IDOR via internal_api "users" endpoint

👉 https://hackerone.com/reports/349291

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 10:55am (UTC)

[NR Insights] Data app permissions setting does not fully prevent other users from modifying/changing changing data related to your data app

👉 https://hackerone.com/reports/388743

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 10:56am (UTC)

[NR Infrastructure] Restricted user can update integration provider account name via integrations API

👉 https://hackerone.com/reports/397483

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 10:57am (UTC)

Permissions leaks the full name of other NR accounts - Regression of #267636

👉 https://hackerone.com/reports/347665

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 10:58am (UTC)

[NR Alerts] Internal API exposes Synthetics monitor details to a restricted user without view monitor permissions

👉 https://hackerone.com/reports/386556

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 10:58am (UTC)

[NR Alerts/Synthetics?] User with no Synthetics permissions can view synthetic monitor details through /internal_api/ endpoint

👉 https://hackerone.com/reports/320200

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 10:59am (UTC)

Restricted user can bypass permissions restriction to create NR Alert policies

👉 https://hackerone.com/reports/380413

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 11:00am (UTC)

[NR Insights] IDOR - Modify the filter settings for any NR Insights dashboard through internal_api endpoint

👉 https://hackerone.com/reports/459443

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 11:00am (UTC)

Upgrade menu exposes the mobile application token meant to only be visible to administrators

👉 https://hackerone.com/reports/447975

🔹 Severity: Low | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 11:00am (UTC)

Ability to view monitor names of other NR accounts through internal API (v3) via "monitor_id" parameter

👉 https://hackerone.com/reports/462321

🔹 Severity: High | 💰 2,000 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 11:03am (UTC)

[NR Alerts/Synthetics] IDOR through /policies.json with Synthetics exposes full name of other NR users

👉 https://hackerone.com/reports/419875

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 11:04am (UTC)

Full name of other accounts exposed through NR API Explorer (another workaround of #476958)

👉 https://hackerone.com/reports/520518

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 11:07am (UTC)

[Synthetics/Infrastructure/everything] Individual account permissions are not properly managed and inherited on sub accounts

👉 https://hackerone.com/reports/268541

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 5:06pm (UTC)

[NR Synthetics] (IDOR) Ability to see full name associated with other New Relic accounts through workaround of #255894

👉 https://hackerone.com/reports/267636

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 5:08pm (UTC)

Logic flaw enables restricted account to access account license key

👉 https://hackerone.com/reports/200576

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 5:08pm (UTC)

GET request to accounts.json on support site leaks the root account license key and the browser license key to a restricted user

👉 https://hackerone.com/reports/479135

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 5:09pm (UTC)

Reflected-XSS on https://www.topcoder.com/tc via pt parameter

👉 https://hackerone.com/reports/789652

🔹 Severity: Medium
🔹 Reported To: Topcoder
🔹 Reported By: #laz0rde
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 7:53pm (UTC)

[extend-merge] Prototype pollution

👉 https://hackerone.com/reports/878339

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: September 6, 2020, 1:00pm (UTC)

Reading arbitrary files via running arbitrary python code

👉 https://hackerone.com/reports/974697

🔹 Severity: No Rating
🔹 Reported To: BugPoC
🔹 Reported By: #hackk9
🔹 State: 🔴 N/A
🔹 Disclosed: September 6, 2020, 1:17pm (UTC)

Keychain data persistence may lead to account takeover

👉 https://hackerone.com/reports/761975

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: QIWI
🔹 Reported By: #0x3c3e
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2020, 2:47pm (UTC)

XSS on https://fax.pbx.itsendless.org/ (CVE-2017-18024)

👉 https://hackerone.com/reports/963798

🔹 Severity: Medium
🔹 Reported To: Endless Hosting
🔹 Reported By: #pirneci
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2020, 5:42pm (UTC)