XSS on Videos IA

👉 https://hackerone.com/reports/910427

🔹 Severity: Medium
🔹 Reported To: DuckDuckGo
🔹 Reported By: #capuzsec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2020, 7:39pm (UTC)

curl overwrites local file with -J option if file non-readable, but file writable.

👉 https://hackerone.com/reports/926638

🔹 Severity: Medium
🔹 Reported To: curl
🔹 Reported By: #brumbrum
🔹 State: ⚪️ Informative
🔹 Disclosed: August 1, 2020, 4:46pm (UTC)

Get-based SSRF limited to HTTP protocol on https://resizer.line-apps.com/form

👉 https://hackerone.com/reports/707014

🔹 Severity: Medium | 💰 1,350 USD
🔹 Reported To: LINE
🔹 Reported By: #ledz1996
🔹 State: 🟢 Resolved
🔹 Disclosed: August 2, 2020, 7:10am (UTC)

Facebook - Reputation Sync For #267890541047618

👉 https://hackerone.com/reports/896019

🔹 Severity: Low | 💰 1,000 USD
🔹 Reported To: Facebook
🔹 Reported By: #yashrs
🔹 State: 🟢 Resolved
🔹 Disclosed: August 2, 2020, 9:30am (UTC)

Anonymous file drop page ignores user profile visibility restrictions

👉 https://hackerone.com/reports/752353

🔹 Severity: No Rating
🔹 Reported To: Nextcloud
🔹 Reported By: #pshknst
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 8:27am (UTC)

relap.io IDOR

👉 https://hackerone.com/reports/749887

🔹 Severity: Low | 💰 750 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #shuraros
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 9:39am (UTC)

Account takeover through password reset in cups.mail.ru

👉 https://hackerone.com/reports/843160

🔹 Severity: High | 💰 1,500 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #weev3kyaw
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 9:53am (UTC)

Reflected XSS in "keywords" parameter at "https://sbermarket.ru/metro/search"

👉 https://hackerone.com/reports/898344

🔹 Severity: Medium
🔹 Reported To: Mail.ru
🔹 Reported By: #mehulpanchal007
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 10:05am (UTC)

xss on [storehouse5.ucs.ru]

👉 https://hackerone.com/reports/900573

🔹 Severity: Low
🔹 Reported To: Mail.ru
🔹 Reported By: #pisarenko
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 10:09am (UTC)

xss while uploading a file

👉 https://hackerone.com/reports/915346

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #aslanemre
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 10:10am (UTC)

Open Redirect at "city-mobil.ru"

👉 https://hackerone.com/reports/919241

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #kursadalsan
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 10:12am (UTC)

Insufficient access control on all BCRM instances leading to the ability to create admin accounts using the API

👉 https://hackerone.com/reports/836081

🔹 Severity: High | 💰 4,750 USD
🔹 Reported To: LINE
🔹 Reported By: #j0eii
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 10:48am (UTC)

Unrestricted file upload leads to Stored XSS

👉 https://hackerone.com/reports/880099

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: GitLab
🔹 Reported By: #semsem123
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 12:26pm (UTC)

Private list members disclosure via GraphQL

👉 https://hackerone.com/reports/885539

🔹 Severity: Low | 💰 2,940 USD
🔹 Reported To: Twitter
🔹 Reported By: #ryotak
🔹 State: 🟢 Resolved
🔹 Disclosed: August 4, 2020, 1:25am (UTC)

Spring Actuator endpoints publicly available, leading to account takeover

👉 https://hackerone.com/reports/862589

🔹 Severity: Critical | 💰 5,000 USD
🔹 Reported To: LINE
🔹 Reported By: #kazan71p
🔹 State: 🟢 Resolved
🔹 Disclosed: August 4, 2020, 2:52am (UTC)

Stored XSS in blob viewer

👉 https://hackerone.com/reports/806571

🔹 Severity: Medium | 💰 2,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #yvvdwf
🔹 State: 🟢 Resolved
🔹 Disclosed: August 4, 2020, 9:46am (UTC)

Time-base SQL Injection in Search Users

👉 https://hackerone.com/reports/876800

🔹 Severity: Medium
🔹 Reported To: concrete5
🔹 Reported By: #thiennv
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2020, 1:08am (UTC)

XSS in image metadata field

👉 https://hackerone.com/reports/896511

🔹 Severity: Medium
🔹 Reported To: Nextcloud
🔹 Reported By: #yzy9951
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2020, 7:04am (UTC)

Arbitrary code execution in desktop client via OpenSSL config

👉 https://hackerone.com/reports/622170

🔹 Severity: Medium
🔹 Reported To: Nextcloud
🔹 Reported By: #l00ph0le
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2020, 8:50am (UTC)

S3 bucket data at http://rockset-support.s3-us-west-2.amazonaws.com/ reveals user addresses based on latitudes and longitudes.

👉 https://hackerone.com/reports/947725

🔹 Severity: High
🔹 Reported To: Rockset
🔹 Reported By: #thatquasar
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2020, 2:38pm (UTC)

Send Phishing/Spam email from support@sameroom.io to any email address.

👉 https://hackerone.com/reports/840688

🔹 Severity: High
🔹 Reported To: 8x8
🔹 Reported By: #wisp
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2020, 10:34pm (UTC)