Email Spoofing on sifchain.finance

👉 https://hackerone.com/reports/1191209

🔹 Severity: Low
🔹 Reported To: Sifchain
🔹 Reported By: #ibrahimauwal1
🔹 State: 🟤 Duplicate
🔹 Disclosed: May 11, 2021, 2:23pm (UTC)

Members Personal Information Leak Due to IDOR

👉 https://hackerone.com/reports/847185

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #r00tpgp
🔹 State: 🟢 Resolved
🔹 Disclosed: May 11, 2021, 8:13pm (UTC)

DOM Based XSS on https://████ via backURL param

👉 https://hackerone.com/reports/1159255

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #nagli
🔹 State: 🟢 Resolved
🔹 Disclosed: May 11, 2021, 8:15pm (UTC)

Path Traversal - [ CVE-2020-3452 ]

👉 https://hackerone.com/reports/1137321

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #khun_myat
🔹 State: 🟢 Resolved
🔹 Disclosed: May 11, 2021, 8:16pm (UTC)

https://████ is vulnerable to cve-2020-3452

👉 https://hackerone.com/reports/998925

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #moon_shadow
🔹 State: 🟢 Resolved
🔹 Disclosed: May 11, 2021, 8:18pm (UTC)

XSS via X-Forwarded-Host header

👉 https://hackerone.com/reports/882220

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #geeknik
🔹 State: 🟢 Resolved
🔹 Disclosed: May 11, 2021, 8:19pm (UTC)

███ on https://████ enable ███ scraping, injection, stored XSS

👉 https://hackerone.com/reports/1048571

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #skarsom
🔹 State: 🟢 Resolved
🔹 Disclosed: May 11, 2021, 8:25pm (UTC)

Moodle XSS on evolve.glovoapp.com

👉 https://hackerone.com/reports/1165540

🔹 Severity: Medium
🔹 Reported To: Glovo
🔹 Reported By: #sn3akysnak3
🔹 State: 🟢 Resolved
🔹 Disclosed: May 12, 2021, 7:41am (UTC)

Path traversal lead to LFR via [CVE-2019-3394]

👉 https://hackerone.com/reports/980881

🔹 Severity: Critical | 💰 1,500 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #tounsi_007
🔹 State: 🟢 Resolved
🔹 Disclosed: May 12, 2021, 2:09pm (UTC)

Получение локального пути до файла [geekbrains.ru]

👉 https://hackerone.com/reports/1012644

🔹 Severity: Low
🔹 Reported To: Mail.ru
🔹 Reported By: #lobity
🔹 State: 🟢 Resolved
🔹 Disclosed: May 12, 2021, 2:14pm (UTC)

Wrong Url in Main Page

👉 https://hackerone.com/reports/1188629

🔹 Severity: Low | 💰 200 USD
🔹 Reported To: Sifchain
🔹 Reported By: #n33dm0n3y
🔹 State: 🟢 Resolved
🔹 Disclosed: May 12, 2021, 3:25pm (UTC)

SSRF at jira.plazius.ru - CVE-2019-8451

👉 https://hackerone.com/reports/900618

🔹 Severity: High | 💰 1,200 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #cutedoggo
🔹 State: 🟢 Resolved
🔹 Disclosed: May 12, 2021, 3:48pm (UTC)

Social media links not working

👉 https://hackerone.com/reports/1189282

🔹 Severity: No Rating
🔹 Reported To: Sifchain
🔹 Reported By: #tefa_
🔹 State: 🟤 Duplicate
🔹 Disclosed: May 12, 2021, 5:41pm (UTC)

CORS Misconfiguration

👉 https://hackerone.com/reports/1194280

🔹 Severity: No Rating
🔹 Reported To: Sifchain
🔹 Reported By: #itsme_ani
🔹 State: 🟤 Duplicate
🔹 Disclosed: May 12, 2021, 6:01pm (UTC)

Wordpress Users Disclosure (/wp-json/wp/v2/users/) on sifchain.finance

👉 https://hackerone.com/reports/1195194

🔹 Severity: Low
🔹 Reported To: Sifchain
🔹 Reported By: #ibrahimauwal1
🔹 State: 🟤 Duplicate
🔹 Disclosed: May 13, 2021, 12:43am (UTC)

Cross Origin Resource Sharing Misconfiguration | Lead to sensitive information.

👉 https://hackerone.com/reports/1189363

🔹 Severity: No Rating
🔹 Reported To: Sifchain
🔹 Reported By: #immortalsurya
🔹 State: 🟤 Duplicate
🔹 Disclosed: May 13, 2021, 3:32am (UTC)

CSRF allows to test email forwarding

👉 https://hackerone.com/reports/1131473

🔹 Severity: Low
🔹 Reported To: HackerOne
🔹 Reported By: #muon4
🔹 State: 🟢 Resolved
🔹 Disclosed: May 13, 2021, 5:22am (UTC)

Lack warning label when receiving a letter

👉 https://hackerone.com/reports/1128701

🔹 Severity: Low
🔹 Reported To: HackerOne
🔹 Reported By: #haxta4ok00
🔹 State: 🟢 Resolved
🔹 Disclosed: May 13, 2021, 8:25am (UTC)

Email spoofing

👉 https://hackerone.com/reports/1187511

🔹 Severity: No Rating
🔹 Reported To: Sifchain
🔹 Reported By: #tmsm
🔹 State: 🟤 Duplicate
🔹 Disclosed: May 13, 2021, 10:20am (UTC)

Path Transversal inside saveContracts.js

👉 https://hackerone.com/reports/1196917

🔹 Severity: No Rating
🔹 Reported To: Sifchain
🔹 Reported By: #caon
🔹 State: 🔴 N/A
🔹 Disclosed: May 14, 2021, 12:47am (UTC)

Found a url on source code which was disclosing different juicy informations like ip addresses and available endponts

👉 https://hackerone.com/reports/1195432

🔹 Severity: No Rating
🔹 Reported To: Sifchain
🔹 Reported By: #paranoid07
🔹 State: 🔴 N/A
🔹 Disclosed: May 14, 2021, 3:25pm (UTC)