NR-wide cross account access through misconfigured CORS-policy of multiple endpoints

👉 https://hackerone.com/reports/751699

🔹 Severity: High | 💰 3,125 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:30pm (UTC)

Disclosure of locally served nerdpacks due to nr-local.net CORS policy misconfiguration

👉 https://hackerone.com/reports/746786

🔹 Severity: Low | 💰 625 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:31pm (UTC)

Stored admin-to-owner XSS at infrastructure alerts runbook URL leading to account takeover by malicious admin

👉 https://hackerone.com/reports/605845

🔹 Severity: Medium | 💰 1,337 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:32pm (UTC)

Stored XSS on recruit.innogames.de

👉 https://hackerone.com/reports/917250

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: InnoGames
🔹 Reported By: #aeswagyewgyes
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:42pm (UTC)

Ability to run monitors' jobs of other accounts and to read these jobs content (including the secure credentials values)

👉 https://hackerone.com/reports/787886

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:45pm (UTC)

Cross-account stored XSS at embedded charts

👉 https://hackerone.com/reports/709883

🔹 Severity: High | 💰 3,625 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:47pm (UTC)

Stored XSS at APM transaction map (transactionName field)

👉 https://hackerone.com/reports/667770

🔹 Severity: Medium | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:48pm (UTC)

One Click Remote Code Injection - *.blog.newrelic.com

👉 https://hackerone.com/reports/941421

🔹 Severity: Medium | 💰 506 USD
🔹 Reported To: New Relic
🔹 Reported By: #arsene_lupin
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:14pm (UTC)

Secure credentials values disclosure to regular users due to access control issue in monitor creating function

👉 https://hackerone.com/reports/788499

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:19pm (UTC)

Attacker can create new account inside any partnership with no approve from the Partnership owner

👉 https://hackerone.com/reports/786109

🔹 Severity: Medium | 💰 695 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:26pm (UTC)

Stored XSS at Synthetics private locations (planted through location label or description)

👉 https://hackerone.com/reports/680240

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:29pm (UTC)

Restricted user can manage the NerdGraph entities' tags

👉 https://hackerone.com/reports/757957

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:30pm (UTC)

Cross-account reading of Insights dashboards through GraphQL

👉 https://hackerone.com/reports/765565

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:36pm (UTC)

Ability to buy PRO subscriptions by arbitrary reduced prices

👉 https://hackerone.com/reports/783688

🔹 Severity: Low | 💰 203 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:37pm (UTC)

Account owner/admin can't actually delete personal users' API keys

👉 https://hackerone.com/reports/782703

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:38pm (UTC)

Restricted user can update Apdex target for applications by leveraging the GraphQL mutation

👉 https://hackerone.com/reports/776449

🔹 Severity: Medium | 💰 626 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:39pm (UTC)

Restricted user can remove NerdStorage documents/collections scoped to ACCOUNT or ENTITY

👉 https://hackerone.com/reports/766145

🔹 Severity: Medium | 💰 600 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:40pm (UTC)

Restricted user can add and delete tags of APM key transactions

👉 https://hackerone.com/reports/638685

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 4:39pm (UTC)

IDOR allows accounts to view full name of other accounts based on email through share notes feature

👉 https://hackerone.com/reports/476958

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 4:40pm (UTC)

Bypass of #447975 - view mobile application token though "Application Information" sidebar on Installation page

👉 https://hackerone.com/reports/479139

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 4:40pm (UTC)

https://█████ is vulnerable to CVE-2020-3452 Read-Only Path Traversal Vulnerability

👉 https://hackerone.com/reports/940384

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #they
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 6:08pm (UTC)