Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalation

👉 https://hackerone.com/reports/910300

🔹 Severity: Critical | 💰 22,500 USD
🔹 Reported To: Shopify
🔹 Reported By: #say_ch33se
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 6:47am (UTC)

CircleCI token in github repo allows for access to sensitive build information

👉 https://hackerone.com/reports/858915

🔹 Severity: No Rating | 💰 1,500 USD
🔹 Reported To: Shopify
🔹 Reported By: #dwimmerlaik
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 9:30am (UTC)

[icq.im] Reflected XSS via chat invite link

👉 https://hackerone.com/reports/796897

🔹 Severity: Low | 💰 250 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #romesful
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 12:25pm (UTC)

Private files exposed to other apps

👉 https://hackerone.com/reports/838587

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #kanytu
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 1:14pm (UTC)

Database read through provider misconfiguration

👉 https://hackerone.com/reports/882475

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #kanytu
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 1:20pm (UTC)

IDOR in tracking driver logs at city-mobil.ru

👉 https://hackerone.com/reports/847876

🔹 Severity: Low | 💰 150 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #r0hack
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 1:59pm (UTC)

Cache Poisoning via uppercase letters in invalid path

👉 https://hackerone.com/reports/960618

🔹 Severity: Medium | 💰 550 USD
🔹 Reported To: InnoGames
🔹 Reported By: #mace
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 2:48pm (UTC)

xss triggered in "myshopify.com/admin/product"

👉 https://hackerone.com/reports/978125

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #jaka_tingkir
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 8:30pm (UTC)

[authmagic-timerange-stateless-core] Improper Authentication

👉 https://hackerone.com/reports/736522

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #ermilov
🔹 State: 🟢 Resolved
🔹 Disclosed: September 16, 2020, 5:07am (UTC)

Possible denial of service when entering a loooong password

👉 https://hackerone.com/reports/952349

🔹 Severity: Medium
🔹 Reported To: Nextcloud
🔹 Reported By: #guoxuxin
🔹 State: 🟢 Resolved
🔹 Disclosed: September 16, 2020, 9:28am (UTC)

Clear text storage of proxy parameters and passwords

👉 https://hackerone.com/reports/685990

🔹 Severity: Low | 💰 250 USD
🔹 Reported To: Nextcloud
🔹 Reported By: #rbcafe
🔹 State: 🟢 Resolved
🔹 Disclosed: September 16, 2020, 2:32pm (UTC)

IDOR - User is able to download charts/dashboards from cross accounts

👉 https://hackerone.com/reports/975749

🔹 Severity: No Rating
🔹 Reported To: New Relic
🔹 Reported By: #k3ne
🔹 State: 🔴 N/A
🔹 Disclosed: September 17, 2020, 11:24am (UTC)

Self XSS

👉 https://hackerone.com/reports/982510

🔹 Severity: No Rating | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #wannacry0x01
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2020, 4:07pm (UTC)

email spoofing

👉 https://hackerone.com/reports/981456

🔹 Severity: Medium
🔹 Reported To: Solana BBP
🔹 Reported By: #crazy_criminal_bj-4545
🔹 State: 🟤 Duplicate
🔹 Disclosed: September 17, 2020, 9:59pm (UTC)

[@knutkirkhorn/free-space] - Command Injection through Lack of Sanitization

👉 https://hackerone.com/reports/950192

🔹 Severity: Medium
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #ansuj
🔹 State: 🟢 Resolved
🔹 Disclosed: September 18, 2020, 12:35pm (UTC)

Log files Leaked In mcsblog.ru

👉 https://hackerone.com/reports/909166

🔹 Severity: Medium | 💰 150 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #sniper302
🔹 State: 🟢 Resolved
🔹 Disclosed: September 18, 2020, 3:25pm (UTC)

Broken twitter link hijacking at https://games.mail.ru/pc/search/

👉 https://hackerone.com/reports/975653

🔹 Severity: No Rating
🔹 Reported To: Mail.ru
🔹 Reported By: #nagli
🔹 State: 🟢 Resolved
🔹 Disclosed: September 18, 2020, 3:30pm (UTC)

Java : add MongoDB injection sinks

👉 https://hackerone.com/reports/983867

🔹 Severity: Low | 💰 1,000 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #porcupineyhairs
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2020, 7:30pm (UTC)

Stored XSS in collabora via user name

👉 https://hackerone.com/reports/968232

🔹 Severity: Low
🔹 Reported To: Nextcloud
🔹 Reported By: #meliodas19
🔹 State: 🟢 Resolved
🔹 Disclosed: September 19, 2020, 2:00am (UTC)

Buffer over read from `smtp_command_parse_parameters`

👉 https://hackerone.com/reports/900548

🔹 Severity: No Rating | 💰 50 USD
🔹 Reported To: Open-Xchange
🔹 Reported By: #catenacyber
🔹 State: 🟢 Resolved
🔹 Disclosed: September 21, 2020, 9:15am (UTC)

Sensitive information about a ██████

👉 https://hackerone.com/reports/893970

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #0x9747
🔹 State: 🟢 Resolved
🔹 Disclosed: September 21, 2020, 2:49pm (UTC)