DOM-Based XSS in tumblr.com

👉 https://hackerone.com/reports/882546

🔹 Severity: Medium | 💰 350 USD
🔹 Reported To: Automattic
🔹 Reported By: #keer0k
🔹 Disclosed: July 27, 2020, 3:24pm (UTC)

JDBC credentials leaked via github

👉 https://hackerone.com/reports/935573

🔹 Severity: No Rating
🔹 Reported To: Yelp
🔹 Reported By: #walidhossain
🔹 Disclosed: July 27, 2020, 4:44pm (UTC)

IDOR: Adding Contacts to Other User Groups

👉 https://hackerone.com/reports/879960

🔹 Severity: Low
🔹 Reported To: 8x8
🔹 Reported By: #ameyanekar
🔹 Disclosed: July 27, 2020, 4:50pm (UTC)

Python : Add query to detect Server Side Template Injection

👉 https://hackerone.com/reports/944359

🔹 Severity: High | 💰 2300 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #porcupineyhairs
🔹 Disclosed: July 27, 2020, 9:45pm (UTC)

Wordpress Users Disclosure (/wp-json/wp/v2/users/) on data.gov

👉 https://hackerone.com/reports/942481

🔹 Severity: Medium
🔹 Reported To: TTS Bug Bounty
🔹 Reported By: #nagli
🔹 Disclosed: July 28, 2020, 12:12am (UTC)

Stored XSS In mlbootcamp.ru

👉 https://hackerone.com/reports/820217

🔹 Severity: High
🔹 Reported To: Mail.ru
🔹 Reported By: #sniper302
🔹 Disclosed: July 28, 2020, 8:28am (UTC)

Content injection on shared event (calendar.mail.ru)

👉 https://hackerone.com/reports/847473

🔹 Severity: Low | 💰 150 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #urban_tramp
🔹 Disclosed: July 28, 2020, 8:31am (UTC)

Blindy Replace User's Session with Attacker's Session

👉 https://hackerone.com/reports/892986

🔹 Severity: Low | 💰 150 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #sayaanalam
🔹 Disclosed: July 28, 2020, 8:37am (UTC)

HTML/iframe/XSS injection on https://www.ucs.ru/online/shelter/settings/check/

👉 https://hackerone.com/reports/907867

🔹 Severity: Medium
🔹 Reported To: Mail.ru
🔹 Reported By: #hunter_py
🔹 Disclosed: July 28, 2020, 8:41am (UTC)

Test-scripts for postgis in mason-repository using unsafe unzip of content from unclaimed bucket creates potential RCE-issues

👉 https://hackerone.com/reports/329689

🔹 Severity: Critical | 💰 12500 USD
🔹 Reported To: Mapbox
🔹 Reported By: #fransrosen
🔹 Disclosed: July 28, 2020, 7:37pm (UTC)

Singapore - Account Takeover via IDOR

👉 https://hackerone.com/reports/876300

🔹 Severity: Critical
🔹 Reported To: Starbucks
🔹 Reported By: #ko2sec
🔹 Disclosed: July 28, 2020, 7:44pm (UTC)

SQL injection in Razer Gold List Admin at /lists/index.php via the `list[]` parameter.

👉 https://hackerone.com/reports/824307

🔹 Severity: Critical | 💰 2000 USD
🔹 Reported To: Razer
🔹 Reported By: #stealthy
🔹 Disclosed: July 28, 2020, 9:59pm (UTC)

User Access Control Bypass Via Razer elevated service ( RzKLService.exe ) which loads exe in misconfigured way.

👉 https://hackerone.com/reports/769684

🔹 Severity: High | 💰 750 USD
🔹 Reported To: Razer
🔹 Reported By: #dredd_589
🔹 Disclosed: July 28, 2020, 10:01pm (UTC)

Missing rate limit in signup Form

👉 https://hackerone.com/reports/905692

🔹 Severity: Medium
🔹 Reported To: Courier
🔹 Reported By: #ahmed_almalky
🔹 Disclosed: July 28, 2020, 10:51pm (UTC)

"😂" + Unauthenticated Stored XSS in API at https://api.my.games/comments/v1/comments/update/

👉 https://hackerone.com/reports/853637

🔹 Severity: High
🔹 Reported To: Mail.ru
🔹 Reported By: #samet
🔹 Disclosed: July 28, 2020, 8:34am (UTC)

Possible denial of service when entering a loooong password

👉 https://hackerone.com/reports/840598

🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: Nextcloud
🔹 Reported By: #xcheater
🔹 Disclosed: July 29, 2020, 10:30am (UTC)

Fastify uses allErrors: true ajv configuration by default which is susceptible to DoS

👉 https://hackerone.com/reports/903521

🔹 Severity: Medium | 💰 250 USD
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #chalker
🔹 Disclosed: July 29, 2020, 12:53pm (UTC)

Stealing the ip addres from users

👉 https://hackerone.com/reports/672499

🔹 Severity: Low
🔹 Reported To: Vanilla
🔹 Reported By: #minoto
🔹 Disclosed: July 29, 2020, 4:13pm (UTC)

SQL injection (stacked queries) in the export to Excel functionality on Vidyo Server

👉 https://hackerone.com/reports/922567

🔹 Severity: High
🔹 Reported To: 8x8
🔹 Reported By: #b1ackgamba
🔹 State: Resolved
🔹 Disclosed: July 29, 2020, 5:07pm (UTC)

Stored XSS in my staff name fired in another your internal panel

👉 https://hackerone.com/reports/946053

🔹 Severity: High | 💰 5,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #cyber__sec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2020, 10:06pm (UTC)

Bypass Too Many Requests Sign Up

👉 https://hackerone.com/reports/947349

🔹 Severity: Medium
🔹 Reported To: Courier
🔹 Reported By: #ni4hadpd
🔹 State: ⚪️ Informative
🔹 Disclosed: July 30, 2020, 6:52am (UTC)