Internal API endpoint discloses full account name of email address associated with unconfirmed user

👉 https://hackerone.com/reports/332381

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 10:59am (UTC)

Initial mirror user can be assigned by other user even if the mirror was removed

👉 https://hackerone.com/reports/819821

🔹 Severity: Medium | 💰 3,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #sky003
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 1:52pm (UTC)

Stealing data from customers.gitlab.com without user interaction

👉 https://hackerone.com/reports/674195

🔹 Severity: High | 💰 3,500 USD
🔹 Reported To: GitLab
🔹 Reported By: #rpadovani
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 2:02pm (UTC)

Privilege escalation from any user (including external) to gitlab admin when admin impersonates you

👉 https://hackerone.com/reports/493324

🔹 Severity: Critical | 💰 10,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #skavans
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 2:10pm (UTC)

An attacker can run pipeline jobs as arbitrary user

👉 https://hackerone.com/reports/894569

🔹 Severity: Critical | 💰 12,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #u3mur4
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 2:11pm (UTC)

Stored XSS in "Create Groups"

👉 https://hackerone.com/reports/647130

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: GitLab
🔹 Reported By: #rioncool22
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2020, 2:15pm (UTC)

Graphql: Sorting the reports by jira_status field resulted to different value

👉 https://hackerone.com/reports/955286

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: HackerOne
🔹 Reported By: #0619
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2020, 8:27am (UTC)

Stored XSS in eaccounting.stage.vismaonline.com

👉 https://hackerone.com/reports/897523

🔹 Severity: Medium | 💰 250 USD
🔹 Reported To: Visma Public
🔹 Reported By: #4mat
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2020, 10:26am (UTC)

Null dereference in `cmd_denotify_operation_execute`

👉 https://hackerone.com/reports/965881

🔹 Severity: No Rating | 💰 50 USD
🔹 Reported To: Open-Xchange
🔹 Reported By: #catenacyber
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2020, 11:20am (UTC)

Assert failed in `edit_mail_istream_read`

👉 https://hackerone.com/reports/965790

🔹 Severity: No Rating | 💰 50 USD
🔹 Reported To: Open-Xchange
🔹 Reported By: #catenacyber
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2020, 11:20am (UTC)

Failed assert in `mail_index_transaction_lookup`

👉 https://hackerone.com/reports/965782

🔹 Severity: No Rating | 💰 50 USD
🔹 Reported To: Open-Xchange
🔹 Reported By: #catenacyber
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2020, 11:20am (UTC)

[bl] Uninitialized memory exposure via negative .consume()

👉 https://hackerone.com/reports/966347

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #chalker
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2020, 3:16pm (UTC)

notevil - Sandbox Escape Lead to RCE on Node.js and XSS in the Browser

👉 https://hackerone.com/reports/809012

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #phra
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2020, 4:14pm (UTC)

The authenticity_token can be reversed and used to forge valid per_form_csrf_tokens for arbitrary routes

👉 https://hackerone.com/reports/732415

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Ruby on Rails
🔹 Reported By: #jregele
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2020, 4:25pm (UTC)

CSV Injection Via Student Password/Name Leads To Client Side RCE And Reading Client Files

👉 https://hackerone.com/reports/943255

🔹 Severity: Medium
🔹 Reported To: Khan Academy
🔹 Reported By: #demonia
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2020, 6:56pm (UTC)

Ability to publish a paid theme without purchasing it.

👉 https://hackerone.com/reports/927567

🔹 Severity: Low | 💰 2,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #saltymermaid
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2020, 7:41pm (UTC)

Ability to publish a paid theme without purchasing it.

👉 https://hackerone.com/reports/953083

🔹 Severity: Low | 💰 2,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #saltymermaid
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2020, 7:42pm (UTC)

XSS from arbitrary attachment upload.

👉 https://hackerone.com/reports/831703

🔹 Severity: High
🔹 Reported To: Qulture.Rocks
🔹 Reported By: #wisp
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2020, 4:53am (UTC)

XSS via unicode characters in upload filename

👉 https://hackerone.com/reports/179695

🔹 Severity: Medium | 💰 600 USD
🔹 Reported To: WordPress
🔹 Reported By: #kahoots
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2020, 4:43pm (UTC)

Remote Code Execution in Slack desktop apps + bonus

👉 https://hackerone.com/reports/783877

🔹 Severity: Critical | 💰 1,750 USD
🔹 Reported To: Slack
🔹 Reported By: #oskarsv
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2020, 6:04pm (UTC)

Private leaderboard owner email disclosure when sending invites

👉 https://hackerone.com/reports/969988

🔹 Severity: No Rating
🔹 Reported To: WakaTime
🔹 Reported By: #hy76t56f565
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2020, 11:15pm (UTC)