Conversation

Notices

1. Embed this notice
   cR0w (cr0w@infosec.exchange)'s status on Tuesday, 06-May-2025 04:06:25 JST cR0w

   in reply to

   Bug bounties. lol.

   Edit to fix the markdown from the copy / paste.

   • February 04, 2025: Initial contact attempt by ERNW via Mail stating it cannot accept the terms and conditions of HackerOne .
   • February 10, 2025: Contact attempt by ERNW.
   • February 11, 2025: Contact attempt by ERNW.
   • February 11, 2025: PagerDuty Security Team states only reports via HackerOne are accepted.
   • February 12, 2025: ERNW states it cannot accept the terms and conditions.
   • February 14, 2025: Contact attempt by ERNW.
   • February 26, 2025: Contact attempt by ERNW.
   • March 04, 2025: Contact attempt by ERNW.
   • March 27, 2025: Contact attempt by ERNW.
   • May 05, 2025: Contact attempt by ERNW stating that the disclosure timeline is exceeded. Public Disclosure by ERNW.
   • Embed this notice
     cR0w (cr0w@infosec.exchange)'s status on Tuesday, 06-May-2025 04:06:26 JST cR0w

     Public disclosure of a few command injection vulns in Rundeck 5.8.0 and 5.11.1 ( which is the latest version on the Rundeck site ) and IDK, probably others.

     https://insinuator.net/2025/05/full-disclosure-multiple-rundeck-job-command-injections/

     scriptjunkie and GreenSkyOverMe (Monika) repeated this.