Get analytics token using only apps permission

👉 https://hackerone.com/reports/901775

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #jmp_35p
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 9:29pm (UTC)

Some store settings/data are accessible to "No Access" permission users on GraphQL LiveView operation

👉 https://hackerone.com/reports/409973

🔹 Severity: No Rating | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #tolo7010
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 10:09pm (UTC)

Korea - Reflected XSS on https://www.istarbucks.co.kr/app/getGiftStock.do via "skuNo" and "skuImgUrl" parameters

👉 https://hackerone.com/reports/768345

🔹 Severity: Medium | 💰 250 USD
🔹 Reported To: Starbucks
🔹 Reported By: #rexvuz
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 10:38pm (UTC)

Password reset link not expired at Stocky App

👉 https://hackerone.com/reports/898841

🔹 Severity: No Rating | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #ayyoub
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 10:53pm (UTC)

I.D.O.R TO EDIT ALL USER'S CREDIT CARD INFORMATION+(Partial credit card info disclosure)

👉 https://hackerone.com/reports/361984

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Yelp
🔹 Reported By: #hk755a
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 12:59am (UTC)

I.D.O.R To Order,Book,Buy,reserve On YELP FOR FREE (UNAUTHORIZED USE OF OTHER USER'S CREDIT CARD)

👉 https://hackerone.com/reports/391092

🔹 Severity: Critical | 💰 2,500 USD
🔹 Reported To: Yelp
🔹 Reported By: #hk755a
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 1:11am (UTC)

CRITICAL Insecure Direct Object Reference (I.D.O.R) - Link Other User's Credit Card

👉 https://hackerone.com/reports/358143

🔹 Severity: High | 💰 2,000 USD
🔹 Reported To: Yelp
🔹 Reported By: #hk755a
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 1:26am (UTC)

Buffer overflow In hl.exe's launch -game argument allows an attacker to execute arbitrary code locally or from browser

👉 https://hackerone.com/reports/832750

🔹 Severity: High | 💰 1,150 USD
🔹 Reported To: Valve
🔹 Reported By: #irukandjisecresearch
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 3:20am (UTC)

[GoldSrc] RCE via malformed BSP file

👉 https://hackerone.com/reports/763403

🔹 Severity: High | 💰 450 USD
🔹 Reported To: Valve
🔹 Reported By: #gamer7112
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 3:29am (UTC)

[GoldSrc] RCE via 'spk' Console Command

👉 https://hackerone.com/reports/769014

🔹 Severity: High | 💰 350 USD
🔹 Reported To: Valve
🔹 Reported By: #gamer7112
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 4:37am (UTC)

Denial of Service when entring an Array in email at seetings

👉 https://hackerone.com/reports/961997

🔹 Severity: Medium
🔹 Reported To: Nextcloud
🔹 Reported By: #ja3far
🔹 State: ⚪️ Informative
🔹 Disclosed: August 19, 2020, 11:02am (UTC)

Missing SPF Records

👉 https://hackerone.com/reports/652447

🔹 Severity: Medium
🔹 Reported To: Avito
🔹 Reported By: #harshita174
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 1:15pm (UTC)

IDOR at [https://dropcontact.firstpromote] which allows an UNAUTHORIZED user to ACCESS and EDIT Paypal GMAIL by Changing the ID.

👉 https://hackerone.com/reports/959697

🔹 Severity: High
🔹 Reported To: Dropcontact
🔹 Reported By: #try___for_impossible
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 10:13am (UTC)

Rate Limit too lenient for endpoint sending emails

👉 https://hackerone.com/reports/658089

🔹 Severity: No Rating
🔹 Reported To: WakaTime
🔹 Reported By: #harshita174
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 3:11pm (UTC)

Ability to generate shipping labels in another store orders

👉 https://hackerone.com/reports/884159

🔹 Severity: No Rating | 💰 1,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #francisbeaudoin
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 5:58pm (UTC)

[vboxmanage.js] Command Injection via insecure command concatenation

👉 https://hackerone.com/reports/864777

🔹 Severity: Critical
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 9:08am (UTC)

[object-path-set] Prototype pollution

👉 https://hackerone.com/reports/878332

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 9:08am (UTC)

[extra-ffmpeg] Command Injection via insecure command formatting

👉 https://hackerone.com/reports/863944

🔹 Severity: Critical
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 9:08am (UTC)

[supermixer] Prototype pollution

👉 https://hackerone.com/reports/959987

🔹 Severity: No Rating
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #0x1337r00t
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 11:10am (UTC)

Insufficient validation on Digits bridge

👉 https://hackerone.com/reports/168116

🔹 Severity: No Rating | 💰 5,040 USD
🔹 Reported To: Twitter
🔹 Reported By: #filedescriptor
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 11:20am (UTC)

API key is not validated for C.R.M integration [Pipedrive] of LOGGED IN USER, A user can use another USER'S API key for this operation.

👉 https://hackerone.com/reports/962033

🔹 Severity: Medium
🔹 Reported To: Dropcontact
🔹 Reported By: #try___for_impossible
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 2:16pm (UTC)