Ability to buy PRO subscriptions by arbitrary reduced prices

👉 https://hackerone.com/reports/783688

🔹 Severity: Low | 💰 203 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:37pm (UTC)

Account owner/admin can't actually delete personal users' API keys

👉 https://hackerone.com/reports/782703

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:38pm (UTC)

Restricted user can update Apdex target for applications by leveraging the GraphQL mutation

👉 https://hackerone.com/reports/776449

🔹 Severity: Medium | 💰 626 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:39pm (UTC)

Restricted user can remove NerdStorage documents/collections scoped to ACCOUNT or ENTITY

👉 https://hackerone.com/reports/766145

🔹 Severity: Medium | 💰 600 USD
🔹 Reported To: New Relic
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 3:40pm (UTC)

Restricted user can add and delete tags of APM key transactions

👉 https://hackerone.com/reports/638685

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 4:39pm (UTC)

IDOR allows accounts to view full name of other accounts based on email through share notes feature

👉 https://hackerone.com/reports/476958

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 4:40pm (UTC)

Bypass of #447975 - view mobile application token though "Application Information" sidebar on Installation page

👉 https://hackerone.com/reports/479139

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 4:40pm (UTC)

https://█████ is vulnerable to CVE-2020-3452 Read-Only Path Traversal Vulnerability

👉 https://hackerone.com/reports/940384

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #they
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 6:08pm (UTC)

Path traversal on https://███ allows arbitrary file read (CVE-2020-3452)

👉 https://hackerone.com/reports/936399

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #un4gi
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 6:09pm (UTC)

Remote Code Execution via CVE-2019-18935

👉 https://hackerone.com/reports/913695

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #un4gi
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 6:11pm (UTC)

Stored XSS Via NRQL chartbuilder JSON view

👉 https://hackerone.com/reports/634692

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2020, 6:56pm (UTC)

Missing memory corruption protection on Windows release built

👉 https://hackerone.com/reports/380102

🔹 Severity: Medium | 💰 50 USD
🔹 Reported To: Nextcloud
🔹 Reported By: #secconsult
🔹 State: 🟢 Resolved
🔹 Disclosed: August 14, 2020, 6:21am (UTC)

Default Creds Spring Boot Admin

👉 https://hackerone.com/reports/954818

🔹 Severity: High
🔹 Reported To: 8x8
🔹 Reported By: #testingforbugs
🔹 State: 🟢 Resolved
🔹 Disclosed: August 14, 2020, 5:01pm (UTC)

Arbitrary code execution via untrusted schemas in ajv

👉 https://hackerone.com/reports/897974

🔹 Severity: Low
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #chalker
🔹 State: 🟢 Resolved
🔹 Disclosed: August 14, 2020, 5:21pm (UTC)

Denial-of- service By Cache Poisoning The Cross-Origin Resource Sharing Misconfiguration Allow Origin Header

👉 https://hackerone.com/reports/921704

🔹 Severity: Medium | 💰 200 USD
🔹 Reported To: Automattic
🔹 Reported By: #hannanhaseeb
🔹 State: 🟢 Resolved
🔹 Disclosed: August 14, 2020, 7:53pm (UTC)

HTML injection in email content

👉 https://hackerone.com/reports/786976

🔹 Severity: Medium
🔹 Reported To: Bitwala
🔹 Reported By: #lamscun
🔹 State: 🟢 Resolved
🔹 Disclosed: August 14, 2020, 8:01pm (UTC)

SVG file upload leads to XML injection

👉 https://hackerone.com/reports/845832

🔹 Severity: Low
🔹 Reported To: Topcoder
🔹 Reported By: #tushr
🔹 State: 🟢 Resolved
🔹 Disclosed: August 14, 2020, 9:43pm (UTC)

Solution for XSS challenge calc.buggywebsite.com

👉 https://hackerone.com/reports/954249

🔹 Severity: High
🔹 Reported To: BugPoC
🔹 Reported By: #d1r3wolf
🔹 State: 🟢 Resolved
🔹 Disclosed: August 15, 2020, 6:32pm (UTC)

Unrestricted File Upload in Chat Window

👉 https://hackerone.com/reports/925513

🔹 Severity: Medium
🔹 Reported To: OWOX, Inc.
🔹 Reported By: #ant_pyne
🔹 State: 🟢 Resolved
🔹 Disclosed: August 16, 2020, 6:35am (UTC)

XSS in desktop client via invalid server address on login form

👉 https://hackerone.com/reports/685552

🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: Nextcloud
🔹 Reported By: #jplopezy
🔹 State: 🟢 Resolved
🔹 Disclosed: August 17, 2020, 12:50am (UTC)

Authenticity token doesnt expire after single use leading to CSRF

👉 https://hackerone.com/reports/919112

🔹 Severity: No Rating
🔹 Reported To: Omise
🔹 Reported By: #justlife_4x4
🔹 State: ⚪️ Informative
🔹 Disclosed: August 17, 2020, 1:36am (UTC)