Cross-account stored XSS at notes (through "swf" note parameter)

👉 https://hackerone.com/reports/710535

🔹 Severity: High | 💰 2,000 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:05am (UTC)

Unsafe charts embedding implementation leads to cross-account stored XSS and SSRF

👉 https://hackerone.com/reports/708589

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:06am (UTC)

Passive stored XSS at Synthetics job result page (View resource)

👉 https://hackerone.com/reports/690536

🔹 Severity: Medium | 💰 1,075 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 11:10am (UTC)

Stored XSS in notes (charts) because of insecure chart data JSON generation

👉 https://hackerone.com/reports/507132

🔹 Severity: High | 💰 4,250 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:27pm (UTC)

NR-wide cross account access through misconfigured CORS-policy of multiple endpoints

👉 https://hackerone.com/reports/751699

🔹 Severity: High | 💰 3,125 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:30pm (UTC)

Disclosure of locally served nerdpacks due to nr-local.net CORS policy misconfiguration

👉 https://hackerone.com/reports/746786

🔹 Severity: Low | 💰 625 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:31pm (UTC)

Stored admin-to-owner XSS at infrastructure alerts runbook URL leading to account takeover by malicious admin

👉 https://hackerone.com/reports/605845

🔹 Severity: Medium | 💰 1,337 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:32pm (UTC)

Stored XSS on recruit.innogames.de

👉 https://hackerone.com/reports/917250

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: InnoGames
🔹 Reported By: #aeswagyewgyes
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:42pm (UTC)

Ability to run monitors' jobs of other accounts and to read these jobs content (including the secure credentials values)

👉 https://hackerone.com/reports/787886

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:45pm (UTC)

Cross-account stored XSS at embedded charts

👉 https://hackerone.com/reports/709883

🔹 Severity: High | 💰 3,625 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:47pm (UTC)

Stored XSS at APM transaction map (transactionName field)

👉 https://hackerone.com/reports/667770

🔹 Severity: Medium | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:48pm (UTC)

One Click Remote Code Injection - *.blog.newrelic.com

👉 https://hackerone.com/reports/941421

🔹 Severity: Medium | 💰 506 USD
🔹 Reported To: New Relic
🔹 Reported By: #arsene_lupin
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:14pm (UTC)

Secure credentials values disclosure to regular users due to access control issue in monitor creating function

👉 https://hackerone.com/reports/788499

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:19pm (UTC)

Attacker can create new account inside any partnership with no approve from the Partnership owner

👉 https://hackerone.com/reports/786109

🔹 Severity: Medium | 💰 695 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:26pm (UTC)

Stored XSS at Synthetics private locations (planted through location label or description)

👉 https://hackerone.com/reports/680240

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:29pm (UTC)

Restricted user can manage the NerdGraph entities' tags

👉 https://hackerone.com/reports/757957

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:30pm (UTC)

Cross-account reading of Insights dashboards through GraphQL

👉 https://hackerone.com/reports/765565

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:36pm (UTC)

Ability to buy PRO subscriptions by arbitrary reduced prices

👉 https://hackerone.com/reports/783688

🔹 Severity: Low | 💰 203 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:37pm (UTC)

Account owner/admin can't actually delete personal users' API keys

👉 https://hackerone.com/reports/782703

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:38pm (UTC)

Restricted user can update Apdex target for applications by leveraging the GraphQL mutation

👉 https://hackerone.com/reports/776449

🔹 Severity: Medium | 💰 626 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:39pm (UTC)

Restricted user can remove NerdStorage documents/collections scoped to ACCOUNT or ENTITY

👉 https://hackerone.com/reports/766145

🔹 Severity: Medium | 💰 600 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:40pm (UTC)