Singapore - Account Takeover via IDOR

👉 https://hackerone.com/reports/876300

🔹 Severity: Critical
🔹 Reported To: Starbucks
🔹 Reported By: #ko2sec
🔹 Disclosed: July 28, 2020, 7:44pm (UTC)

SQL injection in Razer Gold List Admin at /lists/index.php via the `list[]` parameter.

👉 https://hackerone.com/reports/824307

🔹 Severity: Critical | 💰 2000 USD
🔹 Reported To: Razer
🔹 Reported By: #stealthy
🔹 Disclosed: July 28, 2020, 9:59pm (UTC)

User Access Control Bypass Via Razer elevated service ( RzKLService.exe ) which loads exe in misconfigured way.

👉 https://hackerone.com/reports/769684

🔹 Severity: High | 💰 750 USD
🔹 Reported To: Razer
🔹 Reported By: #dredd_589
🔹 Disclosed: July 28, 2020, 10:01pm (UTC)

Missing rate limit in signup Form

👉 https://hackerone.com/reports/905692

🔹 Severity: Medium
🔹 Reported To: Courier
🔹 Reported By: #ahmed_almalky
🔹 Disclosed: July 28, 2020, 10:51pm (UTC)

"😂" + Unauthenticated Stored XSS in API at https://api.my.games/comments/v1/comments/update/

👉 https://hackerone.com/reports/853637

🔹 Severity: High
🔹 Reported To: Mail.ru
🔹 Reported By: #samet
🔹 Disclosed: July 28, 2020, 8:34am (UTC)

Possible denial of service when entering a loooong password

👉 https://hackerone.com/reports/840598

🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: Nextcloud
🔹 Reported By: #xcheater
🔹 Disclosed: July 29, 2020, 10:30am (UTC)

Fastify uses allErrors: true ajv configuration by default which is susceptible to DoS

👉 https://hackerone.com/reports/903521

🔹 Severity: Medium | 💰 250 USD
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #chalker
🔹 Disclosed: July 29, 2020, 12:53pm (UTC)

Stealing the ip addres from users

👉 https://hackerone.com/reports/672499

🔹 Severity: Low
🔹 Reported To: Vanilla
🔹 Reported By: #minoto
🔹 Disclosed: July 29, 2020, 4:13pm (UTC)

SQL injection (stacked queries) in the export to Excel functionality on Vidyo Server

👉 https://hackerone.com/reports/922567

🔹 Severity: High
🔹 Reported To: 8x8
🔹 Reported By: #b1ackgamba
🔹 State: Resolved
🔹 Disclosed: July 29, 2020, 5:07pm (UTC)

Stored XSS in my staff name fired in another your internal panel

👉 https://hackerone.com/reports/946053

🔹 Severity: High | 💰 5,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #cyber__sec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2020, 10:06pm (UTC)

Bypass Too Many Requests Sign Up

👉 https://hackerone.com/reports/947349

🔹 Severity: Medium
🔹 Reported To: Courier
🔹 Reported By: #ni4hadpd
🔹 State: ⚪️ Informative
🔹 Disclosed: July 30, 2020, 6:52am (UTC)

SMTP Header Injection at http://abonement.ucs.ru

👉 https://hackerone.com/reports/901956

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #killinem_sec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 9:30am (UTC)

Stored XSS on ████████helpdesk

👉 https://hackerone.com/reports/901799

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #atbabers
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:45pm (UTC)

HTML Injection leads to XSS on███

👉 https://hackerone.com/reports/874228

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #lemonoftroy
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:46pm (UTC)

RCE (Remote code execution) in one of DoD's websites

👉 https://hackerone.com/reports/874924

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #ilyass01
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:47pm (UTC)

PulseSSL VPN Site with Compromised Creds @ ████

👉 https://hackerone.com/reports/854049

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #r00tpgp
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:48pm (UTC)

Exposed Docker Registry at https://████

👉 https://hackerone.com/reports/924487

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #chron0x
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:51pm (UTC)

Reflected XSS on https://███████/

👉 https://hackerone.com/reports/804364

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #the_unlucky_guy
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:53pm (UTC)

Reflected XSS on ███████ page

👉 https://hackerone.com/reports/915573

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #scraps
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:54pm (UTC)

ajaxgetachievementsforgame is not guarded for unreleased apps

👉 https://hackerone.com/reports/835087

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: Valve
🔹 Reported By: #jameslll
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 8:38pm (UTC)

Stored self XSS at auto.mail.ru using add_review functionality

👉 https://hackerone.com/reports/914286

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #avolume
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 7:17am (UTC)