Information Disclosure through DEBUG at Subscription [https://app.dropcontact.io/app/subscription?connector=salesforce](CRITICAL)

👉 https://hackerone.com/reports/963921

🔹 Severity: Critical
🔹 Reported To: Dropcontact
🔹 Reported By: #try___for_impossible
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 7:53am (UTC)

[javascript] CWE-117: CodeQL query to detect Log Injection

👉 https://hackerone.com/reports/963816

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2020, 9:51pm (UTC)

Django DEBUG mode enabled and leaked system information.

👉 https://hackerone.com/reports/963542

🔹 Severity: High
🔹 Reported To: Dropcontact
🔹 Reported By: #aungkyawphyo
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 8:12am (UTC)

Prototype Pollution lodash 4.17.15

👉 https://hackerone.com/reports/864701

🔹 Severity: High | 💰 250 USD
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #awarau
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 10:34am (UTC)

Sensitive Information Disclosure

👉 https://hackerone.com/reports/963352

🔹 Severity: Critical
🔹 Reported To: Dropcontact
🔹 Reported By: #exploit_db
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 1:19pm (UTC)

Django should not have debug mode enabled

👉 https://hackerone.com/reports/963809

🔹 Severity: Low
🔹 Reported To: Dropcontact
🔹 Reported By: #higbee
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 2:38pm (UTC)

Django debug enabled showing information about system, database, configuration files.

👉 https://hackerone.com/reports/963164

🔹 Severity: Low
🔹 Reported To: Dropcontact
🔹 Reported By: #vbdev
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 7:52pm (UTC)

Unauthorized Use of Victim Credit Card

👉 https://hackerone.com/reports/391385

🔹 Severity: High | 💰 400 USD
🔹 Reported To: Yelp
🔹 Reported By: #hk755a
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 8:20pm (UTC)

ClickJacking on IMPORTANT Functions of Yelp

👉 https://hackerone.com/reports/305128

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: Yelp
🔹 Reported By: #hk755a
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 8:41pm (UTC)

CRITICAL-CLICKJACKING at Yelp Reservations Resulting in exposure of victim Private Data (Email info) + Victim Credit Card MissUse.

👉 https://hackerone.com/reports/355859

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Yelp
🔹 Reported By: #hk755a
🔹 State: 🟢 Resolved
🔹 Disclosed: August 21, 2020, 8:51pm (UTC)

[extra-asciinema] Command Injection via insecure command formatting

👉 https://hackerone.com/reports/863956

🔹 Severity: Critical
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: August 22, 2020, 8:48am (UTC)

[meemo-app] Denial of Service via LDAP Injection

👉 https://hackerone.com/reports/907311

🔹 Severity: Critical
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: August 22, 2020, 8:48am (UTC)

[cloudron-surfer] Denial of Service via LDAP Injection

👉 https://hackerone.com/reports/906959

🔹 Severity: Critical
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: August 22, 2020, 8:48am (UTC)

Pentester can obtain information about other pentesters who applied for the same test, but weren't accepted

👉 https://hackerone.com/reports/958374

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: HackerOne
🔹 Reported By: #haxta4ok00
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 9:39am (UTC)

User registration using public domain email like gmail in place of professional email.

👉 https://hackerone.com/reports/963546

🔹 Severity: Medium
🔹 Reported To: Dropcontact
🔹 Reported By: #cyc0rpion
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 10:21am (UTC)

Null dereference in mcht_relational_validate ext-relational-common.c:136

👉 https://hackerone.com/reports/894446

🔹 Severity: No Rating | 💰 50 USD
🔹 Reported To: Open-Xchange
🔹 Reported By: #catenacyber
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 11:42am (UTC)

No Valid SPF Records

👉 https://hackerone.com/reports/962909

🔹 Severity: Medium
🔹 Reported To: Dropcontact
🔹 Reported By: #harshita174
🔹 State: 🟤 Duplicate
🔹 Disclosed: August 24, 2020, 2:38pm (UTC)

Stored XSS via "my recent queries" selector in NRQL dashboard builder

👉 https://hackerone.com/reports/626082

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 2:58pm (UTC)

NRQL Query allows restricted user to pull all data from Synthetics monitors without having read permissions enabled

👉 https://hackerone.com/reports/387290

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 3:00pm (UTC)

Restricted user can view all account invoices, payment method details, PII of account owner through zoura_api endpoints

👉 https://hackerone.com/reports/501672

🔹 Severity: Medium | 💰 900 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 3:01pm (UTC)

(Prerelease UI) Stored XSS via role name in JSON chart

👉 https://hackerone.com/reports/520630

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 3:03pm (UTC)