SQL injection (stacked queries) in the export to Excel functionality on Vidyo Server

👉 https://hackerone.com/reports/922567

🔹 Severity: High
🔹 Reported To: 8x8
🔹 Reported By: #b1ackgamba
🔹 State: Resolved
🔹 Disclosed: July 29, 2020, 5:07pm (UTC)

Stored XSS in my staff name fired in another your internal panel

👉 https://hackerone.com/reports/946053

🔹 Severity: High | 💰 5,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #cyber__sec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2020, 10:06pm (UTC)

Bypass Too Many Requests Sign Up

👉 https://hackerone.com/reports/947349

🔹 Severity: Medium
🔹 Reported To: Courier
🔹 Reported By: #ni4hadpd
🔹 State: ⚪️ Informative
🔹 Disclosed: July 30, 2020, 6:52am (UTC)

SMTP Header Injection at http://abonement.ucs.ru

👉 https://hackerone.com/reports/901956

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #killinem_sec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 9:30am (UTC)

Stored XSS on ████████helpdesk

👉 https://hackerone.com/reports/901799

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #atbabers
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:45pm (UTC)

HTML Injection leads to XSS on███

👉 https://hackerone.com/reports/874228

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #lemonoftroy
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:46pm (UTC)

RCE (Remote code execution) in one of DoD's websites

👉 https://hackerone.com/reports/874924

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #ilyass01
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:47pm (UTC)

PulseSSL VPN Site with Compromised Creds @ ████

👉 https://hackerone.com/reports/854049

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #r00tpgp
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:48pm (UTC)

Exposed Docker Registry at https://████

👉 https://hackerone.com/reports/924487

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #chron0x
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:51pm (UTC)

Reflected XSS on https://███████/

👉 https://hackerone.com/reports/804364

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #the_unlucky_guy
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:53pm (UTC)

Reflected XSS on ███████ page

👉 https://hackerone.com/reports/915573

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #scraps
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 5:54pm (UTC)

ajaxgetachievementsforgame is not guarded for unreleased apps

👉 https://hackerone.com/reports/835087

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: Valve
🔹 Reported By: #jameslll
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2020, 8:38pm (UTC)

Stored self XSS at auto.mail.ru using add_review functionality

👉 https://hackerone.com/reports/914286

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #avolume
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 7:17am (UTC)

Sidekiq Dashboard Publicly accessible at http://shopper.staging.instamart.ru/sidekiq/

👉 https://hackerone.com/reports/890513

🔹 Severity: Medium | 💰 150 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #sudi
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 7:19am (UTC)

Path traversal in filename in LINE Mac client

👉 https://hackerone.com/reports/727727

🔹 Severity: High | 💰 2,785 USD
🔹 Reported To: LINE
🔹 Reported By: #hackerontwowheels
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 9:32am (UTC)

Reverse Tabnabbing in printing source document images

👉 https://hackerone.com/reports/911123

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Visma Public
🔹 Reported By: #artebels
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 12:40pm (UTC)

[is-my-json-valid] ReDoS via 'style' format

👉 https://hackerone.com/reports/909757

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #chalker
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 5:13pm (UTC)

Arbitrary code execution via untrusted schemas in is-my-json-valid

👉 https://hackerone.com/reports/894308

🔹 Severity: Medium
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #chalker
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 5:14pm (UTC)

Awesome XSS in Google docs via postMessage()

🎬 https://www.youtube.com/watch?v=aCexqB9qi70

🔹 Severity: Medium | 💰 4,133.70 USD
🔹 Reported To: Google
🔹 Reported By: #nikolay
🔹 State: 🟢 Resolved

XSS on Videos IA

👉 https://hackerone.com/reports/910427

🔹 Severity: Medium
🔹 Reported To: DuckDuckGo
🔹 Reported By: #capuzsec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 7:39pm (UTC)

curl overwrites local file with -J option if file non-readable, but file writable.

👉 https://hackerone.com/reports/926638

🔹 Severity: Medium
🔹 Reported To: curl
🔹 Reported By: #brumbrum
🔹 State: ⚪️ Informative
🔹 Disclosed: August 1, 2020, 4:46pm (UTC)