Content Spoofing

👉 https://hackerone.com/reports/841630

🔹 Severity: No Rating
🔹 Reported To: Acronis
🔹 Reported By: #full109tun
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 3:15pm (UTC)

Java: CWE-798 - Hardcoded AWS credentials

👉 https://hackerone.com/reports/956967

🔹 Severity: Low | 💰 1,000 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #luchua
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2020, 4:54pm (UTC)

Pre-auth Denial-of-Service in Dovecot RPA implementation

👉 https://hackerone.com/reports/866605

🔹 Severity: Medium | 💰 550 USD
🔹 Reported To: Open-Xchange
🔹 Reported By: #orange
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 6:43am (UTC)

Pre-auth buffer over-read in Dovecot NTLM implementation

👉 https://hackerone.com/reports/866597

🔹 Severity: Medium | 💰 550 USD
🔹 Reported To: Open-Xchange
🔹 Reported By: #orange
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 6:43am (UTC)

SSRF in imgur video GIF conversion

👉 https://hackerone.com/reports/247680

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: Imgur
🔹 Reported By: #justchillin
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:15am (UTC)

Stored XSS at APM applications listing

👉 https://hackerone.com/reports/530511

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:45am (UTC)

Stored XSS firing if the error occurs when trying to delete the APM app

👉 https://hackerone.com/reports/530871

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:46am (UTC)

User can run monitors at private locations, which he has no access to

👉 https://hackerone.com/reports/681001

🔹 Severity: High | 💰 3,000 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:52am (UTC)

Stored XSS at APM apps labels autocomplete dropdown (apps listing)

👉 https://hackerone.com/reports/534711

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:53am (UTC)

CSRF at acknowledging an incident

👉 https://hackerone.com/reports/512102

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:53am (UTC)

CSTI fix (#587829) bypass leading to stored XSS at plugins again

👉 https://hackerone.com/reports/629113

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:57am (UTC)

CSTI at Plugin page leading to active stored XSS (Publisher name)

👉 https://hackerone.com/reports/587829

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:57am (UTC)

Stored XSS firing at the "Add chart to note" popup

👉 https://hackerone.com/reports/566400

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:58am (UTC)

Stored XSS at APM key transactions list

👉 https://hackerone.com/reports/567468

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:58am (UTC)

Stored XSS firing at transaction map (applicationName field)

👉 https://hackerone.com/reports/549084

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:58am (UTC)

Urgent! Stored XSS at plugin's violations leading to account takeover

👉 https://hackerone.com/reports/602527

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:59am (UTC)

Site-wide clickjacking at IE11

👉 https://hackerone.com/reports/614947

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:59am (UTC)

CSRF at adding new role (user-management.service.newrelic.com)

👉 https://hackerone.com/reports/504782

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:04am (UTC)

Stored XSS at Mobile (Versions tab)

👉 https://hackerone.com/reports/706533

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:04am (UTC)

Cross-account stored XSS at notes (through "swf" note parameter)

👉 https://hackerone.com/reports/710535

🔹 Severity: High | 💰 2,000 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:05am (UTC)

Unsafe charts embedding implementation leads to cross-account stored XSS and SSRF

👉 https://hackerone.com/reports/708589

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:06am (UTC)