本页有简体中文版。
切换到简体中文本頁有繁體中文版。
切換到繁體中文Bug Bounty Channel@bug_bounty_channel
Open@bug_bounty_channel
Bug Bounty Channel (@bug_bounty_channel) is a Telegram Development channel listed on TGbox, with 14,656 subscribers, created on Aug 20, 2016, activity rated Very active, mainly in English.
All bug bounties here.
– ·7 samples
🏦 MariaDB Report ⚡ Title: Connector/C++ ignores allowMultiQueries and injects savepoint names into SQL 🔍 Reporter: fg0x0 (Yalguun Tumenkhuu) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: SQL Injection └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-04 11:40:48 UTC └ 📝 Created: 2026-07-26 00:59:38 UTC
🏦 MariaDB Report ⚡ Title: Connector/C++ aborts client process on server session-tracking packet via std::stoi 🔍 Reporter: fg0x0 (Yalguun Tumenkhuu) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: Uncontrolled Resource Consumption └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-04 11:40:31 UTC └ 📝 Created: 2026-07-26 01:30:04 UTC
🏦 MariaDB Report ⚡ Title: Connector/C++ string escaper re-escapes its own output, enabling SQL injection 🔍 Reporter: fg0x0 (Yalguun Tumenkhuu) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: SQL Injection └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-04 11:39:07 UTC └ 📝 Created: 2026-07-26 00:20:07 UTC
🏦 MariaDB Report ⚡ Title: Connector/ODBC: MADB\_Stmt::ArrayOffset is not reset when an exception unwinds out of MADB\_StmtExecute, so the next paramset reads out of bounds 🔍 Reporter: fg0x0 (Yalguun Tumenkhuu) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: Out-of-bounds Read └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-04 12:36:47 UTC └ 📝 Created: 2026-08-06 09:50:59 UTC
🏦 MariaDB Report ⚡ Title: Connector/ODBC: SqlwcsOctetLen sizes UTF-16 with a byte-oriented helper, reading past the caller's buffer and sending client memory to the server 🔍 Reporter: fg0x0 (Yalguun Tumenkhuu) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: Out-of-bounds Read └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-04 12:36:07 UTC └ 📝 Created: 2026-08-06 09:45:22 UTC
🏦 MariaDB Report ⚡ Title: r2dbc-mariadb: server message accepted with no command in flight desynchronises the connection and serves one user's rows to another 🔍 Reporter: fg0x0 (Yalguun Tumenkhuu) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: Information Disclosure └ 🔢 CVE: CVE-2026-55859, CVE-2026-55860 ⏰ Timeline: └ 🔓 Disclosed: 2026-11-04 12:35:53 UTC └ 📝 Created: 2026-08-06 09:42:36 UTC
🏦 MariaDB Report ⚡ Title: Connector/ODBC injects unquoted column names into positioned DELETE and UPDATE via MADB\_DynStrGetWhere 🔍 Reporter: fg0x0 (Yalguun Tumenkhuu) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: SQL Injection └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-04 12:35:31 UTC └ 📝 Created: 2026-07-26 19:08:35 UTC
🏦 MariaDB Report ⚡ Title: Connector/ODBC SQLGetDescRec treats descriptor handle as statement handle, heap OOB write on every call 🔍 Reporter: fg0x0 (Yalguun Tumenkhuu) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: Type Confusion └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-04 12:35:06 UTC └ 📝 Created: 2026-07-26 14:26:05 UTC
🏦 MariaDB Report ⚡ Title: Stack buffer overflow in 9 of 10 Connector/ODBC catalog functions via unbounded name 🔍 Reporter: fg0x0 (Yalguun Tumenkhuu) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: Stack Overflow └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-04 12:34:42 UTC └ 📝 Created: 2026-07-26 14:18:40 UTC
🏦 MariaDB Report ❓ Title: Connector/C TLS auth-switch bypass exposes plaintext password on hostname verification failure 🔍 Reporter: mschorm (Michal Schorm) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Not Specified └ 🎯 CWE: Improper Certificate Validation └ 🔢 CVE: CVE-2026-107819 ⏰ Timeline: └ 🔓 Disclosed: 2026-11-04 17:31:54 UTC └ 📝 Created: 2026-07-28 15:19:54 UTC
🏦 MariaDB Report ❓ Title: Connector/C Out-of-bounds read from unterminated GSSAPI SPN in \`parse\_server\_packet\(\)\` 🔍 Reporter: mschorm (Michal Schorm) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Not Specified └ 🎯 CWE: Out-of-bounds Read └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-04 17:31:34 UTC └ 📝 Created: 2026-07-28 15:47:37 UTC
🏦 Weblate Report ⚡ Title: CPU-based Denial of Service in translation-finder via O\(N²\) per-result wildcard mask matching 🔍 Reporter: robin-sabhaya (Robin) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: Uncontrolled Resource Consumption └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-05 09:51:14 UTC └ 📝 Created: 2026-10-05 17:39:11 UTC
🏦 WordPress Report ⚠️ Title: Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp Reports 🔍 Reporter: 0xbs0d27 (0xBS0D27) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: High └ 🎯 CWE: Improper Access Control - Generic └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-05 13:59:32 UTC └ 📝 Created: 2026-07-18 02:44:52 UTC
🏦 WordPress Report ⚡ Title: WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responses 🔍 Reporter: 0xbs0d27 (0xBS0D27) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: Improper Access Control - Generic └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-05 14:18:33 UTC └ 📝 Created: 2026-09-14 20:40:59 UTC
🏦 WordPress Report ⚠️ Title: wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable\_roles 🔍 Reporter: 0xbs0d27 (0xBS0D27) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: High └ 🎯 CWE: Improper Access Control - Generic └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-05 14:18:24 UTC └ 📝 Created: 2026-08-15 16:39:03 UTC
🏦 WordPress Report ⚠️ Title: Instamojo CampTix: fail-open MAC + webhook Credit without binding payment to order 🔍 Reporter: 0xbs0d27 (0xBS0D27) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: High └ 🎯 CWE: Improper Access Control - Generic └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-05 14:18:06 UTC └ 📝 Created: 2026-08-15 04:52:27 UTC
🏦 WordPress Report ⚠️ Title: Unauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference Fields 🔍 Reporter: 0x200notfound (0x200) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: High └ 🎯 CWE: Information Disclosure └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-05 19:56:29 UTC └ 📝 Created: 2026-10-28 05:28:00 UTC
🏦 AWS VDP Report ⚡ Title: Unescaped consent-prompt renderer \(HTML\(\)\) enables concealed-approval OS command injection in strands-agents/tools use\_computer — RCE 🔍 Reporter: hope_no_dupe (peeker) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: OS Command Injection └ 🔢 CVE: CVE-2026-18733 ⏰ Timeline: └ 🔓 Disclosed: 2026-11-06 14:33:16 UTC └ 📝 Created: 2026-10-02 03:00:22 UTC
🏦 Weblate Report ⚡ Title: Billion laughs entity expansion in Qt .ts discovery: a crafted ~950 KB file forces ~55 MB of XML expansion per parse, cost scales with crafted file c 🔍 Reporter: sumit-sabhaya (0xsumit) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: XML Entity Expansion └ 🔢 CVE: CVE-2026-62326 ⏰ Timeline: └ 🔓 Disclosed: 2026-11-07 07:46:29 UTC └ 📝 Created: 2026-10-07 16:46:52 UTC
🏦 curl Report ⚠️ Title: curl 8.23.0 keeps sending requests to an HTTP/3 backend after Alt-Svc: clear 🔍 Reporter: arizonya (Aaron Johnstone) 📋 Details: └ 📊 Status: informative └ ⚡ Severity: High └ 🎯 CWE: Improper Access Control - Generic └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-11-07 22:37:27 UTC └ 📝 Created: 2026-11-06 10:51:03 UTC
No description
Here we announce Telegram coding contests in Android Java, iOS Swift, JS, C/C++. Discussion: @contests
The official source for news about the Telegram Bot API. https://core.telegram.org/bots
News and info from the Linux world 🐧 📨 linuxgr4m@gmail.com 📨 💸 If you want to support Linuxgram❤️ 🐧 - BTC: 15aVLQeNY18VAaoBXPgLFA4wfwJnecbjC1
This test store features the most exotic imaginary goods no money can buy, so you can test how Telegram Payments 2.0 work without spending a penny.
VPS News Channel, VPS Signal Flag is an instant messaging small organization, focusing on VPS and communication freedom. For you to select the most valuable information and provide industry hot news surveys. Discussion Groups:https://t.me/vpsxinhaoqi Comment Rules:https://t.me/xhq_rule 🙋 Post Chat:https://t.me/PandasChatBot
欢迎加入【海外华人聚乐部】！这里聚集了各地优质华人资源，旨在搭建合规、高效的资讯与资源共享平台。 规则：禁止发布任何违法违规、电诈、网赌等不良广告。让我们携手打造正规、诚信的海外华人圈子。
Every day, we change the world. The group promotes meaningful speech, sharing valuable information, such as technical discussions, security information, beginner tutorials, etc. Unnecessary messages will be deleted, with moderation. Banned transactions, recruitment, teachers’ recruitment, beware of being cheated; Banned social work, black production, advertising, politics, driving, etc., including user names and profiles; Banned having questions not directly asking, is there a big guy, asking for a belt, pulling me, understanding, greeting, etc. Banned speech and behavior; Banned private talk to others; Banned abuse of robots. If there is a violation, will be deleted, warned or blocked. Thank you for cooperation.
WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB WEB
