Memory Leak in OCUtil.dll library in Desktop client can lead to DoS

👉 https://hackerone.com/reports/588562

🔹 Severity: Medium
🔹 Reported To: Nextcloud
🔹 Reported By: #cwave
🔹 State: 🟢 Resolved
🔹 Disclosed: August 6, 2020, 1:56pm (UTC)

[wappalyzer] ReDoS allows an attacker to completely break Wappalyzer

👉 https://hackerone.com/reports/888030

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #vrechson
🔹 State: 🟢 Resolved
🔹 Disclosed: August 6, 2020, 10:56pm (UTC)

Lack of Input sanitization leads to database Character encoding configuration Disclosure

👉 https://hackerone.com/reports/866271

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Unikrn
🔹 Reported By: #l_user
🔹 State: 🟢 Resolved
🔹 Disclosed: August 7, 2020, 8:48am (UTC)

Full Read SSRF on Gitlab's Internal Grafana

👉 https://hackerone.com/reports/878779

🔹 Severity: Critical | 💰 12,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #rhynorater
🔹 State: 🟢 Resolved
🔹 Disclosed: August 7, 2020, 1:48pm (UTC)

Server-Side Request Forgery in "icons.bitwarden.net"

👉 https://hackerone.com/reports/913276

🔹 Severity: Medium
🔹 Reported To: Bitwarden
🔹 Reported By: #njgadhiya
🔹 State: 🟢 Resolved
🔹 Disclosed: August 7, 2020, 2:39pm (UTC)

Blind stored XSS due to insecure contact form at https://www.topcoder.com leads to leakage of session token and other PII

👉 https://hackerone.com/reports/878145

🔹 Severity: High
🔹 Reported To: Topcoder
🔹 Reported By: #mase289
🔹 State: 🟢 Resolved
🔹 Disclosed: August 7, 2020, 5:17pm (UTC)

Improper use of "path" parameter can be used to trick testers into leaking their Front-End PoC

👉 https://hackerone.com/reports/926221

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: BugPoC
🔹 Reported By: #acut3
🔹 State: 🟢 Resolved
🔹 Disclosed: August 7, 2020, 7:12pm (UTC)

Availing Zomato gold by using a random third-party `wallet_id`

👉 https://hackerone.com/reports/938021

🔹 Severity: Critical | 💰 2,000 USD
🔹 Reported To: Zomato
🔹 Reported By: #pandaaaa
🔹 State: 🟢 Resolved
🔹 Disclosed: August 7, 2020, 7:42pm (UTC)

Ability to manipulate price with a max threshold of `<1 Rupee` in support rider parameter

👉 https://hackerone.com/reports/927661

🔹 Severity: Low | 💰 150 USD
🔹 Reported To: Zomato
🔹 Reported By: #0xdexter
🔹 State: 🟢 Resolved
🔹 Disclosed: August 8, 2020, 7:36am (UTC)

Access control on https://eaccounting.stage.vismaonline.com/

👉 https://hackerone.com/reports/812143

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Visma Public
🔹 Reported By: #brdoors3
🔹 State: 🟢 Resolved
🔹 Disclosed: August 9, 2020, 7:57pm (UTC)

Solr Injection in `user_id` parameter at :/v2/leaderboard_v2.json

👉 https://hackerone.com/reports/952501

🔹 Severity: Critical | 💰 2,000 USD
🔹 Reported To: Zomato
🔹 Reported By: #zzzhacker13
🔹 State: 🟢 Resolved
🔹 Disclosed: August 10, 2020, 7:50am (UTC)

Unauthenticated users can access all food.grammarly.io user's data

👉 https://hackerone.com/reports/745495

🔹 Severity: Low | 💰 1,000 USD
🔹 Reported To: Grammarly
🔹 Reported By: #cript0nauta
🔹 State: 🟢 Resolved
🔹 Disclosed: August 10, 2020, 10:10am (UTC)

[www.zomato.com] Abusing LocalParams (city) to Inject SOLR query

👉 https://hackerone.com/reports/844428

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Zomato
🔹 Reported By: #zzzhacker13
🔹 State: 🟢 Resolved
🔹 Disclosed: August 10, 2020, 1:23pm (UTC)

[www.zomato.com] Blind SQL Injection in /php/geto2banner

👉 https://hackerone.com/reports/838855

🔹 Severity: Critical | 💰 2,000 USD
🔹 Reported To: Zomato
🔹 Reported By: #zzzhacker13
🔹 State: 🟢 Resolved
🔹 Disclosed: August 10, 2020, 1:27pm (UTC)

[www.zomato.com] Blind SQL Injection in /php/widgets_handler.php

👉 https://hackerone.com/reports/836079

🔹 Severity: Critical | 💰 2,000 USD
🔹 Reported To: Zomato
🔹 Reported By: #zzzhacker13
🔹 State: 🟢 Resolved
🔹 Disclosed: August 10, 2020, 1:38pm (UTC)

[api.zomato.com] Abusing LocalParams (city_id) to Inject SOLR query

👉 https://hackerone.com/reports/953203

🔹 Severity: Low | 💰 150 USD
🔹 Reported To: Zomato
🔹 Reported By: #zzzhacker13
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2020, 8:34am (UTC)

Missing authorization allows sales only user to record payment.

👉 https://hackerone.com/reports/919008

🔹 Severity: Medium | 💰 250 USD
🔹 Reported To: Visma Public
🔹 Reported By: #vapour
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2020, 9:46am (UTC)

Lack of Password Confirmation for Account Deletion

👉 https://hackerone.com/reports/950471

🔹 Severity: No Rating
🔹 Reported To: Zomato
🔹 Reported By: #cybrot
🔹 State: 🔴 N/A
🔹 Disclosed: August 11, 2020, 12:22pm (UTC)

Golang : Improvements to Golang SSRF query

👉 https://hackerone.com/reports/956296

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #porcupineyhairs
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2020, 6:20pm (UTC)

LDAP injection vulnerability in Java

👉 https://hackerone.com/reports/956295

🔹 Severity: Critical | 💰 2,500 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #grzegol
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2020, 6:20pm (UTC)

Improper access control allows sales only user to view bank balance of company accounts.

👉 https://hackerone.com/reports/906328

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Visma Public
🔹 Reported By: #vapour
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 8:44am (UTC)