Stored XSS firing at transaction map (applicationName field)

👉 https://hackerone.com/reports/549084

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:58am (UTC)

Urgent! Stored XSS at plugin's violations leading to account takeover

👉 https://hackerone.com/reports/602527

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:59am (UTC)

Site-wide clickjacking at IE11

👉 https://hackerone.com/reports/614947

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 10:59am (UTC)

CSRF at adding new role (user-management.service.newrelic.com)

👉 https://hackerone.com/reports/504782

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:04am (UTC)

Stored XSS at Mobile (Versions tab)

👉 https://hackerone.com/reports/706533

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:04am (UTC)

Cross-account stored XSS at notes (through "swf" note parameter)

👉 https://hackerone.com/reports/710535

🔹 Severity: High | 💰 2,000 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:05am (UTC)

Unsafe charts embedding implementation leads to cross-account stored XSS and SSRF

👉 https://hackerone.com/reports/708589

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:06am (UTC)

Passive stored XSS at Synthetics job result page (View resource)

👉 https://hackerone.com/reports/690536

🔹 Severity: Medium | 💰 1,075 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:10am (UTC)

Stored XSS in notes (charts) because of insecure chart data JSON generation

👉 https://hackerone.com/reports/507132

🔹 Severity: High | 💰 4,250 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:27pm (UTC)

NR-wide cross account access through misconfigured CORS-policy of multiple endpoints

👉 https://hackerone.com/reports/751699

🔹 Severity: High | 💰 3,125 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:30pm (UTC)

Disclosure of locally served nerdpacks due to nr-local.net CORS policy misconfiguration

👉 https://hackerone.com/reports/746786

🔹 Severity: Low | 💰 625 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:31pm (UTC)

Stored admin-to-owner XSS at infrastructure alerts runbook URL leading to account takeover by malicious admin

👉 https://hackerone.com/reports/605845

🔹 Severity: Medium | 💰 1,337 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:32pm (UTC)

Stored XSS on recruit.innogames.de

👉 https://hackerone.com/reports/917250

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: InnoGames
🔹 Reported By: #aeswagyewgyes
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:42pm (UTC)

Ability to run monitors' jobs of other accounts and to read these jobs content (including the secure credentials values)

👉 https://hackerone.com/reports/787886

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:45pm (UTC)

Cross-account stored XSS at embedded charts

👉 https://hackerone.com/reports/709883

🔹 Severity: High | 💰 3,625 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:47pm (UTC)

Stored XSS at APM transaction map (transactionName field)

👉 https://hackerone.com/reports/667770

🔹 Severity: Medium | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:48pm (UTC)

One Click Remote Code Injection - *.blog.newrelic.com

👉 https://hackerone.com/reports/941421

🔹 Severity: Medium | 💰 506 USD
🔹 Reported To: New Relic
🔹 Reported By: #arsene_lupin
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:14pm (UTC)

Secure credentials values disclosure to regular users due to access control issue in monitor creating function

👉 https://hackerone.com/reports/788499

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:19pm (UTC)

Attacker can create new account inside any partnership with no approve from the Partnership owner

👉 https://hackerone.com/reports/786109

🔹 Severity: Medium | 💰 695 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:26pm (UTC)

Stored XSS at Synthetics private locations (planted through location label or description)

👉 https://hackerone.com/reports/680240

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:29pm (UTC)

Restricted user can manage the NerdGraph entities' tags

👉 https://hackerone.com/reports/757957

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:30pm (UTC)