relap.io IDOR

👉 https://hackerone.com/reports/749887

🔹 Severity: Low | 💰 750 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #shuraros
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 9:39am (UTC)

Account takeover through password reset in cups.mail.ru

👉 https://hackerone.com/reports/843160

🔹 Severity: High | 💰 1,500 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #weev3kyaw
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 9:53am (UTC)

Reflected XSS in "keywords" parameter at "https://sbermarket.ru/metro/search"

👉 https://hackerone.com/reports/898344

🔹 Severity: Medium
🔹 Reported To: Mail.ru
🔹 Reported By: #mehulpanchal007
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 10:05am (UTC)

xss on [storehouse5.ucs.ru]

👉 https://hackerone.com/reports/900573

🔹 Severity: Low
🔹 Reported To: Mail.ru
🔹 Reported By: #pisarenko
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 10:09am (UTC)

xss while uploading a file

👉 https://hackerone.com/reports/915346

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #aslanemre
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 10:10am (UTC)

Open Redirect at "city-mobil.ru"

👉 https://hackerone.com/reports/919241

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #kursadalsan
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 10:12am (UTC)

Insufficient access control on all BCRM instances leading to the ability to create admin accounts using the API

👉 https://hackerone.com/reports/836081

🔹 Severity: High | 💰 4,750 USD
🔹 Reported To: LINE
🔹 Reported By: #j0eii
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 10:48am (UTC)

Unrestricted file upload leads to Stored XSS

👉 https://hackerone.com/reports/880099

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: GitLab
🔹 Reported By: #semsem123
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2020, 12:26pm (UTC)

Private list members disclosure via GraphQL

👉 https://hackerone.com/reports/885539

🔹 Severity: Low | 💰 2,940 USD
🔹 Reported To: Twitter
🔹 Reported By: #ryotak
🔹 State: 🟢 Resolved
🔹 Disclosed: August 4, 2020, 1:25am (UTC)

Spring Actuator endpoints publicly available, leading to account takeover

👉 https://hackerone.com/reports/862589

🔹 Severity: Critical | 💰 5,000 USD
🔹 Reported To: LINE
🔹 Reported By: #kazan71p
🔹 State: 🟢 Resolved
🔹 Disclosed: August 4, 2020, 2:52am (UTC)

Stored XSS in blob viewer

👉 https://hackerone.com/reports/806571

🔹 Severity: Medium | 💰 2,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #yvvdwf
🔹 State: 🟢 Resolved
🔹 Disclosed: August 4, 2020, 9:46am (UTC)

Time-base SQL Injection in Search Users

👉 https://hackerone.com/reports/876800

🔹 Severity: Medium
🔹 Reported To: concrete5
🔹 Reported By: #thiennv
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2020, 1:08am (UTC)

XSS in image metadata field

👉 https://hackerone.com/reports/896511

🔹 Severity: Medium
🔹 Reported To: Nextcloud
🔹 Reported By: #yzy9951
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2020, 7:04am (UTC)

Arbitrary code execution in desktop client via OpenSSL config

👉 https://hackerone.com/reports/622170

🔹 Severity: Medium
🔹 Reported To: Nextcloud
🔹 Reported By: #l00ph0le
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2020, 8:50am (UTC)

S3 bucket data at http://rockset-support.s3-us-west-2.amazonaws.com/ reveals user addresses based on latitudes and longitudes.

👉 https://hackerone.com/reports/947725

🔹 Severity: High
🔹 Reported To: Rockset
🔹 Reported By: #thatquasar
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2020, 2:38pm (UTC)

Send Phishing/Spam email from support@sameroom.io to any email address.

👉 https://hackerone.com/reports/840688

🔹 Severity: High
🔹 Reported To: 8x8
🔹 Reported By: #wisp
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2020, 10:34pm (UTC)

Spring Actuator endpoints publicly available and broken authentication

👉 https://hackerone.com/reports/838635

🔹 Severity: Critical | 💰 12,500 USD
🔹 Reported To: LINE
🔹 Reported By: #kazan71p
🔹 State: 🟢 Resolved
🔹 Disclosed: August 6, 2020, 5:13am (UTC)

Memory Leak in OCUtil.dll library in Desktop client can lead to DoS

👉 https://hackerone.com/reports/588562

🔹 Severity: Medium
🔹 Reported To: Nextcloud
🔹 Reported By: #cwave
🔹 State: 🟢 Resolved
🔹 Disclosed: August 6, 2020, 1:56pm (UTC)

[wappalyzer] ReDoS allows an attacker to completely break Wappalyzer

👉 https://hackerone.com/reports/888030

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #vrechson
🔹 State: 🟢 Resolved
🔹 Disclosed: August 6, 2020, 10:56pm (UTC)

Lack of Input sanitization leads to database Character encoding configuration Disclosure

👉 https://hackerone.com/reports/866271

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Unikrn
🔹 Reported By: #l_user
🔹 State: 🟢 Resolved
🔹 Disclosed: August 7, 2020, 8:48am (UTC)

Full Read SSRF on Gitlab's Internal Grafana

👉 https://hackerone.com/reports/878779

🔹 Severity: Critical | 💰 12,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #rhynorater
🔹 State: 🟢 Resolved
🔹 Disclosed: August 7, 2020, 1:48pm (UTC)