+- Dark C0d3rs (https://darkcoders.wiki)
+-- Forum: Exploit Log (https://darkcoders.wiki/Forum-Exploit-Log)
+--- Forum: Research Papers/Vulnerability reports (https://darkcoders.wiki/Forum-Research-Papers-Vulnerability-reports)
+--- Thread: HackerOne Disclosed Reports - 2025-09-29 (/Thread-HackerOne-Disclosed-Reports-2025-09-29)
HackerOne disclosed reports - 2025-09-29 - hashXploiter - 09-30-2025
resolved
Information Exposure Through Directory Listing
Bug reported by Md. Farhad Ali was disclosed at September 29, 2025, 3:53 pm | Information Exposure Through Directory Listing
The web server was configured to display a list of files contained in the directory. This is not recommended as the directory may have contained files that were not normally exposed through links on the website.
resolved
Email not verified when changing afterwards on apps.nextcloud.com
Bug reported by Md. Farhad Ali was disclosed at September 29, 2025, 3:50 pm | Violation of Secure Design Principles
The email verification bypass vulnerability was discovered in the web application apps.nextcloud.com. The vulnerability allowed attackers to create accounts with any email address without verification, effectively taking over victim accounts.
resolved
Exposing debug.log file leads to server full path disclosure
Bug reported by Md. Farhad Ali was disclosed at September 29, 2025, 3:50 pm | Business Logic Errors
The debug.log file on the nextcloud.com website was publicly accessible and contained sensitive information, including the server's full directory path. This type of information disclosure could have assisted attackers in understanding the internal structure of the server.