Сode injection host █████████

👉 https://hackerone.com/reports/954398

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #e3xpl0it
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2020, 5:27pm (UTC)

Subdomain takeover due to an unclaimed Amazon S3 bucket on ███

👉 https://hackerone.com/reports/918946

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #chron0x
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2020, 5:29pm (UTC)

Local Privilege Escalation on Dropbox Desktop for Windows

👉 https://hackerone.com/reports/773571

🔹 Severity: Medium
🔹 Reported To: Dropbox
🔹 Reported By: #tesitura
🔹 State: 🟤 Duplicate
🔹 Disclosed: September 3, 2020, 6:50pm (UTC)

Cross-origin resource sharing misconfiguration (CORS)

👉 https://hackerone.com/reports/954512

🔹 Severity: Low
🔹 Reported To: Brave Software
🔹 Reported By: #drwx
🔹 State: ⚪️ Informative
🔹 Disclosed: September 4, 2020, 12:34am (UTC)

CodeQL query to detect XSLT injections

👉 https://hackerone.com/reports/974368

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #grzegol
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2020, 9:56pm (UTC)

[CATENACYBER]: [CPP] CWE-476 Null Pointer Dereference : Another query to either missing or redundant NULL check

👉 https://hackerone.com/reports/974370

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #catenacyber
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2020, 9:56pm (UTC)

Query to find TLS configurations supporting hardcoded insecure versions of the protocol and cipher suites

👉 https://hackerone.com/reports/974369

🔹 Severity: High | 💰 2,300 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #logicmap
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2020, 9:56pm (UTC)

[NR Synthetics] Restricted User can add/modify alert conditions on monitors without any synthetics privileges

👉 https://hackerone.com/reports/334143

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 10:54am (UTC)

User is able to access and create private synthetics locations without upgrading (regression of #276157)

👉 https://hackerone.com/reports/344468

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 10:55am (UTC)

IDOR via internal_api "users" endpoint

👉 https://hackerone.com/reports/349291

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 10:55am (UTC)

[NR Insights] Data app permissions setting does not fully prevent other users from modifying/changing changing data related to your data app

👉 https://hackerone.com/reports/388743

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 10:56am (UTC)

[NR Infrastructure] Restricted user can update integration provider account name via integrations API

👉 https://hackerone.com/reports/397483

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 10:57am (UTC)

Permissions leaks the full name of other NR accounts - Regression of #267636

👉 https://hackerone.com/reports/347665

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 10:58am (UTC)

[NR Alerts] Internal API exposes Synthetics monitor details to a restricted user without view monitor permissions

👉 https://hackerone.com/reports/386556

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 10:58am (UTC)

[NR Alerts/Synthetics?] User with no Synthetics permissions can view synthetic monitor details through /internal_api/ endpoint

👉 https://hackerone.com/reports/320200

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 10:59am (UTC)

Restricted user can bypass permissions restriction to create NR Alert policies

👉 https://hackerone.com/reports/380413

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 11:00am (UTC)

[NR Insights] IDOR - Modify the filter settings for any NR Insights dashboard through internal_api endpoint

👉 https://hackerone.com/reports/459443

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 11:00am (UTC)

Upgrade menu exposes the mobile application token meant to only be visible to administrators

👉 https://hackerone.com/reports/447975

🔹 Severity: Low | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 11:00am (UTC)

Ability to view monitor names of other NR accounts through internal API (v3) via "monitor_id" parameter

👉 https://hackerone.com/reports/462321

🔹 Severity: High | 💰 2,000 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 11:03am (UTC)

[NR Alerts/Synthetics] IDOR through /policies.json with Synthetics exposes full name of other NR users

👉 https://hackerone.com/reports/419875

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 11:04am (UTC)

Full name of other accounts exposed through NR API Explorer (another workaround of #476958)

👉 https://hackerone.com/reports/520518

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 11:07am (UTC)