Internal IP addresses range and AWS cluster region leaked in a Github repository

👉 https://hackerone.com/reports/877303

🔹 Severity: No Rating
🔹 Reported To: Kubernetes
🔹 Reported By: #cyberhawksec
🔹 Disclosed: July 24, 2020, 12:43am (UTC)

No Rate Limiting On Phone Number Login Leads to Login Bypass

👉 https://hackerone.com/reports/903363

🔹 Severity: Medium
🔹 Reported To: Smule
🔹 Reported By: #done11
🔹 Disclosed: July 24, 2020, 2:19am (UTC)

DoS for client-go jsonpath func

👉 https://hackerone.com/reports/882923

🔹 Severity: Low
🔹 Reported To: Kubernetes
🔹 Reported By: #lazydog
🔹 Disclosed: July 24, 2020, 3:46am (UTC)

Getting SmartDNS for free from - join.nordvpn.com

👉 https://hackerone.com/reports/925757

🔹 Severity: High
🔹 Reported To: NordVPN
🔹 Reported By: #salahhasoneh
🔹 Disclosed: July 24, 2020, 9:01am (UTC)

Business Logic Flaw - A non premium user can change/update retailers to get cashback on all the retailers associated with Curve

👉 https://hackerone.com/reports/672487

🔹 Severity: Medium
🔹 Reported To: Curve
🔹 Reported By: #praseudo7
🔹 Disclosed: July 24, 2020, 12:28pm (UTC)

Stored XSS at [ https://app.lemlist.com/campaigns/cam_QRS5caF2ca7MJtiLS/leads ] in " LINKEDIN URL" Field.

👉 https://hackerone.com/reports/932557

🔹 Severity: Low
🔹 Reported To: lemlist
🔹 Reported By: #try___for___impossible
🔹 Disclosed: July 24, 2020, 2:01pm (UTC)

Grammarly Keyboard for Android "Authorization Code with PKCE" flow implementation vulnerability that allows account takeover

👉 https://hackerone.com/reports/824931

🔹 Severity: Medium
🔹 Reported To: Grammarly
🔹 Reported By: #tomtenisse
🔹 Disclosed: July 24, 2020, 2:22pm (UTC)

CVE-2019-19935 - DOM based XSS in the froala editor

👉 https://hackerone.com/reports/938683

🔹 Severity: Low
🔹 Reported To: lemlist
🔹 Reported By: #chackal
🔹 Disclosed: July 24, 2020, 3:33pm (UTC)

SQL Injection or Denial of Service due to a Prototype Pollution

👉 https://hackerone.com/reports/869574

🔹 Severity: Critical
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #phra
🔹 Disclosed: July 24, 2020, 5:20pm (UTC)

SAML Response Reuse on hackerone.com/users/saml/auth

👉 https://hackerone.com/reports/888930

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: HackerOne
🔹 Reported By: #samtink
🔹 Disclosed: July 24, 2020, 6:51pm (UTC)

Denial of Service [Chrome]

👉 https://hackerone.com/reports/921286

🔹 Severity: Medium | 💰 560 USD
🔹 Reported To: Twitter
🔹 Reported By: #cyanpiny
🔹 Disclosed: July 24, 2020, 8:00pm (UTC)

Untrusted users able to run pending migrations in production

👉 https://hackerone.com/reports/899069

🔹 Severity: Medium
🔹 Reported To: Ruby on Rails
🔹 Reported By: #tenderlove
🔹 Disclosed: July 24, 2020, 8:07pm (UTC)

GraphQL field on Team node can be used to determine if External Program runs invite-only program

👉 https://hackerone.com/reports/877642

🔹 Severity: Medium
🔹 Reported To: HackerOne
🔹 Reported By: #kunal94
🔹 Disclosed: July 25, 2020, 1:13am (UTC)

Contacts menu (not app) fails to restrict (to local groups) for contacts from federated servers

👉 https://hackerone.com/reports/895730

🔹 Severity: Low
🔹 Reported To: Nextcloud
🔹 Reported By: #nursoda
🔹 Disclosed: July 25, 2020, 8:10am (UTC)

Improper validation of unicode characters#2

👉 https://hackerone.com/reports/279945

🔹 Severity: No Rating
🔹 Reported To: Weblate
🔹 Reported By: #code_monkey
🔹 Disclosed: July 26, 2020, 10:50am (UTC)

Open Github Repo Leaking WEBLATE SECRET KEY

👉 https://hackerone.com/reports/942146

🔹 Severity: No Rating
🔹 Reported To: Weblate
🔹 Reported By: #nafisaqil4
🔹 Disclosed: July 26, 2020, 11:24am (UTC)

IDOR with Geolocation data not stripped from images

👉 https://hackerone.com/reports/906907

🔹 Severity: High | 💰 200 USD
🔹 Reported To: IRCCloud
🔹 Reported By: #do_some_hack
🔹 Disclosed: July 26, 2020, 3:36pm (UTC)

Account takeover w/o interaction for a user that doesn't have 2fa enabled via 2fa linking and improper auth at /api/2fa/verify

👉 https://hackerone.com/reports/810880

🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: Helium
🔹 Reported By: #w2w
🔹 Disclosed: July 26, 2020, 4:39pm (UTC)

Send arbitrary PUT requests when user clicks on a link

👉 https://hackerone.com/reports/824689

🔹 Severity: Medium | 💰 3000 USD
🔹 Reported To: GitLab
🔹 Reported By: #yvvdwf
🔹 Disclosed: July 27, 2020, 8:44am (UTC)

📆 July 31 - August 1, 2020

h@cktivitycon is a HackerOne hosted hacker conference built by the community for the community.

h@cktivitycon is a place for hackers to learn, share, and meet friends. Hear talks and panelists exploring offensive hacking techniques, recon skills, target selection and more.

🗣 Speakers | ⏱ Schedule

🚀 Register now

Cross-Site WebSocket Hijacking Lead to Steal XSRF-TOKEN

👉 https://hackerone.com/reports/915541

🔹 Severity: No Rating
🔹 Reported To: Stripo Inc
🔹 Reported By: #3x3s
🔹 Disclosed: July 27, 2020, 12:54pm (UTC)