浏览报告
68 份报告 · 本页赏金 $30,200 · 清除筛选
A disabled account's API key still works on BMO's Mojolicious /rest/ routes, including for security-group bugs filed after the disable身份认证Mozilla中危$4,0002026-10-26Stored XSS on the public Pontoon dashboards: the latest-activity tooltip re-parses a contributor's account address as HTML跨站脚本Mozilla中危$3,0002026-10-14Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)代码执行Mozilla高危$12,0002026-08-05Taskcluster web-server OAuth2 authorization codes are reusable and the exchange handler checks the wrong expiry column身份认证Mozilla低危$2,0002026-06-23User Can Delete Other Users' Personal Access Tokens at /delete-token/{token_id}/ on Mozilla Pontoon访问控制Mozilla低危—2026-04-10Bypass of Restricted Keyword "Mozilla" in Display Name Field via Unicode Homoglyphs on addons.allizom.org其他弱点Mozilla低危$5002026-04-27Microsoft `x-apikey` Exposed in Mozilla CI Public Logs信息泄露Mozilla低危$2002025-11-03Bypass "No Links" Restriction in Biography via Protocol-Relative URL (//)其他弱点Mozilla低危—2025-07-29IDOR: Account Deletion via Session Misbinding – Attacker Can Delete Victim Account不安全的直接对象引用Mozilla中危—2025-06-03[Privilege Escalation] User can Pin|Unpin Any Comment on Any Project or Locale访问控制Mozilla低危—2026-03-20[Vertical Privilege Escalation] User can Unapproved any Approved Translation at [/translations/unapprove/]访问控制Mozilla低危—2026-04-10Mozilla VPN Clients: RCE via file write and path traversal路径遍历Mozilla中危$6,0002025-07-29Netlify Authentication Token Exposed in Public Mozilla CI Logs信息泄露Mozilla高危—2025-05-13Subdomain takeover on a subdomain under firefox.com错误配置Mozilla低危$5002025-07-03Denial of Access to Static Resources via Cache Poisoning on addons.allizom.org注入与走私Mozilla低危—2025-01-08Information disclosure on password cancel endpoint信息泄露Mozilla低危—2024-10-29User API Key leakage in Github commit leads to unauthorized access to sql.telemetry.mozilla.org信息泄露Mozilla中危—2024-10-08Bypass Email verification for monitoring at `monitor.mozilla.org`业务逻辑Mozilla低危—2025-01-22[ addons-preview-cdn.mozilla.net ] A subdomain takeover is available via unregistered domain in Fastly错误配置Mozilla低危$5002024-12-06Private Emails of Moz Workers Leaked in Public file信息泄露Mozilla低危—2024-09-04MozillaVPN: Elevation of Privilege via a Logic Vulnerability路径遍历Mozilla低危—2025-07-03Subdomain takeover on one of the subdomains under mozaws.net错误配置Mozilla低危—2024-07-25csrftoken not unique to session or specific user and csrfmiddlewaretoken can be altered跨站请求伪造Mozilla低危$5002024-11-20Jira Credential Disclosure within Mozilla Slack信息泄露Mozilla高危$1,0002024-04-23sentry Auth Token exposed publicly in docker hub image信息泄露Mozilla低危—2024-10-18
第 1 / 3 页下一页 →