H1 Disclosed - Public Disclosures (@h1Disclosed)

H1 Disclosed - Public Disclosures reposted

ROHIT @rynosec

Jul 4

⚡ heap-use-after-free in curl_easy_cleanup() called from callback 👨🏻‍💻 carehi1324 ➟ curl ⬜ None 💰 None 🔗 hackerone.com/reports/383357… #bugbounty #bugbountytips #cybersecurity #infosec

3

9

924

H1 Disclosed - Public Disclosures reposted

ROHIT @rynosec

Jul 4

⚡ Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status Line 👨🏻‍💻 saif-01 ➟ Node.js 🟧 Medium 💰 None 🔗 hackerone.com/reports/364868… #bugbounty #bugbountytips #cybersecurity #infosec

3

12

813

H1 Disclosed - Public Disclosures reposted

ROHIT @rynosec

Jul 3

Since X moved to a pay-per-use API model, I'm building a custom workaround to keep @h1disclosed running I was tempted to hand this task to my Hermes agent, but honestly half the fun of these side projects is building them yourself. 🤖 Almost Done !! #bugbounty #cybersecurity

2

1

6

1,767

H1 Disclosed - Public Disclosures reposted

ROHIT @rynosec

Jun 20

Rewav📻: 24 hours of nostalgia. That's it. Listen here: radio.ryno.sh #radio

Abhishek ✨ @ImAbhishek7_

Jun 19

Reason why FM Radio stations are shutting down

1:14

1

3

655

H1 Disclosed - Public Disclosures @h1Disclosed

Jul 3

We are back 🦾 #bugbounty #bugbountytips #cybersecurity

ROHIT @rynosec

Jul 3

Since X moved to a pay-per-use API model, I'm building a custom workaround to keep @h1disclosed running I was tempted to hand this task to my Hermes agent, but honestly half the fun of these side projects is building them yourself. 🤖 Almost Done !! #bugbounty #cybersecurity

2

5

1,694

H1 Disclosed - Public Disclosures @h1Disclosed

May 19

⚡ Connection reuse ignores haproxyprotocol and HAPROXY_CLIENT_IP settings, allowing PROXY context t... 👨🏻‍💻 7omoo ➟ curl ⬜ None 💰 None 🔗 hackerone.com/reports/374113… #bugbounty #bugbountytips #cybersecurity #infosec

1

612

H1 Disclosed - Public Disclosures @h1Disclosed

May 19

⚡ Schannel custom-CA path skips Extended Key Usage enforcement 👨🏻‍💻 giant_anteater ➟ curl ⬜ None 💰 None 🔗 hackerone.com/reports/373499… #bugbounty #bugbountytips #cybersecurity #infosec

3

597

H1 Disclosed - Public Disclosures @h1Disclosed

May 19

⚡ HTTP/3 paused transfer buffers incoming data without bound up to ~1 GiB 👨🏻‍💻 giant_anteater ➟ curl ⬜ None 💰 None 🔗 hackerone.com/reports/373494… #bugbounty #bugbountytips #cybersecurity #infosec

1

449

H1 Disclosed - Public Disclosures @h1Disclosed

May 19

⚡ Cross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized deleg... 👨🏻‍💻 @ahacker1_h1 ➟ GitHub 🟧 Medium 💰 None 🔗 hackerone.com/reports/356025… #bugbounty #bugbountytips #cybersecurity #infosec

19

1,012

H1 Disclosed - Public Disclosures @h1Disclosed

May 18

⚡ HSTS multi-trailing-dot bypass-ish: possible incomplete fix for CVE-2022-30115 👨🏻‍💻 giant_anteater ➟ curl 🟧 Medium 💰 None 🔗 hackerone.com/reports/373398… #bugbounty #bugbountytips #cybersecurity #infosec

1

462

H1 Disclosed - Public Disclosures @h1Disclosed

May 18

⚡ rustls backend silently ignores CURLOPT_CRLFILE when native CA store is active 👨🏻‍💻 giant_anteater ➟ curl ⬜ None 💰 None 🔗 hackerone.com/reports/373493… #bugbounty #bugbountytips #cybersecurity #infosec

2

452

H1 Disclosed - Public Disclosures @h1Disclosed

May 18

⚡ libssh SFTP initialization ignores CURLOPT_TIMEOUT, hangs indefinitely 👨🏻‍💻 giant_anteater ➟ curl ⬜ None 💰 None 🔗 hackerone.com/reports/373508… #bugbounty #bugbountytips #cybersecurity #infosec

2

5

601

H1 Disclosed - Public Disclosures @h1Disclosed

May 18

⚡ cookie: case-insensitive path comparison in replace_existing() allows cookie eviction across dist... 👨🏻‍💻 giant_anteater ➟ curl ⬜ None 💰 None 🔗 hackerone.com/reports/373523… #bugbounty #bugbountytips #cybersecurity #infosec

1

308

H1 Disclosed - Public Disclosures @h1Disclosed

May 18

⚡ CURLOPT_HSTS_CTRL disables shared HSTS without share guard — use-after-free and double-free 👨🏻‍💻 giant_anteater ➟ curl ⬜ None 💰 None 🔗 hackerone.com/reports/373393… #bugbounty #bugbountytips #cybersecurity #infosec

2

313

H1 Disclosed - Public Disclosures @h1Disclosed

May 18

⚡ Unauthenticated File Upload to CDN 👨🏻‍💻 @ph0r3nsic ➟ Enjin 🟧 Medium 💰 None 🔗 hackerone.com/reports/358924… #bugbounty #bugbountytips #cybersecurity #infosec

2

36

2,339

H1 Disclosed - Public Disclosures @h1Disclosed

May 18

⚡ IDOR: autotranslate.translateMessage Full Message Content Leak 👨🏻‍💻 josan_george ➟ Rocket.Chat 🟧 Medium 💰 None 🔗 hackerone.com/reports/371368… #bugbounty #bugbountytips #cybersecurity #infosec

1

19

1,781

H1 Disclosed - Public Disclosures @h1Disclosed

May 17

⚡ NULL pointer dereference in libcurl URL API redirect_url() with CURLU_DEFAULT_SCHEME 👨🏻‍💻 mulan_dh ➟ curl ⬜ None 💰 None 🔗 hackerone.com/reports/373623… #bugbounty #bugbountytips #cybersecurity #infosec

1

440

H1 Disclosed - Public Disclosures @h1Disclosed

May 17

⚡ Trailing-dot IPv4 URL bypasses IP-address guard, allows wildcard DNS SAN match 👨🏻‍💻 giant_anteater ➟ curl ⬜ None 💰 None 🔗 hackerone.com/reports/373492… #bugbounty #bugbountytips #cybersecurity #infosec

2

4

691

H1 Disclosed - Public Disclosures @h1Disclosed

May 15

⚡ SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution 👨🏻‍💻 suul ➟ Nextcloud 🟥 High 💰 None 🔗 hackerone.com/reports/346299… #bugbounty #bugbountytips #cybersecurity #infosec

1

434

H1 Disclosed - Public Disclosures @h1Disclosed

May 14

⚡ Origin IP Exposed waf bypass 👨🏻‍💻 @r00tSid ➟ Yuga Labs 🟨 Low 💰 $250 🔗 hackerone.com/reports/182108… #bugbounty #bugbountytips #cybersecurity #infosec

1

7

570