Path Traversal in App Proxy

👉 https://hackerone.com/reports/869888

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #ngalog
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2020, 10:27pm (UTC)

Prototype pollution attack (lodash)

👉 https://hackerone.com/reports/841380

🔹 Severity: Medium
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #macasun
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2020, 9:26am (UTC)

Recently added 'Country' field doesn't send email notification when changed

👉 https://hackerone.com/reports/961841

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: HackerOne
🔹 Reported By: #bugra
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2020, 10:57am (UTC)

Ability to see password protected content by bypassing the password page of shopify preview URL for new development stores (as of August 17, 2020)

👉 https://hackerone.com/reports/961929

🔹 Severity: No Rating | 💰 1,500 USD
🔹 Reported To: Shopify
🔹 Reported By: #saltymermaid
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2020, 3:55pm (UTC)

Stored XSS on Broken Themes via filename

👉 https://hackerone.com/reports/406289

🔹 Severity: Low | 💰 300 USD
🔹 Reported To: WordPress
🔹 Reported By: #apapedulimu
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2020, 3:56pm (UTC)

Self XSS in Timeline

👉 https://hackerone.com/reports/854299

🔹 Severity: No Rating | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #ryat
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2020, 5:04pm (UTC)

Script Editor preview token still working with uninstalled application, even for unpublished script

👉 https://hackerone.com/reports/915940

🔹 Severity: No Rating | 💰 2,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #francisbeaudoin
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2020, 9:34pm (UTC)

[json-bigint] DoS via `__proto__` assignment

👉 https://hackerone.com/reports/916430

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #chalker
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2020, 10:40pm (UTC)

[min-http-server] List any file in the folder by using path traversal.

👉 https://hackerone.com/reports/569891

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #toannc123
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 2:20am (UTC)

Information disclosure to "Permission as auditor" user

👉 https://hackerone.com/reports/959897

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Visma Public
🔹 Reported By: #risinghunter
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 5:09am (UTC)

[New Relic Infrastructure] Restricted User can still integrate with AWS via forced browsing (plus, a few other bugs)

👉 https://hackerone.com/reports/255685

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 10:51am (UTC)

[NR Synthetics] Restricted user can view synthetics monitors and user permissions through .json endpoint at /permissions/securablemetadata/{GROUP ID}

👉 https://hackerone.com/reports/320689

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 10:54am (UTC)

Adding a new user discloses their full name in the "Users" section of NR Alerts notification channels page

👉 https://hackerone.com/reports/344309

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 10:57am (UTC)

Internal API endpoint discloses full account name of email address associated with unconfirmed user

👉 https://hackerone.com/reports/332381

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 10:59am (UTC)

Initial mirror user can be assigned by other user even if the mirror was removed

👉 https://hackerone.com/reports/819821

🔹 Severity: Medium | 💰 3,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #sky003
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 1:52pm (UTC)

Stealing data from customers.gitlab.com without user interaction

👉 https://hackerone.com/reports/674195

🔹 Severity: High | 💰 3,500 USD
🔹 Reported To: GitLab
🔹 Reported By: #rpadovani
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 2:02pm (UTC)

Privilege escalation from any user (including external) to gitlab admin when admin impersonates you

👉 https://hackerone.com/reports/493324

🔹 Severity: Critical | 💰 10,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 2:10pm (UTC)

An attacker can run pipeline jobs as arbitrary user

👉 https://hackerone.com/reports/894569

🔹 Severity: Critical | 💰 12,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #u3mur4
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 2:11pm (UTC)

Stored XSS in "Create Groups"

👉 https://hackerone.com/reports/647130

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: GitLab
🔹 Reported By: #rioncool22
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 2:15pm (UTC)

Graphql: Sorting the reports by jira_status field resulted to different value

👉 https://hackerone.com/reports/955286

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: HackerOne
🔹 Reported By: #0619
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2020, 8:27am (UTC)

Stored XSS in eaccounting.stage.vismaonline.com

👉 https://hackerone.com/reports/897523

🔹 Severity: Medium | 💰 250 USD
🔹 Reported To: Visma Public
🔹 Reported By: #4mat
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2020, 10:26am (UTC)