[GoldSrc] RCE via 'spk' Console Command

👉 https://hackerone.com/reports/769014

🔹 Severity: High | 💰 350 USD
🔹 Reported To: Valve
🔹 Reported By: #gamer7112
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 4:37am (UTC)

Denial of Service when entring an Array in email at seetings

👉 https://hackerone.com/reports/961997

🔹 Severity: Medium
🔹 Reported To: Nextcloud
🔹 Reported By: #ja3far
🔹 State: ⚪️ Informative
🔹 Disclosed: August 19, 2020, 11:02am (UTC)

Missing SPF Records

👉 https://hackerone.com/reports/652447

🔹 Severity: Medium
🔹 Reported To: Avito
🔹 Reported By: #harshita174
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 1:15pm (UTC)

IDOR at [https://dropcontact.firstpromote] which allows an UNAUTHORIZED user to ACCESS and EDIT Paypal GMAIL by Changing the ID.

👉 https://hackerone.com/reports/959697

🔹 Severity: High
🔹 Reported To: Dropcontact
🔹 Reported By: #try___for_impossible
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2020, 10:13am (UTC)

Rate Limit too lenient for endpoint sending emails

👉 https://hackerone.com/reports/658089

🔹 Severity: No Rating
🔹 Reported To: WakaTime
🔹 Reported By: #harshita174
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 3:11pm (UTC)

Ability to generate shipping labels in another store orders

👉 https://hackerone.com/reports/884159

🔹 Severity: No Rating | 💰 1,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #francisbeaudoin
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 5:58pm (UTC)

[vboxmanage.js] Command Injection via insecure command concatenation

👉 https://hackerone.com/reports/864777

🔹 Severity: Critical
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 9:08am (UTC)

[object-path-set] Prototype pollution

👉 https://hackerone.com/reports/878332

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 9:08am (UTC)

[extra-ffmpeg] Command Injection via insecure command formatting

👉 https://hackerone.com/reports/863944

🔹 Severity: Critical
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 9:08am (UTC)

[supermixer] Prototype pollution

👉 https://hackerone.com/reports/959987

🔹 Severity: No Rating
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #0x1337r00t
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 11:10am (UTC)

Insufficient validation on Digits bridge

👉 https://hackerone.com/reports/168116

🔹 Severity: No Rating | 💰 5,040 USD
🔹 Reported To: Twitter
🔹 Reported By: #filedescriptor
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 11:20am (UTC)

API key is not validated for C.R.M integration [Pipedrive] of LOGGED IN USER, A user can use another USER'S API key for this operation.

👉 https://hackerone.com/reports/962033

🔹 Severity: Medium
🔹 Reported To: Dropcontact
🔹 Reported By: #try___for_impossible
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 2:16pm (UTC)

DOM XSS on duckduckgo.com search

👉 https://hackerone.com/reports/921635

🔹 Severity: Medium
🔹 Reported To: DuckDuckGo
🔹 Reported By: #sijisu
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 3:49pm (UTC)

Dropcontact's disclosed report is exposing Private/Confidential information

👉 https://hackerone.com/reports/963327

🔹 Severity: High
🔹 Reported To: Dropcontact
🔹 Reported By: #n1m0
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 4:16pm (UTC)

Java: CWE-522 Insecure basic authentication

👉 https://hackerone.com/reports/963815

🔹 Severity: High | 💰 2,300 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #luchua
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 9:51pm (UTC)

Registering with email [ +70 Chars ] Lead to Disclose some informations [Django Debug Mode ]

👉 https://hackerone.com/reports/963584

🔹 Severity: Medium
🔹 Reported To: Dropcontact
🔹 Reported By: #elmahdi
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 7:41am (UTC)

Information Disclosure through DEBUG at Subscription [https://app.dropcontact.io/app/subscription?connector=salesforce](CRITICAL)

👉 https://hackerone.com/reports/963921

🔹 Severity: Critical
🔹 Reported To: Dropcontact
🔹 Reported By: #try___for_impossible
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 7:53am (UTC)

[javascript] CWE-117: CodeQL query to detect Log Injection

👉 https://hackerone.com/reports/963816

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 9:51pm (UTC)

Django DEBUG mode enabled and leaked system information.

👉 https://hackerone.com/reports/963542

🔹 Severity: High
🔹 Reported To: Dropcontact
🔹 Reported By: #aungkyawphyo
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 8:12am (UTC)

Prototype Pollution lodash 4.17.15

👉 https://hackerone.com/reports/864701

🔹 Severity: High | 💰 250 USD
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #awarau
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 10:34am (UTC)

Sensitive Information Disclosure

👉 https://hackerone.com/reports/963352

🔹 Severity: Critical
🔹 Reported To: Dropcontact
🔹 Reported By: #exploit_db
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 1:19pm (UTC)