Bugpoint

@bugpoint Технологии английский

Latest updates about disclosure bug bounty reports: tech details, impacts, bounties 📣 Rate👇 https://cutt.ly/bugpoint_rate Feedback👇 https://cutt.ly/bugpoint_feedback #️⃣ bug bounty disclosed reports #️⃣ bug bounty write-ups #️⃣ bug bounty teleg

Открыть в Telegram

Подписчики

960

24 часа: 0
7 дней: –
30 дней: –

Средний охват поста

Просмотры поста через 24 часа

Вовлечённость

3,6 %

Охват ÷ подписчики (ERR)

Постов в день

5,2

В среднем за 30 дней

Упоминания

Другими каналами за 90 дней

Реакции на просмотры (ER)

0,07 %

Реакции ÷ просмотры, 30 дней

В среднем на пост

Реакции: 0
Репосты: –
Комментарии: –

Индекс цитирования

–

Другие каналы не цитировали его за 30 дней

Рекламные посты

0 %

0 из 40 постов за 30 дней помечены как реклама

Динамика подписчиков

Подписчиков у канала «Bugpoint»: 960. Средний охват поста за сутки около 35, вовлечённость 3,6 %.

По дням, последние 30 дней

Дата	Подписчики	Изменение	Посты	Ср. просмотры поста
12 ноя	960	0	6	13
11 ноя	960	−1	11	23
10 ноя	961	0	2	46
9 ноя	961	−5	1	54
20 окт	966	–	0	–

Просмотры по возрасту поста

Средние просмотры в каждом возрасте, посты за последние 30 дней.

1 ч: 3
6 ч: 18
12 ч: 21
24 ч: 35
48 ч: 48
3 дня: 49
7 дней: 44

Когда публикует

Время по UTC. 40 постов за 90 дней.

пн вт ср чт пт сб вс 0 6 12 18

Последние посты

12 ноя 2026, 08:26 Открыть пост

DOM-based XSS in playground.wordpress.net (/scope:*/wp-includes/empty.html) lets any attacker run JavaScript on the origin via a single crafted link 🔹 Severity: Low 🔹 Weakness: Cross-site Scripting (XSS) - DOM 🔹 Reported To: WordPress 🔹 Reported By: ariverapoblet 🔹 State: 🟢 Resolved 🔹 Disclosed: November 11, 2026, 8:13pm (UTC) 🐞 Source: HackerOne A DOM-based cross-site scripting vulnerability was discovered in a WordPress playground environment. The vulnerability was located in the service worker code that intercepted requests to a specific file path. The vulnerable code retrieved an attacker-controlled URL fragment and passed it through URL decoding before writing it directly into...

14 просмотров Фото
12 ноя 2026, 01:05 Открыть пост

Stored XSS in the Classic block element path 🔹 Severity: None 🔹 Weakness: Cross-site Scripting (XSS) - Stored 🔹 Reported To: WordPress 🔹 Reported By: pinkdraconian 🔹 State: 🟢 Resolved 🔹 Disclosed: November 11, 2026, 12:42pm (UTC) 🐞 Source: HackerOne A stored cross-site scripting vulnerability was identified in a WordPress development build affecting the Classic block element path. An author could save an image with an entity-encoded HTML payload in a data attribute. When an administrator edited the post in the Classic block and selected the image, the payload was decoded and inserted into the element-path user interface as HTML, resulting in script execution… 👉 Read full report

18 просмотров Фото
12 ноя 2026, 01:05 Открыть пост

CSRF in tracker invocation page 🔹 Severity: Medium 🔹 Weakness: Cross-Site Request Forgery (CSRF) 🔹 Reported To: Revive Adserver 🔹 Reported By: abhi_hackz 🔹 State: 🟢 Resolved 🔹 Disclosed: November 11, 2026, 10:49am (UTC) 🐞 Source: HackerOne 👉 Read full report

12 просмотров Фото
12 ноя 2026, 01:05 Открыть пост

Cross-agency delivery rule set creation 🔹 Severity: Medium 🔹 Weakness: Insecure Direct Object Reference (IDOR) 🔹 Reported To: Revive Adserver 🔹 Reported By: vidang04 🔹 State: 🟢 Resolved 🔹 Disclosed: November 11, 2026, 10:49am (UTC) 🐞 Source: HackerOne 👉 Read full report

10 просмотров Фото
12 ноя 2026, 01:05 Открыть пост

Cross-agency disclosure in website listing 🔹 Severity: Medium 🔹 Weakness: Insecure Direct Object Reference (IDOR) 🔹 Reported To: Revive Adserver 🔹 Reported By: shmulc8 🔹 State: 🟢 Resolved 🔹 Disclosed: November 11, 2026, 10:48am (UTC) 🐞 Source: HackerOne 👉 Read full report

12 просмотров Фото
12 ноя 2026, 01:05 Открыть пост

Reflected XSS via invocation banner ID field in admin-generate.php 🔹 Severity: Medium 🔹 Weakness: Cross-site Scripting (XSS) - Reflected 🔹 Reported To: Revive Adserver 🔹 Reported By: blasterx24 🔹 State: 🟢 Resolved 🔹 Disclosed: November 11, 2026, 10:48am (UTC) 🐞 Source: HackerOne 👉 Read full report

13 просмотров Фото
11 ноя 2026, 18:46 Открыть пост

Formula injection in conversion tracking report export 🔹 Severity: Medium 🔹 Weakness: Code Injection 🔹 Reported To: Revive Adserver 🔹 Reported By: baptoutatis 🔹 State: 🟢 Resolved 🔹 Disclosed: November 11, 2026, 10:48am (UTC) 🐞 Source: HackerOne 👉 Read full report

21 просмотров Фото
11 ноя 2026, 18:46 Открыть пост

Stored XSS via unescaped tracker name in append-code check 🔹 Severity: Medium 🔹 Weakness: Cross-site Scripting (XSS) - Stored 🔹 Reported To: Revive Adserver 🔹 Reported By: flasks 🔹 State: 🟢 Resolved 🔹 Disclosed: November 11, 2026, 10:48am (UTC) 🐞 Source: HackerOne 👉 Read full report

20 просмотров Фото
11 ноя 2026, 18:46 Открыть пост

Reflected XSS via wrong permission check in conversion statistics 🔹 Severity: Medium 🔹 Weakness: Cross-site Scripting (XSS) - Reflected 🔹 Reported To: Revive Adserver 🔹 Reported By: 7yr 🔹 State: 🟢 Resolved 🔹 Disclosed: November 11, 2026, 10:47am (UTC) 🐞 Source: HackerOne 👉 Read full report

17 просмотров Фото
11 ноя 2026, 18:46 Открыть пост

Reflected XSS in popup invocation options 🔹 Severity: Medium 🔹 Weakness: Cross-site Scripting (XSS) - Reflected 🔹 Reported To: Revive Adserver 🔹 Reported By: miauuu 🔹 State: 🟢 Resolved 🔹 Disclosed: November 11, 2026, 10:46am (UTC) 🐞 Source: HackerOne A reflected cross-site scripting vulnerability was found in popup invocation options. Request parameters for top, left, timeout, and delay were included in HTML attributes without proper encoding. Popup option values were subsequently HTML-encoded when included in invocation-option form fields to resolve the issue. 👉 Read full report

15 просмотров Фото

8 ноя 2026, 23:13 Открыть пост

Broken Access Control on **healthwatch.trellix.com** Leading to Unauthorized Access and Sensitive Data Exposure 🔹 Severity: Medium 🔹 Weakness: Improper Access Control - Generic 🔹 Reported To: Trellix 🔹 Reported By: t4f3 🔹 State: 🟢 Resolved 🔹 Disclosed: November 8, 2026, 10:22pm (UTC) 🐞 Source: HackerOne A broken access control vulnerability was discovered on a health monitoring platform. The vulnerability consisted of three chained security flaws: insufficient email domain validation during account registration allowed attackers to register accounts with external email addresses, a password reset mechanism could be exploited to activate accounts pending administrator approval, and...

59 просмотров Фото
5 ноя 2026, 22:56 Открыть пост

Unauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference Fields 🔹 Severity: High 🔹 Weakness: Information Disclosure 🔹 Reported To: WordPress 🔹 Reported By: 0x200notfound 🔹 State: 🟢 Resolved 🔹 Disclosed: November 5, 2026, 7:56pm (UTC) 🐞 Source: HackerOne A vulnerability was discovered in a WordPress plugin's reference field functionality that allowed unauthenticated users to access non-public post content through a permission bypass. The issue existed in the post retrieval function, which did not enforce read permission checks when retrieving posts with any status, including private, draft, and password-protec...

57 просмотров Фото
7 ноя 2026, 08:57 Открыть пост

Billion laughs entity expansion in Qt .ts discovery: a crafted ~950 KB file forces ~55 MB of XML expansion per parse, cost scales with crafted file c 🔹 Severity: Medium 🔹 Weakness: XML Entity Expansion 🔹 Reported To: Weblate 🔹 Reported By: sumit-sabhaya 🔹 State: 🟢 Resolved 🔹 Disclosed: November 7, 2026, 7:46am (UTC) 🐞 Source: HackerOne An XML entity expansion vulnerability was discovered in the Qt translation discovery backend of a software component. The vulnerability existed in a function that parsed Qt .ts files using default entity processing without proper restrictions. An attacker could craft malicious .ts files with internal entity declarations that, while staying within the...

56 просмотров Фото
7 ноя 2026, 22:53 Открыть пост

curl 8.23.0 keeps sending requests to an HTTP/3 backend after Alt-Svc: clear 🔹 Severity: High 🔹 Weakness: Improper Access Control - Generic 🔹 Reported To: curl 🔹 Reported By: arizonya 🔹 State: ⚪️ Informative 🔹 Disclosed: November 7, 2026, 10:37pm (UTC) 🐞 Source: HackerOne 👉 Read full report

54 просмотров Фото
9 ноя 2026, 20:53 Открыть пост

SQL Injection via Unsanitized Identifiers and String Literals in `@aws-cdk/aws-redshift-alpha` Custom Resource Handlers 🔹 Severity: High 🔹 Weakness: SQL Injection 🔹 Reported To: AWS VDP 🔹 Reported By: suul 🔹 State: 🟢 Resolved 🔹 Disclosed: November 9, 2026, 6:53pm (UTC) 🐞 Source: HackerOne A SQL injection vulnerability was discovered in custom resource handlers within the AWS CDK Redshift Alpha module. The vulnerability resulted from unsanitized identifiers and string literals in SQL queries, which allowed malicious input to be executed as SQL commands. The issue was remediated following responsible disclosure coordination. 👉 Read full report

54 просмотров Фото
5 ноя 2026, 17:48 Открыть пост

WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responses 🔹 Severity: Medium 🔹 Weakness: Improper Access Control - Generic 🔹 Reported To: WordPress 🔹 Reported By: 0xbs0d27 🔹 State: 🟢 Resolved 🔹 Disclosed: November 5, 2026, 2:18pm (UTC) 🐞 Source: HackerOne A password protection bypass was identified in a REST API wrapper for recurring events. The wrapper endpoint exposed RSVP attendee roster data without verifying password authentication, while the core API correctly enforced password gates. Unauthenticated requests could retrieve attendee names, user IDs, profile information, and comment details for password-protected events. T...

53 просмотров Фото
6 ноя 2026, 10:11 Открыть пост

Blind SSRF in `/api/img` on blua.bupa.com.au — internal host discovery & port scanning of `*.internal.bupa.com.au` 🔹 Severity: Medium 🔹 Reported To: Bupa Australia Vulnerability Disclosure Engagement 🔹 Reported By: x3c 🔹 State: 🟢 Resolved 🔹 Disclosed: November 6, 2026 🐞 Source: Bugcrowd 👉 Read full report

52 просмотров Фото
10 ноя 2026, 10:48 Открыть пост

Mass PII Exposure: 120,000+ Consumer Email Addresses Leaked via Author Enumeration on ████████ 🔹 Severity: Critical 🔹 Weakness: Information Disclosure 🔹 Reported To: Essity 🔹 Reported By: matty69v 🔹 State: 🟢 Resolved 🔹 Disclosed: November 10, 2026, 7:41am (UTC) 🐞 Source: HackerOne A WordPress loyalty program was found to expose approximately 121,000 consumer email addresses through user enumeration. The email addresses were configured as display names and became publicly visible through author archive pages, REST API endpoints, and RSS feeds. The affected pages were not protected by noindex directives or robots.txt restrictions, making them indexable by search engines. Sequential u...

51 просмотров Фото
8 ноя 2026, 19:47 Открыть пост

Open Email Relay on WordPress Gutenberg Plugin via formAction parameter leads to phishing and spam campaigns 🔹 Severity: No Rating 🔹 Reported To: WordPress 🔹 Reported By: zadwon 🔹 State: 🟢 Resolved 🔹 Disclosed: November 8, 2026, 6:15pm (UTC) 🐞 Source: HackerOne A vulnerability was discovered in the WordPress Gutenberg plugin version 22.2.0 that exposed an unauthenticated AJAX endpoint. The experimental Form block allowed arbitrary attackers to relay emails through the WordPress site to any recipient without authentication. The vulnerability existed because the form handler was registered for both authenticated and unauthenticated requests, and the handler trusted… 👉 Read full repo...

49 просмотров Фото
5 ноя 2026, 02:55 Открыть пост

Connector/C TLS auth-switch bypass exposes plaintext password on hostname verification failure 🔹 Severity: No Rating 🔹 Weakness: Improper Certificate Validation 🔹 Reported To: MariaDB 🔹 Reported By: mschorm 🔹 State: 🟢 Resolved 🔹 Disclosed: November 4, 2026, 5:31pm (UTC) 🐞 Source: HackerOne A logic flaw was identified in the TLS authentication verification of a database connector library. The auth-switch guard used an insufficient bitwise check that allowed hostname verification failures to bypass security controls. When a server requested a non-hashing authentication plugin after initial connection, clients with hostname verification enabled could be forced to send their database p...

49 просмотров Фото

Вопросы о канале «Bugpoint»

Сколько подписчиков у канала «Bugpoint»?

У канала «Bugpoint» (@bugpoint) 960 подписчиков на 12 ноября 2026 г.

Сколько человек видят пост в канале «Bugpoint»?

Средний пост набирает около 35 просмотров за 24 часа, это примерно 4 % подписчиков (ERR).

О чём канал «Bugpoint»?

Канал в категории «Технологии», язык постов: английский. Описание канала: «Latest updates about disclosure bug bounty reports: tech details, impacts, bounties 📣 Rate👇 https://cutt.ly/bugpoint_rate Feedback👇 https://cutt.ly/bugpoint_feedback #️⃣ bug bounty disclosed report...»

Какое место занимает канал «Bugpoint»?

По числу подписчиков: №221 в категории «Технологии», №4 009 среди международных каналов, №7 989 среди каналов на языке «английский», №9 002 в мире.

Публикует ли канал «Bugpoint» рекламу?

За последние 30 дней ни один из 40 постов не помечен как реклама (#ad, Sponsored, «Реклама»). Рекламу без пометки определить нельзя.

Статистика обновлена 56 минут назад.