Grammarly Keyboard for Android "Authorization Code with PKCE" flow implementation vulnerability that allows account takeover

👉 https://hackerone.com/reports/824931

🔹 Severity: Medium
🔹 Reported To: Grammarly
🔹 Reported By: #tomtenisse
🔹 Disclosed: July 24, 2020, 2:22pm (UTC)

CVE-2019-19935 - DOM based XSS in the froala editor

👉 https://hackerone.com/reports/938683

🔹 Severity: Low
🔹 Reported To: lemlist
🔹 Reported By: #chackal
🔹 Disclosed: July 24, 2020, 3:33pm (UTC)

SQL Injection or Denial of Service due to a Prototype Pollution

👉 https://hackerone.com/reports/869574

🔹 Severity: Critical
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #phra
🔹 Disclosed: July 24, 2020, 5:20pm (UTC)

SAML Response Reuse on hackerone.com/users/saml/auth

👉 https://hackerone.com/reports/888930

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: HackerOne
🔹 Reported By: #samtink
🔹 Disclosed: July 24, 2020, 6:51pm (UTC)

Denial of Service [Chrome]

👉 https://hackerone.com/reports/921286

🔹 Severity: Medium | 💰 560 USD
🔹 Reported To: Twitter
🔹 Reported By: #cyanpiny
🔹 Disclosed: July 24, 2020, 8:00pm (UTC)

Untrusted users able to run pending migrations in production

👉 https://hackerone.com/reports/899069

🔹 Severity: Medium
🔹 Reported To: Ruby on Rails
🔹 Reported By: #tenderlove
🔹 Disclosed: July 24, 2020, 8:07pm (UTC)

GraphQL field on Team node can be used to determine if External Program runs invite-only program

👉 https://hackerone.com/reports/877642

🔹 Severity: Medium
🔹 Reported To: HackerOne
🔹 Reported By: #kunal94
🔹 Disclosed: July 25, 2020, 1:13am (UTC)

Contacts menu (not app) fails to restrict (to local groups) for contacts from federated servers

👉 https://hackerone.com/reports/895730

🔹 Severity: Low
🔹 Reported To: Nextcloud
🔹 Reported By: #nursoda
🔹 Disclosed: July 25, 2020, 8:10am (UTC)

Improper validation of unicode characters#2

👉 https://hackerone.com/reports/279945

🔹 Severity: No Rating
🔹 Reported To: Weblate
🔹 Reported By: #code_monkey
🔹 Disclosed: July 26, 2020, 10:50am (UTC)

Open Github Repo Leaking WEBLATE SECRET KEY

👉 https://hackerone.com/reports/942146

🔹 Severity: No Rating
🔹 Reported To: Weblate
🔹 Reported By: #nafisaqil4
🔹 Disclosed: July 26, 2020, 11:24am (UTC)

IDOR with Geolocation data not stripped from images

👉 https://hackerone.com/reports/906907

🔹 Severity: High | 💰 200 USD
🔹 Reported To: IRCCloud
🔹 Reported By: #do_some_hack
🔹 Disclosed: July 26, 2020, 3:36pm (UTC)

Account takeover w/o interaction for a user that doesn't have 2fa enabled via 2fa linking and improper auth at /api/2fa/verify

👉 https://hackerone.com/reports/810880

🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: Helium
🔹 Reported By: #w2w
🔹 Disclosed: July 26, 2020, 4:39pm (UTC)

Send arbitrary PUT requests when user clicks on a link

👉 https://hackerone.com/reports/824689

🔹 Severity: Medium | 💰 3000 USD
🔹 Reported To: GitLab
🔹 Reported By: #yvvdwf
🔹 Disclosed: July 27, 2020, 8:44am (UTC)

📆 July 31 - August 1, 2020

h@cktivitycon is a HackerOne hosted hacker conference built by the community for the community.

h@cktivitycon is a place for hackers to learn, share, and meet friends. Hear talks and panelists exploring offensive hacking techniques, recon skills, target selection and more.

🗣 Speakers | ⏱ Schedule

🚀 Register now

Cross-Site WebSocket Hijacking Lead to Steal XSRF-TOKEN

👉 https://hackerone.com/reports/915541

🔹 Severity: No Rating
🔹 Reported To: Stripo Inc
🔹 Reported By: #3x3s
🔹 Disclosed: July 27, 2020, 12:54pm (UTC)

DOM-Based XSS in tumblr.com

👉 https://hackerone.com/reports/882546

🔹 Severity: Medium | 💰 350 USD
🔹 Reported To: Automattic
🔹 Reported By: #keer0k
🔹 Disclosed: July 27, 2020, 3:24pm (UTC)

JDBC credentials leaked via github

👉 https://hackerone.com/reports/935573

🔹 Severity: No Rating
🔹 Reported To: Yelp
🔹 Reported By: #walidhossain
🔹 Disclosed: July 27, 2020, 4:44pm (UTC)

IDOR: Adding Contacts to Other User Groups

👉 https://hackerone.com/reports/879960

🔹 Severity: Low
🔹 Reported To: 8x8
🔹 Reported By: #ameyanekar
🔹 Disclosed: July 27, 2020, 4:50pm (UTC)

Python : Add query to detect Server Side Template Injection

👉 https://hackerone.com/reports/944359

🔹 Severity: High | 💰 2300 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #porcupineyhairs
🔹 Disclosed: July 27, 2020, 9:45pm (UTC)

Wordpress Users Disclosure (/wp-json/wp/v2/users/) on data.gov

👉 https://hackerone.com/reports/942481

🔹 Severity: Medium
🔹 Reported To: TTS Bug Bounty
🔹 Reported By: #nagli
🔹 Disclosed: July 28, 2020, 12:12am (UTC)

Stored XSS In mlbootcamp.ru

👉 https://hackerone.com/reports/820217

🔹 Severity: High
🔹 Reported To: Mail.ru
🔹 Reported By: #sniper302
🔹 Disclosed: July 28, 2020, 8:28am (UTC)