[NR Synthetics] (IDOR) Ability to see full name associated with other New Relic accounts through workaround of #255894

👉 https://hackerone.com/reports/267636

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 5:08pm (UTC)

Logic flaw enables restricted account to access account license key

👉 https://hackerone.com/reports/200576

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 5:08pm (UTC)

GET request to accounts.json on support site leaks the root account license key and the browser license key to a restricted user

👉 https://hackerone.com/reports/479135

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: New Relic
🔹 Reported By: #jon_bottarini
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 5:09pm (UTC)

Reflected-XSS on https://www.topcoder.com/tc via pt parameter

👉 https://hackerone.com/reports/789652

🔹 Severity: Medium
🔹 Reported To: Topcoder
🔹 Reported By: #laz0rde
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2020, 7:53pm (UTC)

[extend-merge] Prototype pollution

👉 https://hackerone.com/reports/878339

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: September 6, 2020, 1:00pm (UTC)

Reading arbitrary files via running arbitrary python code

👉 https://hackerone.com/reports/974697

🔹 Severity: No Rating
🔹 Reported To: BugPoC
🔹 Reported By: #hackk9
🔹 State: 🔴 N/A
🔹 Disclosed: September 6, 2020, 1:17pm (UTC)

Keychain data persistence may lead to account takeover

👉 https://hackerone.com/reports/761975

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: QIWI
🔹 Reported By: #0x3c3e
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2020, 2:47pm (UTC)

XSS on https://fax.pbx.itsendless.org/ (CVE-2017-18024)

👉 https://hackerone.com/reports/963798

🔹 Severity: Medium
🔹 Reported To: Endless Hosting
🔹 Reported By: #pirneci
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2020, 5:42pm (UTC)

[bugs.fuzzing-project.org] HTML Injection via 'custom_field_7[]' parameter in '/view_all_set.php'

👉 https://hackerone.com/reports/903869

🔹 Severity: Medium
🔹 Reported To: Hanno's projects
🔹 Reported By: #dragonjar
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2020, 7:30am (UTC)

No CSRF Protection in Resend Confirmation Email feature leads to Sending Unwanted Email in Victim's Inbox without knowing Victim's email address

👉 https://hackerone.com/reports/753386

🔹 Severity: Medium
🔹 Reported To: Stripo Inc
🔹 Reported By: #binit
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2020, 11:17am (UTC)

SSRF into Shared Runner, by replacing dockerd with malicious server in Executor

👉 https://hackerone.com/reports/809248

🔹 Severity: Medium | 💰 2,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #lucash-dev
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2020, 1:28pm (UTC)

Members from parent group keep their access level on a subgroup transfer and are invisible

👉 https://hackerone.com/reports/790786

🔹 Severity: High | 💰 4,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #kryword
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2020, 1:44pm (UTC)

Injection of `http.<url>.*` git config settings leading to SSRF

👉 https://hackerone.com/reports/855276

🔹 Severity: High | 💰 3,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #vakzz
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2020, 1:46pm (UTC)

EXIF metadata not stripped from JPG group logos

👉 https://hackerone.com/reports/446238

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: GitLab
🔹 Reported By: #jackb898
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2020, 2:02pm (UTC)

Blind SQL Injection

👉 https://hackerone.com/reports/758654

🔹 Severity: Critical | 💰 2,000 USD
🔹 Reported To: InnoGames
🔹 Reported By: #rzx007x
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2020, 3:04pm (UTC)

Race Condition when following a user

👉 https://hackerone.com/reports/927384

🔹 Severity: Low
🔹 Reported To: Staging.every.org
🔹 Reported By: #bugra
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2020, 5:51am (UTC)

damage to the timeline so that comment fields cannot be displayed or not available to all members in the store

👉 https://hackerone.com/reports/971599

🔹 Severity: No Rating
🔹 Reported To: Shopify
🔹 Reported By: #jaka_tingkir
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2020, 4:45pm (UTC)

Add apps to packages 0, 61, 62 with /store/ajaxpackagemerge

👉 https://hackerone.com/reports/972243

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: Valve
🔹 Reported By: #njbooher
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2020, 8:07pm (UTC)

Unauthorized updates to extended_info properties in /store/ajaxpackagesave

👉 https://hackerone.com/reports/815547

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: Valve
🔹 Reported By: #njbooher
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2020, 8:27pm (UTC)

Stored XSS on PyPi simple API endpoint

👉 https://hackerone.com/reports/856836

🔹 Severity: Medium | 💰 3,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #vakzz
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2020, 9:57pm (UTC)

Stored XSS in markdown when redacting references

👉 https://hackerone.com/reports/836649

🔹 Severity: High | 💰 5,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #vakzz
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2020, 9:58pm (UTC)