"😂" + Unauthenticated Stored XSS in API at https://api.my.games/comments/v1/comments/update/

👉 https://hackerone.com/reports/853637

🔹 Severity: High
🔹 Reported To: Mail.ru
🔹 Reported By: #samet
🔹 Disclosed: July 28, 2020, 8:34am (UTC)

Possible denial of service when entering a loooong password

👉 https://hackerone.com/reports/840598

🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: Nextcloud
🔹 Reported By: #xcheater
🔹 Disclosed: July 29, 2020, 10:30am (UTC)

Fastify uses allErrors: true ajv configuration by default which is susceptible to DoS

👉 https://hackerone.com/reports/903521

🔹 Severity: Medium | 💰 250 USD
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #chalker
🔹 Disclosed: July 29, 2020, 12:53pm (UTC)

Stealing the ip addres from users

👉 https://hackerone.com/reports/672499

🔹 Severity: Low
🔹 Reported To: Vanilla
🔹 Reported By: #minoto
🔹 Disclosed: July 29, 2020, 4:13pm (UTC)

SQL injection (stacked queries) in the export to Excel functionality on Vidyo Server

👉 https://hackerone.com/reports/922567

🔹 Severity: High
🔹 Reported To: 8x8
🔹 Reported By: #b1ackgamba
🔹 State: Resolved
🔹 Disclosed: July 29, 2020, 5:07pm (UTC)

Stored XSS in my staff name fired in another your internal panel

👉 https://hackerone.com/reports/946053

🔹 Severity: High | 💰 5,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #cyber__sec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2020, 10:06pm (UTC)

Bypass Too Many Requests Sign Up

👉 https://hackerone.com/reports/947349

🔹 Severity: Medium
🔹 Reported To: Courier
🔹 Reported By: #ni4hadpd
🔹 State: ⚪️ Informative
🔹 Disclosed: July 30, 2020, 6:52am (UTC)

SMTP Header Injection at http://abonement.ucs.ru

👉 https://hackerone.com/reports/901956

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #killinem_sec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 9:30am (UTC)

Stored XSS on ████████helpdesk

👉 https://hackerone.com/reports/901799

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #atbabers
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:45pm (UTC)

HTML Injection leads to XSS on███

👉 https://hackerone.com/reports/874228

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #lemonoftroy
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:46pm (UTC)

RCE (Remote code execution) in one of DoD's websites

👉 https://hackerone.com/reports/874924

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #ilyass01
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:47pm (UTC)

PulseSSL VPN Site with Compromised Creds @ ████

👉 https://hackerone.com/reports/854049

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #r00tpgp
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:48pm (UTC)

Exposed Docker Registry at https://████

👉 https://hackerone.com/reports/924487

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #chron0x
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:51pm (UTC)

Reflected XSS on https://███████/

👉 https://hackerone.com/reports/804364

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #the_unlucky_guy
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:53pm (UTC)

Reflected XSS on ███████ page

👉 https://hackerone.com/reports/915573

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #scraps
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:54pm (UTC)

ajaxgetachievementsforgame is not guarded for unreleased apps

👉 https://hackerone.com/reports/835087

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: Valve
🔹 Reported By: #jameslll
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 8:38pm (UTC)

Stored self XSS at auto.mail.ru using add_review functionality

👉 https://hackerone.com/reports/914286

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #avolume
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 7:17am (UTC)

Sidekiq Dashboard Publicly accessible at http://shopper.staging.instamart.ru/sidekiq/

👉 https://hackerone.com/reports/890513

🔹 Severity: Medium | 💰 150 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #sudi
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 7:19am (UTC)

Path traversal in filename in LINE Mac client

👉 https://hackerone.com/reports/727727

🔹 Severity: High | 💰 2,785 USD
🔹 Reported To: LINE
🔹 Reported By: #hackerontwowheels
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 9:32am (UTC)

Reverse Tabnabbing in printing source document images

👉 https://hackerone.com/reports/911123

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Visma Public
🔹 Reported By: #artebels
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 12:40pm (UTC)

[is-my-json-valid] ReDoS via 'style' format

👉 https://hackerone.com/reports/909757

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #chalker
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 5:13pm (UTC)