Availing Zomato gold by using a random third-party `wallet_id`

👉 https://hackerone.com/reports/938021

🔹 Severity: Critical | 💰 2,000 USD
🔹 Reported To: Zomato
🔹 Reported By: #pandaaaa
🔹 State: 🟢 Resolved
🔹 Disclosed: August 7, 2020, 7:42pm (UTC)

Ability to manipulate price with a max threshold of `<1 Rupee` in support rider parameter

👉 https://hackerone.com/reports/927661

🔹 Severity: Low | 💰 150 USD
🔹 Reported To: Zomato
🔹 Reported By: #0xdexter
🔹 State: 🟢 Resolved
🔹 Disclosed: August 8, 2020, 7:36am (UTC)

Access control on https://eaccounting.stage.vismaonline.com/

👉 https://hackerone.com/reports/812143

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Visma Public
🔹 Reported By: #brdoors3
🔹 State: 🟢 Resolved
🔹 Disclosed: August 9, 2020, 7:57pm (UTC)

Solr Injection in `user_id` parameter at :/v2/leaderboard_v2.json

👉 https://hackerone.com/reports/952501

🔹 Severity: Critical | 💰 2,000 USD
🔹 Reported To: Zomato
🔹 Reported By: #zzzhacker13
🔹 State: 🟢 Resolved
🔹 Disclosed: August 10, 2020, 7:50am (UTC)

Unauthenticated users can access all food.grammarly.io user's data

👉 https://hackerone.com/reports/745495

🔹 Severity: Low | 💰 1,000 USD
🔹 Reported To: Grammarly
🔹 Reported By: #cript0nauta
🔹 State: 🟢 Resolved
🔹 Disclosed: August 10, 2020, 10:10am (UTC)

[www.zomato.com] Abusing LocalParams (city) to Inject SOLR query

👉 https://hackerone.com/reports/844428

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Zomato
🔹 Reported By: #zzzhacker13
🔹 State: 🟢 Resolved
🔹 Disclosed: August 10, 2020, 1:23pm (UTC)

[www.zomato.com] Blind SQL Injection in /php/geto2banner

👉 https://hackerone.com/reports/838855

🔹 Severity: Critical | 💰 2,000 USD
🔹 Reported To: Zomato
🔹 Reported By: #zzzhacker13
🔹 State: 🟢 Resolved
🔹 Disclosed: August 10, 2020, 1:27pm (UTC)

[www.zomato.com] Blind SQL Injection in /php/widgets_handler.php

👉 https://hackerone.com/reports/836079

🔹 Severity: Critical | 💰 2,000 USD
🔹 Reported To: Zomato
🔹 Reported By: #zzzhacker13
🔹 State: 🟢 Resolved
🔹 Disclosed: August 10, 2020, 1:38pm (UTC)

[api.zomato.com] Abusing LocalParams (city_id) to Inject SOLR query

👉 https://hackerone.com/reports/953203

🔹 Severity: Low | 💰 150 USD
🔹 Reported To: Zomato
🔹 Reported By: #zzzhacker13
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2020, 8:34am (UTC)

Missing authorization allows sales only user to record payment.

👉 https://hackerone.com/reports/919008

🔹 Severity: Medium | 💰 250 USD
🔹 Reported To: Visma Public
🔹 Reported By: #vapour
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2020, 9:46am (UTC)

Lack of Password Confirmation for Account Deletion

👉 https://hackerone.com/reports/950471

🔹 Severity: No Rating
🔹 Reported To: Zomato
🔹 Reported By: #cybrot
🔹 State: 🔴 N/A
🔹 Disclosed: August 11, 2020, 12:22pm (UTC)

Golang : Improvements to Golang SSRF query

👉 https://hackerone.com/reports/956296

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #porcupineyhairs
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2020, 6:20pm (UTC)

LDAP injection vulnerability in Java

👉 https://hackerone.com/reports/956295

🔹 Severity: Critical | 💰 2,500 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #grzegol
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2020, 6:20pm (UTC)

Improper access control allows sales only user to view bank balance of company accounts.

👉 https://hackerone.com/reports/906328

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Visma Public
🔹 Reported By: #vapour
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 8:44am (UTC)

A sales only user can edit the purchase invoice drafts.

👉 https://hackerone.com/reports/918938

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Visma Public
🔹 Reported By: #vapour
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 8:44am (UTC)

information disclosure via IDOR on "https://target.my.com/api/v2/coverage/segment.json?id={id}" endpoint

👉 https://hackerone.com/reports/763258

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #shuraros
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 9:53am (UTC)

tracker.my.com information disclosure via csrf bypass

👉 https://hackerone.com/reports/748538

🔹 Severity: Low
🔹 Reported To: Mail.ru
🔹 Reported By: #shuraros
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 9:56am (UTC)

[c-api.city-mobil.ru] IDOR chat messages between driver and customer

👉 https://hackerone.com/reports/850637

🔹 Severity: No Rating | 💰 150 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #anyday
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 10:43am (UTC)

Vertical Privilege Escalation on {target.my.com}

👉 https://hackerone.com/reports/854973

🔹 Severity: Medium
🔹 Reported To: Mail.ru
🔹 Reported By: #dedsec69
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 2:44pm (UTC)

Subdomain takeover at msproject.geekbrains.ru

👉 https://hackerone.com/reports/922506

🔹 Severity: Medium
🔹 Reported To: Mail.ru
🔹 Reported By: #steal_wart
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 2:46pm (UTC)

Bypass OTP on contact back request at https://driver.city-mobil.ru/

👉 https://hackerone.com/reports/926228

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #nitin1205
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 2:48pm (UTC)