Rate Limit too lenient for endpoint sending emails

👉 https://hackerone.com/reports/658089

🔹 Severity: No Rating
🔹 Reported To: WakaTime
🔹 Reported By: #harshita174
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 3:11pm (UTC)

Ability to generate shipping labels in another store orders

👉 https://hackerone.com/reports/884159

🔹 Severity: No Rating | 💰 1,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #francisbeaudoin
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2020, 5:58pm (UTC)

[vboxmanage.js] Command Injection via insecure command concatenation

👉 https://hackerone.com/reports/864777

🔹 Severity: Critical
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 9:08am (UTC)

[object-path-set] Prototype pollution

👉 https://hackerone.com/reports/878332

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 9:08am (UTC)

[extra-ffmpeg] Command Injection via insecure command formatting

👉 https://hackerone.com/reports/863944

🔹 Severity: Critical
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 9:08am (UTC)

[supermixer] Prototype pollution

👉 https://hackerone.com/reports/959987

🔹 Severity: No Rating
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #0x1337r00t
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 11:10am (UTC)

Insufficient validation on Digits bridge

👉 https://hackerone.com/reports/168116

🔹 Severity: No Rating | 💰 5,040 USD
🔹 Reported To: Twitter
🔹 Reported By: #filedescriptor
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 11:20am (UTC)

API key is not validated for C.R.M integration [Pipedrive] of LOGGED IN USER, A user can use another USER'S API key for this operation.

👉 https://hackerone.com/reports/962033

🔹 Severity: Medium
🔹 Reported To: Dropcontact
🔹 Reported By: #try___for_impossible
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 2:16pm (UTC)

DOM XSS on duckduckgo.com search

👉 https://hackerone.com/reports/921635

🔹 Severity: Medium
🔹 Reported To: DuckDuckGo
🔹 Reported By: #sijisu
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 3:49pm (UTC)

Dropcontact's disclosed report is exposing Private/Confidential information

👉 https://hackerone.com/reports/963327

🔹 Severity: High
🔹 Reported To: Dropcontact
🔹 Reported By: #n1m0
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 4:16pm (UTC)

Java: CWE-522 Insecure basic authentication

👉 https://hackerone.com/reports/963815

🔹 Severity: High | 💰 2,300 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #luchua
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 9:51pm (UTC)

Registering with email [ +70 Chars ] Lead to Disclose some informations [Django Debug Mode ]

👉 https://hackerone.com/reports/963584

🔹 Severity: Medium
🔹 Reported To: Dropcontact
🔹 Reported By: #elmahdi
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 7:41am (UTC)

Information Disclosure through DEBUG at Subscription [https://app.dropcontact.io/app/subscription?connector=salesforce](CRITICAL)

👉 https://hackerone.com/reports/963921

🔹 Severity: Critical
🔹 Reported To: Dropcontact
🔹 Reported By: #try___for_impossible
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 7:53am (UTC)

[javascript] CWE-117: CodeQL query to detect Log Injection

👉 https://hackerone.com/reports/963816

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 9:51pm (UTC)

Django DEBUG mode enabled and leaked system information.

👉 https://hackerone.com/reports/963542

🔹 Severity: High
🔹 Reported To: Dropcontact
🔹 Reported By: #aungkyawphyo
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 8:12am (UTC)

Prototype Pollution lodash 4.17.15

👉 https://hackerone.com/reports/864701

🔹 Severity: High | 💰 250 USD
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #awarau
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 10:34am (UTC)

Sensitive Information Disclosure

👉 https://hackerone.com/reports/963352

🔹 Severity: Critical
🔹 Reported To: Dropcontact
🔹 Reported By: #exploit_db
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 1:19pm (UTC)

Django should not have debug mode enabled

👉 https://hackerone.com/reports/963809

🔹 Severity: Low
🔹 Reported To: Dropcontact
🔹 Reported By: #higbee
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 2:38pm (UTC)

Django debug enabled showing information about system, database, configuration files.

👉 https://hackerone.com/reports/963164

🔹 Severity: Low
🔹 Reported To: Dropcontact
🔹 Reported By: #vbdev
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 7:52pm (UTC)

Unauthorized Use of Victim Credit Card

👉 https://hackerone.com/reports/391385

🔹 Severity: High | 💰 400 USD
🔹 Reported To: Yelp
🔹 Reported By: #hk755a
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 8:20pm (UTC)

ClickJacking on IMPORTANT Functions of Yelp

👉 https://hackerone.com/reports/305128

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: Yelp
🔹 Reported By: #hk755a
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 8:41pm (UTC)