Stored XSS at APM transaction map (transactionName field)

👉 https://hackerone.com/reports/667770

🔹 Severity: Medium | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 1:48pm (UTC)

One Click Remote Code Injection - *.blog.newrelic.com

👉 https://hackerone.com/reports/941421

🔹 Severity: Medium | 💰 506 USD
🔹 Reported To: New Relic
🔹 Reported By: #arsene_lupin
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:14pm (UTC)

Secure credentials values disclosure to regular users due to access control issue in monitor creating function

👉 https://hackerone.com/reports/788499

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:19pm (UTC)

Attacker can create new account inside any partnership with no approve from the Partnership owner

👉 https://hackerone.com/reports/786109

🔹 Severity: Medium | 💰 695 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:26pm (UTC)

Stored XSS at Synthetics private locations (planted through location label or description)

👉 https://hackerone.com/reports/680240

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:29pm (UTC)

Restricted user can manage the NerdGraph entities' tags

👉 https://hackerone.com/reports/757957

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:30pm (UTC)

Cross-account reading of Insights dashboards through GraphQL

👉 https://hackerone.com/reports/765565

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:36pm (UTC)

Ability to buy PRO subscriptions by arbitrary reduced prices

👉 https://hackerone.com/reports/783688

🔹 Severity: Low | 💰 203 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:37pm (UTC)

Account owner/admin can't actually delete personal users' API keys

👉 https://hackerone.com/reports/782703

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:38pm (UTC)

Restricted user can update Apdex target for applications by leveraging the GraphQL mutation

👉 https://hackerone.com/reports/776449

🔹 Severity: Medium | 💰 626 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:39pm (UTC)

Restricted user can remove NerdStorage documents/collections scoped to ACCOUNT or ENTITY

👉 https://hackerone.com/reports/766145

🔹 Severity: Medium | 💰 600 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:40pm (UTC)

Restricted user can add and delete tags of APM key transactions

👉 https://hackerone.com/reports/638685

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 4:39pm (UTC)

IDOR allows accounts to view full name of other accounts based on email through share notes feature

👉 https://hackerone.com/reports/476958

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 4:40pm (UTC)

Bypass of #447975 - view mobile application token though "Application Information" sidebar on Installation page

👉 https://hackerone.com/reports/479139

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 4:40pm (UTC)

https://█████ is vulnerable to CVE-2020-3452 Read-Only Path Traversal Vulnerability

👉 https://hackerone.com/reports/940384

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #they
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 6:08pm (UTC)

Path traversal on https://███ allows arbitrary file read (CVE-2020-3452)

👉 https://hackerone.com/reports/936399

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #un4gi
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 6:09pm (UTC)

Remote Code Execution via CVE-2019-18935

👉 https://hackerone.com/reports/913695

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #un4gi
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 6:11pm (UTC)

Stored XSS Via NRQL chartbuilder JSON view

👉 https://hackerone.com/reports/634692

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 6:56pm (UTC)

Missing memory corruption protection on Windows release built

👉 https://hackerone.com/reports/380102

🔹 Severity: Medium | 💰 50 USD
🔹 Reported To: Nextcloud
🔹 Reported By: #secconsult
🔹 State: 🟢 Resolved
🔹 Disclosed: August 14, 2020, 6:21am (UTC)

Default Creds Spring Boot Admin

👉 https://hackerone.com/reports/954818

🔹 Severity: High
🔹 Reported To: 8x8
🔹 Reported By: #testingforbugs
🔹 State: 🟢 Resolved
🔹 Disclosed: August 14, 2020, 5:01pm (UTC)

Arbitrary code execution via untrusted schemas in ajv

👉 https://hackerone.com/reports/897974

🔹 Severity: Low
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #chalker
🔹 State: 🟢 Resolved
🔹 Disclosed: August 14, 2020, 5:21pm (UTC)