Stored XSS via "my recent queries" selector in NRQL dashboard builder

👉 https://hackerone.com/reports/626082

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 2:58pm (UTC)

NRQL Query allows restricted user to pull all data from Synthetics monitors without having read permissions enabled

👉 https://hackerone.com/reports/387290

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 3:00pm (UTC)

Restricted user can view all account invoices, payment method details, PII of account owner through zoura_api endpoints

👉 https://hackerone.com/reports/501672

🔹 Severity: Medium | 💰 900 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 3:01pm (UTC)

(Prerelease UI) Stored XSS via role name in JSON chart

👉 https://hackerone.com/reports/520630

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 3:03pm (UTC)

Restricted user is able to delete filter sets of admin users in https://infrastructure.newrelic.com/accounts/{{ACC#}}/settings/filterSets

👉 https://hackerone.com/reports/202501

🔹 Severity: Medium | 💰 250 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 3:07pm (UTC)

SSO bypass in zendesk using trint organization able to leak internal ticket information

👉 https://hackerone.com/reports/734936

🔹 Severity: High
🔹 Reported To: Trint Ltd
🔹 Reported By: #dopaminedetox
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 3:43pm (UTC)

increased privileges on staff account

👉 https://hackerone.com/reports/911857

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: Shopify
🔹 Reported By: #jaka_tingkir
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 4:05pm (UTC)

xss stored in https://your store.myshopify.com/admin/

👉 https://hackerone.com/reports/887879

🔹 Severity: Low | 💰 1,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #zwail
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 4:08pm (UTC)

Subdomain takeover in help.tictail.com pointing to Zendesk (a Shopify acquisition)

👉 https://hackerone.com/reports/869605

🔹 Severity: Medium
🔹 Reported To: Shopify
🔹 Reported By: #meow-hacker-meow
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 4:17pm (UTC)

*.shopify.com - Authentication bypass

👉 https://hackerone.com/reports/838231

🔹 Severity: No Rating
🔹 Reported To: Shopify
🔹 Reported By: #nooblife
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 4:18pm (UTC)

STAFF "No-Permissions" on the Store can retrieve the details Order via exchangeReceiptSend

👉 https://hackerone.com/reports/917875

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #langduvnsec
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 4:41pm (UTC)

[com.smule.autorap.*] Cloud Messaging/Push Notification service takeover due to clear-text usage of Legacy FCM Server keys in the client app

👉 https://hackerone.com/reports/789370

🔹 Severity: Critical
🔹 Reported To: Smule
🔹 Reported By: #absshax
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 7:27pm (UTC)

Stocky App Administrator can create a backdoor admin account by using an existing POS User

👉 https://hackerone.com/reports/962895

🔹 Severity: No Rating | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #francisbeaudoin
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 9:58pm (UTC)

[windows-edge] RCE via insecure command formatting

👉 https://hackerone.com/reports/878420

🔹 Severity: Critical
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #mik317
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 10:04pm (UTC)

Path Traversal in App Proxy

👉 https://hackerone.com/reports/869888

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #ngalog
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 10:27pm (UTC)

Prototype pollution attack (lodash)

👉 https://hackerone.com/reports/841380

🔹 Severity: Medium
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #macasun
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2020, 9:26am (UTC)

Recently added 'Country' field doesn't send email notification when changed

👉 https://hackerone.com/reports/961841

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: HackerOne
🔹 Reported By: #bugra
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2020, 10:57am (UTC)

Ability to see password protected content by bypassing the password page of shopify preview URL for new development stores (as of August 17, 2020)

👉 https://hackerone.com/reports/961929

🔹 Severity: No Rating | 💰 1,500 USD
🔹 Reported To: Shopify
🔹 Reported By: #saltymermaid
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2020, 3:55pm (UTC)

Stored XSS on Broken Themes via filename

👉 https://hackerone.com/reports/406289

🔹 Severity: Low | 💰 300 USD
🔹 Reported To: WordPress
🔹 Reported By: #apapedulimu
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2020, 3:56pm (UTC)

Self XSS in Timeline

👉 https://hackerone.com/reports/854299

🔹 Severity: No Rating | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #ryat
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2020, 5:04pm (UTC)

Script Editor preview token still working with uninstalled application, even for unpublished script

👉 https://hackerone.com/reports/915940

🔹 Severity: No Rating | 💰 2,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #francisbeaudoin
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2020, 9:34pm (UTC)