LDAP injection vulnerability in Java

👉 https://hackerone.com/reports/956295

🔹 Severity: Critical | 💰 2,500 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #grzegol
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2020, 6:20pm (UTC)

Improper access control allows sales only user to view bank balance of company accounts.

👉 https://hackerone.com/reports/906328

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Visma Public
🔹 Reported By: #vapour
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 8:44am (UTC)

A sales only user can edit the purchase invoice drafts.

👉 https://hackerone.com/reports/918938

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Visma Public
🔹 Reported By: #vapour
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 8:44am (UTC)

information disclosure via IDOR on "https://target.my.com/api/v2/coverage/segment.json?id={id}" endpoint

👉 https://hackerone.com/reports/763258

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #shuraros
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 9:53am (UTC)

tracker.my.com information disclosure via csrf bypass

👉 https://hackerone.com/reports/748538

🔹 Severity: Low
🔹 Reported To: Mail.ru
🔹 Reported By: #shuraros
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 9:56am (UTC)

[c-api.city-mobil.ru] IDOR chat messages between driver and customer

👉 https://hackerone.com/reports/850637

🔹 Severity: No Rating | 💰 150 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #anyday
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 10:43am (UTC)

Vertical Privilege Escalation on {target.my.com}

👉 https://hackerone.com/reports/854973

🔹 Severity: Medium
🔹 Reported To: Mail.ru
🔹 Reported By: #dedsec69
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 2:44pm (UTC)

Subdomain takeover at msproject.geekbrains.ru

👉 https://hackerone.com/reports/922506

🔹 Severity: Medium
🔹 Reported To: Mail.ru
🔹 Reported By: #steal_wart
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 2:46pm (UTC)

Bypass OTP on contact back request at https://driver.city-mobil.ru/

👉 https://hackerone.com/reports/926228

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #nitin1205
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 2:48pm (UTC)

[performancemarketing.geekbrains.ru] Tilda Subdomain Takeover

👉 https://hackerone.com/reports/928602

🔹 Severity: Low
🔹 Reported To: Mail.ru
🔹 Reported By: #xaleraf4ra
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 2:49pm (UTC)

DOM based Cross-site Scripting

👉 https://hackerone.com/reports/954613

🔹 Severity: Medium
🔹 Reported To: BugPoC
🔹 Reported By: #ivarsvids
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 2:58pm (UTC)

XSS Challenge #2 Solution

👉 https://hackerone.com/reports/953873

🔹 Severity: No Rating
🔹 Reported To: BugPoC
🔹 Reported By: #bad5ect0r
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 3:11pm (UTC)

Content Spoofing

👉 https://hackerone.com/reports/841630

🔹 Severity: No Rating
🔹 Reported To: Acronis
🔹 Reported By: #full109tun
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 3:15pm (UTC)

Java: CWE-798 - Hardcoded AWS credentials

👉 https://hackerone.com/reports/956967

🔹 Severity: Low | 💰 1,000 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #luchua
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 4:54pm (UTC)

Pre-auth Denial-of-Service in Dovecot RPA implementation

👉 https://hackerone.com/reports/866605

🔹 Severity: Medium | 💰 550 USD
🔹 Reported To: Open-Xchange
🔹 Reported By: #orange
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 6:43am (UTC)

Pre-auth buffer over-read in Dovecot NTLM implementation

👉 https://hackerone.com/reports/866597

🔹 Severity: Medium | 💰 550 USD
🔹 Reported To: Open-Xchange
🔹 Reported By: #orange
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 6:43am (UTC)

SSRF in imgur video GIF conversion

👉 https://hackerone.com/reports/247680

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: Imgur
🔹 Reported By: #justchillin
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:15am (UTC)

Stored XSS at APM applications listing

👉 https://hackerone.com/reports/530511

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:45am (UTC)

Stored XSS firing if the error occurs when trying to delete the APM app

👉 https://hackerone.com/reports/530871

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:46am (UTC)

User can run monitors at private locations, which he has no access to

👉 https://hackerone.com/reports/681001

🔹 Severity: High | 💰 3,000 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:52am (UTC)

Stored XSS at APM apps labels autocomplete dropdown (apps listing)

👉 https://hackerone.com/reports/534711

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:53am (UTC)