `url` parameter7

https://hackerone.com/reports/2035332 RXSS at image.hackerone.live via the `url` parameter8

https://hackerone.com/reports/2035332 RXSS at image.hackerone.live via the `url` parameter9

https://hackerone.com/reports/1688309 [MK8DX] Improper metadata parsing0

https://hackerone.com/reports/1688309 [MK8DX] Improper metadata parsing1

https://hackerone.com/reports/1688309 [MK8DX] Improper metadata parsing2

https://hackerone.com/reports/1688309 [MK8DX] Improper metadata parsing3

https://hackerone.com/reports/1688309 [MK8DX] Improper metadata parsing4

https://hackerone.com/reports/1688309 [MK8DX] Improper metadata parsing5

https://hackerone.com/reports/1688309 [MK8DX] Improper metadata parsing6

https://hackerone.com/reports/1688309 [MK8DX] Improper metadata parsing7

https://hackerone.com/reports/1688309 [MK8DX] Improper metadata parsing8

https://hackerone.com/reports/1688309 [MK8DX] Improper metadata parsing9

https://hackerone.com/reports/1864188 SSRF in graphQL query (pwapi.ex2b.com)0

https://hackerone.com/reports/1864188 SSRF in graphQL query (pwapi.ex2b.com)1

https://hackerone.com/reports/1864188 SSRF in graphQL query (pwapi.ex2b.com)2

https://hackerone.com/reports/1864188 SSRF in graphQL query (pwapi.ex2b.com)3

https://hackerone.com/reports/1864188 SSRF in graphQL query (pwapi.ex2b.com)4

https://hackerone.com/reports/1864188 SSRF in graphQL query (pwapi.ex2b.com)5

https://hackerone.com/reports/1864188 SSRF in graphQL query (pwapi.ex2b.com)6

https://hackerone.com/reports/1864188 SSRF in graphQL query (pwapi.ex2b.com)7

https://hackerone.com/reports/1864188 SSRF in graphQL query (pwapi.ex2b.com)8

https://hackerone.com/reports/1864188 SSRF in graphQL query (pwapi.ex2b.com)9

https://hackerone.com/reports/2018615 HTML injection on newsroom.snap.com/* via search?q=10

https://hackerone.com/reports/2018615 HTML injection on newsroom.snap.com/* via search?q=11

https://hackerone.com/reports/2018615 HTML injection on newsroom.snap.com/* via search?q=12

https://hackerone.com/reports/2018615 HTML injection on newsroom.snap.com/* via search?q=13

https://hackerone.com/reports/2018615 HTML injection on newsroom.snap.com/* via search?q=14

https://hackerone.com/reports/2018615 HTML injection on newsroom.snap.com/* via search?q=15

https://hackerone.com/reports/2018615 HTML injection on newsroom.snap.com/* via search?q=16

https://hackerone.com/reports/2018615 HTML injection on newsroom.snap.com/* via search?q=17

https://hackerone.com/reports/2018615 HTML injection on newsroom.snap.com/* via search?q=18

https://hackerone.com/reports/2018615 HTML injection on newsroom.snap.com/* via search?q=19

https://hackerone.com/reports/2010530 yelp.com XSS ATO (via login keylogger, link Google account)00

https://hackerone.com/reports/2010530 yelp.com XSS ATO (via login keylogger, link Google account)01