Pre-auth Denial-of-Service in Dovecot RPA implementation

👉 https://hackerone.com/reports/866605

🔹 Severity: Medium | 💰 550 USD
🔹 Reported To: Open-Xchange
🔹 Reported By: #orange
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 6:43am (UTC)

Pre-auth buffer over-read in Dovecot NTLM implementation

👉 https://hackerone.com/reports/866597

🔹 Severity: Medium | 💰 550 USD
🔹 Reported To: Open-Xchange
🔹 Reported By: #orange
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 6:43am (UTC)

SSRF in imgur video GIF conversion

👉 https://hackerone.com/reports/247680

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: Imgur
🔹 Reported By: #justchillin
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:15am (UTC)

Stored XSS at APM applications listing

👉 https://hackerone.com/reports/530511

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:45am (UTC)

Stored XSS firing if the error occurs when trying to delete the APM app

👉 https://hackerone.com/reports/530871

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:46am (UTC)

User can run monitors at private locations, which he has no access to

👉 https://hackerone.com/reports/681001

🔹 Severity: High | 💰 3,000 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:52am (UTC)

Stored XSS at APM apps labels autocomplete dropdown (apps listing)

👉 https://hackerone.com/reports/534711

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:53am (UTC)

CSRF at acknowledging an incident

👉 https://hackerone.com/reports/512102

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:53am (UTC)

CSTI fix (#587829) bypass leading to stored XSS at plugins again

👉 https://hackerone.com/reports/629113

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:57am (UTC)

CSTI at Plugin page leading to active stored XSS (Publisher name)

👉 https://hackerone.com/reports/587829

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:57am (UTC)

Stored XSS firing at the "Add chart to note" popup

👉 https://hackerone.com/reports/566400

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:58am (UTC)

Stored XSS at APM key transactions list

👉 https://hackerone.com/reports/567468

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:58am (UTC)

Stored XSS firing at transaction map (applicationName field)

👉 https://hackerone.com/reports/549084

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:58am (UTC)

Urgent! Stored XSS at plugin's violations leading to account takeover

👉 https://hackerone.com/reports/602527

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:59am (UTC)

Site-wide clickjacking at IE11

👉 https://hackerone.com/reports/614947

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:59am (UTC)

CSRF at adding new role (user-management.service.newrelic.com)

👉 https://hackerone.com/reports/504782

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:04am (UTC)

Stored XSS at Mobile (Versions tab)

👉 https://hackerone.com/reports/706533

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:04am (UTC)

Cross-account stored XSS at notes (through "swf" note parameter)

👉 https://hackerone.com/reports/710535

🔹 Severity: High | 💰 2,000 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:05am (UTC)

Unsafe charts embedding implementation leads to cross-account stored XSS and SSRF

👉 https://hackerone.com/reports/708589

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:06am (UTC)

Passive stored XSS at Synthetics job result page (View resource)

👉 https://hackerone.com/reports/690536

🔹 Severity: Medium | 💰 1,075 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:10am (UTC)

Stored XSS in notes (charts) because of insecure chart data JSON generation

👉 https://hackerone.com/reports/507132

🔹 Severity: High | 💰 4,250 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:27pm (UTC)