Path traversal in filename in LINE Mac client

👉 https://hackerone.com/reports/727727

🔹 Severity: High | 💰 2,785 USD
🔹 Reported To: LINE
🔹 Reported By: #hackerontwowheels
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 9:32am (UTC)

Reverse Tabnabbing in printing source document images

👉 https://hackerone.com/reports/911123

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Visma Public
🔹 Reported By: #artebels
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 12:40pm (UTC)

[is-my-json-valid] ReDoS via 'style' format

👉 https://hackerone.com/reports/909757

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #chalker
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 5:13pm (UTC)

Arbitrary code execution via untrusted schemas in is-my-json-valid

👉 https://hackerone.com/reports/894308

🔹 Severity: Medium
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #chalker
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 5:14pm (UTC)

Awesome XSS in Google docs via postMessage()

🎬 https://www.youtube.com/watch?v=aCexqB9qi70

🔹 Severity: Medium | 💰 4,133.70 USD
🔹 Reported To: Google
🔹 Reported By: #nikolay
🔹 State: 🟢 Resolved

XSS on Videos IA

👉 https://hackerone.com/reports/910427

🔹 Severity: Medium
🔹 Reported To: DuckDuckGo
🔹 Reported By: #capuzsec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 7:39pm (UTC)

curl overwrites local file with -J option if file non-readable, but file writable.

👉 https://hackerone.com/reports/926638

🔹 Severity: Medium
🔹 Reported To: curl
🔹 Reported By: #brumbrum
🔹 State: ⚪️ Informative
🔹 Disclosed: August 1, 2020, 4:46pm (UTC)

Get-based SSRF limited to HTTP protocol on https://resizer.line-apps.com/form

👉 https://hackerone.com/reports/707014

🔹 Severity: Medium | 💰 1,350 USD
🔹 Reported To: LINE
🔹 Reported By: #ledz1996
🔹 State: 🟢 Resolved
🔹 Disclosed: August 2, 2020, 7:10am (UTC)

Facebook - Reputation Sync For #267890541047618

👉 https://hackerone.com/reports/896019

🔹 Severity: Low | 💰 1,000 USD
🔹 Reported To: Facebook
🔹 Reported By: #yashrs
🔹 State: 🟢 Resolved
🔹 Disclosed: August 2, 2020, 9:30am (UTC)

Anonymous file drop page ignores user profile visibility restrictions

👉 https://hackerone.com/reports/752353

🔹 Severity: No Rating
🔹 Reported To: Nextcloud
🔹 Reported By: #pshknst
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 8:27am (UTC)

relap.io IDOR

👉 https://hackerone.com/reports/749887

🔹 Severity: Low | 💰 750 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #shuraros
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 9:39am (UTC)

Account takeover through password reset in cups.mail.ru

👉 https://hackerone.com/reports/843160

🔹 Severity: High | 💰 1,500 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #weev3kyaw
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 9:53am (UTC)

Reflected XSS in "keywords" parameter at "https://sbermarket.ru/metro/search"

👉 https://hackerone.com/reports/898344

🔹 Severity: Medium
🔹 Reported To: Mail.ru
🔹 Reported By: #mehulpanchal007
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 10:05am (UTC)

xss on [storehouse5.ucs.ru]

👉 https://hackerone.com/reports/900573

🔹 Severity: Low
🔹 Reported To: Mail.ru
🔹 Reported By: #pisarenko
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 10:09am (UTC)

xss while uploading a file

👉 https://hackerone.com/reports/915346

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #aslanemre
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 10:10am (UTC)

Open Redirect at "city-mobil.ru"

👉 https://hackerone.com/reports/919241

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #kursadalsan
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 10:12am (UTC)

Insufficient access control on all BCRM instances leading to the ability to create admin accounts using the API

👉 https://hackerone.com/reports/836081

🔹 Severity: High | 💰 4,750 USD
🔹 Reported To: LINE
🔹 Reported By: #j0eii
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 10:48am (UTC)

Unrestricted file upload leads to Stored XSS

👉 https://hackerone.com/reports/880099

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: GitLab
🔹 Reported By: #semsem123
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 12:26pm (UTC)

Private list members disclosure via GraphQL

👉 https://hackerone.com/reports/885539

🔹 Severity: Low | 💰 2,940 USD
🔹 Reported To: Twitter
🔹 Reported By: #ryotak
🔹 State: 🟢 Resolved
🔹 Disclosed: August 4, 2020, 1:25am (UTC)

Spring Actuator endpoints publicly available, leading to account takeover

👉 https://hackerone.com/reports/862589

🔹 Severity: Critical | 💰 5,000 USD
🔹 Reported To: LINE
🔹 Reported By: #kazan71p
🔹 State: 🟢 Resolved
🔹 Disclosed: August 4, 2020, 2:52am (UTC)

Stored XSS in blob viewer

👉 https://hackerone.com/reports/806571

🔹 Severity: Medium | 💰 2,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #yvvdwf
🔹 State: 🟢 Resolved
🔹 Disclosed: August 4, 2020, 9:46am (UTC)