浏览报告
11 份报告 · 本页赏金 $900 · 清除筛选
SSRF By adding a custom integration on console.helium.com服务端请求伪造Helium中危—2021-05-26Race Condition of Transfer data Credits to Organization Leads to Add Extra free Data Credits to the Organization业务逻辑Helium低危$2502020-11-27Read-Only user can delete users不安全的直接对象引用Helium中危—2020-07-10HTTP request Smuggling注入与走私Helium中危—2020-07-02unpermitted user can change the device name of admin account其他弱点Helium中危—2020-06-16Hyperlink Injection on Email Invitation开放重定向Helium低危$502020-11-24Organization Takeover via invitation API不安全的直接对象引用Helium低危$1002020-05-27Cleartext Transmission of Sensitive Information Leads to administrator access密码学缺陷Helium低危—2020-05-30Account takeover w/o interaction for a user that doesn't have 2fa enabled via 2fa linking and improper auth at /api/2fa/verify身份认证Helium低危—2020-07-26Read-only user can delete higher privileged members using open DELETE /api/memberships/<membershipID> endpoint访问控制Helium低危—2020-06-29Organization Takeover访问控制Helium中危$5002020-05-27