| 2537 | 13 Nagios Vulnerabilities, #7 will SHOCK you! |
RCE
Local Privilege Escalation
XSS
Security code review |
Nagios |
Samir Ghanem (@sam0x21r) |
Bug Bounty | 2021-05-20 | 2023-06-13 |
| 2416 | Apple Security Bounty: A personal experience |
Permission bypass
iOS |
Apple |
Nicolas Brunner |
Bug Bounty | 2021-07-13 | 2023-06-13 |
| 2340 | Size Matters — CVE-2021–0485 (High) |
Local Privilege Escalation
Android |
Google |
Dimitrios Valsamaras (@Ch0pin) |
Bug Bounty | 2021-08-07 | 2023-06-13 |
| 2234 | Mistuned Part 1: Client-side XSS to Calculator and More |
XSS
Memory corruption
iOS |
Apple |
CodeColorist (@codecolorist) |
Bug Bounty | 2021-09-10 | 2023-06-13 |
| 2194 | Disclosure of three 0-day iOS vulnerabilities and critique of Apple Security Bounty program |
Information disclosure
Local Privilege Escalation
Privacy issue |
Apple |
Denis Tokarev / illusionofchaos |
Bug Bounty | 2021-09-24 | 2023-06-13 |
| 2168 | [EN] Stored XSS in the administrator’s panel due to misuse of MarkupSafe |
Stored XSS |
pass Culture |
Aethlios (@AethliosIK) |
Bug Bounty | 2021-10-06 | 2023-06-13 |
| 2138 | Exploiting Request forgery on Mobile Applications. |
CSRF
Account takeover
Android
iOS |
Pinterest |
Sayed Abdelhafiz (@dPhoeniixx) |
Bug Bounty | 2021-10-19 | 2023-06-13 |
| 2114 | Write Up – XSS Stored In api.media.atlassian.com Via Doc File (iOS) |
Stored XSS |
Atlassian |
Omar Espino (@omespino) |
Bug Bounty | 2021-10-28 | 2023-06-13 |
| 2071 | Keybase App Vulnerability: Incomplete Cleanup of Messages In Keybase for Android/iOS, CVE-2021-34421 |
Information disclosure |
Keybase |
Olivia O’Hara (@oliviaohara) |
Bug Bounty | 2021-11-17 | 2023-06-13 |
| 2069 | Write Up – Apple N/A: PII Information, Full Contact List, Main Phone No. And Main Icloud Email Extracted; Bug Patched: Arbitrary Local File Read Via Zip File And Symlinks On Ios Files App. |
Arbitrary file read |
Apple |
Omar Espino (@omespino) |
Bug Bounty | 2021-11-17 | 2023-06-13 |
| 2027 | Write Up – XSS Stored In files.slack.com Via XML/SVG File (iOS) – $1,000 USD |
XSS |
Slack |
Omar Espino (@omespino) |
Bug Bounty | 2021-12-03 | 2023-06-13 |
| 1897 | How I got access to 25+ Tesla’s around the world. By accident. And curiosity. |
Default credentials |
Tesla |
David Colombo (@david_colombo_) |
Bug Bounty | 2022-01-23 | 2023-06-13 |
| 1859 | Abusing Facebooks `Call To Action` To Launch Internal Deeplinks |
CSRF
Android
iOS |
Meta / Facebook |
Ashley King (@AshleyKingUK) |
Bug Bounty | 2022-02-02 | 2023-06-13 |
| 1714 | Files.app Symbolic Link Following |
iOS |
Apple |
Ron Masas (@RonMasas) |
Bug Bounty | 2022-03-19 | 2023-06-13 |
| 1706 | Story about more than 3.5 million PII leakage in Yahoo!!! |
IDOR
Information disclosure
iOS |
Yahoo! / Verizon Media |
dhakal_bibek (@dhakal__bibek) |
Bug Bounty | 2022-03-22 | 2023-06-13 |
| 1703 | When Equal is Not, Another WebView Takeover Story |
Android |
NA |
Dimitrios Valsamaras (@Ch0pin) |
Bug Bounty | 2022-03-22 | 2023-06-13 |
| 1596 | [EN] Privileged account creation via Mass Assignment towards a full compromise using a Stored XSS |
Stored XSS
Mass assignment
Security code review |
pass Culture |
Aethlios (@AethliosIK) |
Bug Bounty | 2022-04-26 | 2023-06-13 |
| 1512 | Exploiting iOS app for fun and profit |
Account takeover
Information disclosure |
NA |
Bijan Murmu (@0xbijan) |
Bug Bounty | 2022-05-29 | 2023-06-13 |
| 1442 | Exploiting vulnerabilities in iOS Application |
IDOR
Bruteforce
Lack of rate limiting
Account takeover
iOS |
NA |
Raj Singh Chauhan (@raj_singh_ch) |
Bug Bounty | 2022-06-22 | 2023-06-13 |
| 1430 | Bug: Cisco IOS SNMPv3 ACL Issues |
Information disclosure |
Cisco |
Gerry Gosselin (@ggPixelHealth) |
Bug Bounty | 2022-06-26 | 2023-06-13 |
| 1260 | iOS Privacy: Instagram and Facebook can track anything you do on any website in their in-app browser |
Privacy issue |
Meta / Facebook |
Felix Krause (@KrauseFx) |
Bug Bounty | 2022-08-10 | 2023-06-13 |
| 1250 | Identity Confusion in WebView-based Mobile App-in-app Ecosystems |
Android
iOS |
Alipay |
Lei Zhang, Zhibo Zhang, Ancong Liu, Yinzhi Cao, Xiaohan Zhang, Yanjun Chen, Yuan Zhang, Guangliang Yang & Min Yang |
Bug Bounty | 2022-08-11 | 2023-06-13 |
| 1201 | Amazon Quickly Fixed A Vulnerability In Ring Android App That Could Expose Users’ Camera Recordings |
XSS
iOS
Android |
Amazon |
David Sopas (@dsopas) |
Bug Bounty | 2022-08-18 | 2023-06-13 |
| 1197 | VPNs on iOS are a scam |
Privacy issue |
Apple |
Michael Horowitz (@defensivecomput) |
Bug Bounty | 2022-08-20 | 2023-06-13 |
| 1078 | HTTP Desync Attack (Request Smuggling) - Mass Account Takeover at a Cryptocurrency based asset and 121 other websites |
HTTP Request Smuggling
Desync attack |
NA |
Ankit Singh (@AnkitCuriosity) |
Bug Bounty | 2022-09-14 | 2023-06-13 |
