i don't the important and it's impact . the affected asset: https://github.com/solana-labs/solana/blob/master/.buildkite/env/secrets.ejson

👉 https://hackerone.com/reports/961175

🔹 Severity: Medium
🔹 Reported To: Solana BBP
🔹 Reported By: #hussein_mersal
🔹 State: 🟤 Duplicate
🔹 Disclosed: August 18, 2020, 2:47am (UTC)

Sensitive data leaks [username, password, keys]

👉 https://hackerone.com/reports/961170

🔹 Severity: Critical
🔹 Reported To: Solana BBP
🔹 Reported By: #anjpan
🔹 State: ⚪️ Informative
🔹 Disclosed: August 18, 2020, 3:02am (UTC)

Session not invalidated after password reset

👉 https://hackerone.com/reports/917213

🔹 Severity: Medium
🔹 Reported To: Gener8
🔹 Reported By: #5hu8h4m_n4g4
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 8:53am (UTC)

pre-auth Stored XSS in comments via javascript: url when administrator edits user supplied comment

👉 https://hackerone.com/reports/633231

🔹 Severity: High | 💰 650 USD
🔹 Reported To: WordPress
🔹 Reported By: #simonscannell
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 6:01pm (UTC)

Stored XSS in Post Preview as Contributor

👉 https://hackerone.com/reports/497724

🔹 Severity: Medium | 💰 650 USD
🔹 Reported To: WordPress
🔹 Reported By: #simonscannell
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 6:02pm (UTC)

Blind Stored XSS Via Staff Name

👉 https://hackerone.com/reports/948929

🔹 Severity: High | 💰 3,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #rioncool22
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 7:41pm (UTC)

access permission is not revoked even if the email has been deleted or changed on the partner account -partners.shopify-

👉 https://hackerone.com/reports/870001

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #jaka_tingkir
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 7:44pm (UTC)

OrderListInitial leaks order details

👉 https://hackerone.com/reports/882412

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: Shopify
🔹 Reported By: #sreeju_kc
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 7:52pm (UTC)

Get analytics token using only apps permission

👉 https://hackerone.com/reports/901775

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #jmp_35p
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 9:29pm (UTC)

Some store settings/data are accessible to "No Access" permission users on GraphQL LiveView operation

👉 https://hackerone.com/reports/409973

🔹 Severity: No Rating | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #tolo7010
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 10:09pm (UTC)

Korea - Reflected XSS on https://www.istarbucks.co.kr/app/getGiftStock.do via "skuNo" and "skuImgUrl" parameters

👉 https://hackerone.com/reports/768345

🔹 Severity: Medium | 💰 250 USD
🔹 Reported To: Starbucks
🔹 Reported By: #rexvuz
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 10:38pm (UTC)

Password reset link not expired at Stocky App

👉 https://hackerone.com/reports/898841

🔹 Severity: No Rating | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #ayyoub
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 10:53pm (UTC)

I.D.O.R TO EDIT ALL USER'S CREDIT CARD INFORMATION+(Partial credit card info disclosure)

👉 https://hackerone.com/reports/361984

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Yelp
🔹 Reported By: #hk755a
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 12:59am (UTC)

I.D.O.R To Order,Book,Buy,reserve On YELP FOR FREE (UNAUTHORIZED USE OF OTHER USER'S CREDIT CARD)

👉 https://hackerone.com/reports/391092

🔹 Severity: Critical | 💰 2,500 USD
🔹 Reported To: Yelp
🔹 Reported By: #hk755a
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 1:11am (UTC)

CRITICAL Insecure Direct Object Reference (I.D.O.R) - Link Other User's Credit Card

👉 https://hackerone.com/reports/358143

🔹 Severity: High | 💰 2,000 USD
🔹 Reported To: Yelp
🔹 Reported By: #hk755a
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 1:26am (UTC)

Buffer overflow In hl.exe's launch -game argument allows an attacker to execute arbitrary code locally or from browser

👉 https://hackerone.com/reports/832750

🔹 Severity: High | 💰 1,150 USD
🔹 Reported To: Valve
🔹 Reported By: #irukandjisecresearch
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 3:20am (UTC)

[GoldSrc] RCE via malformed BSP file

👉 https://hackerone.com/reports/763403

🔹 Severity: High | 💰 450 USD
🔹 Reported To: Valve
🔹 Reported By: #gamer7112
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 3:29am (UTC)

[GoldSrc] RCE via 'spk' Console Command

👉 https://hackerone.com/reports/769014

🔹 Severity: High | 💰 350 USD
🔹 Reported To: Valve
🔹 Reported By: #gamer7112
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 4:37am (UTC)

Denial of Service when entring an Array in email at seetings

👉 https://hackerone.com/reports/961997

🔹 Severity: Medium
🔹 Reported To: Nextcloud
🔹 Reported By: #ja3far
🔹 State: ⚪️ Informative
🔹 Disclosed: August 19, 2020, 11:02am (UTC)

Missing SPF Records

👉 https://hackerone.com/reports/652447

🔹 Severity: Medium
🔹 Reported To: Avito
🔹 Reported By: #harshita174
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 1:15pm (UTC)

IDOR at [https://dropcontact.firstpromote] which allows an UNAUTHORIZED user to ACCESS and EDIT Paypal GMAIL by Changing the ID.

👉 https://hackerone.com/reports/959697

🔹 Severity: High
🔹 Reported To: Dropcontact
🔹 Reported By: #try___for_impossible
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 10:13am (UTC)