SHA512 incorrect on most/many releases

👉 https://hackerone.com/reports/1130416

🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: Kubernetes
🔹 Reported By: #ronald_petty
🔹 State: 🟢 Resolved
🔹 Disclosed: May 9, 2021, 8:16pm (UTC)

Host Header Injection

👉 https://hackerone.com/reports/1098948

🔹 Severity: Medium
🔹 Reported To: Kartpay
🔹 Reported By: #streetdragon
🔹 State: 🟢 Resolved
🔹 Disclosed: May 10, 2021, 6:14am (UTC)

removed user can still join the organization

👉 https://hackerone.com/reports/976441

🔹 Severity: Low | 💰 250 USD
🔹 Reported To: New Relic
🔹 Reported By: #moon_shadow
🔹 State: 🟢 Resolved
🔹 Disclosed: May 10, 2021, 11:24am (UTC)

PHP-FPM status page disclosure

👉 https://hackerone.com/reports/1157893

🔹 Severity: Low
🔹 Reported To: Algolia
🔹 Reported By: #iamthefrogy
🔹 State: 🟢 Resolved
🔹 Disclosed: May 10, 2021, 3:10pm (UTC)

DMARC and DNS Records not found on mcuboot.com

👉 https://hackerone.com/reports/1186701

🔹 Severity: No Rating
🔹 Reported To: MCUboot
🔹 Reported By: #dk82hg
🔹 State: 🟢 Resolved
🔹 Disclosed: May 10, 2021, 5:26pm (UTC)

[Portal 2] Remote Code Execution via voice packets

👉 https://hackerone.com/reports/733267

🔹 Severity: Critical | 💰 5,000 USD
🔹 Reported To: Valve
🔹 Reported By: #gamer7112
🔹 State: 🟢 Resolved
🔹 Disclosed: May 10, 2021, 6:18pm (UTC)

Clickjacking Vulnerability in sifchain.finance

👉 https://hackerone.com/reports/1185949

🔹 Severity: No Rating
🔹 Reported To: Sifchain
🔹 Reported By: #lemon_in-the_spoon
🔹 State: 🟤 Duplicate
🔹 Disclosed: May 11, 2021, 3:10am (UTC)

Default Nextcloud allows http federated shares

👉 https://hackerone.com/reports/1183302

🔹 Severity: Medium
🔹 Reported To: Nextcloud
🔹 Reported By: #rtod
🔹 State: ⚪️ Informative
🔹 Disclosed: May 11, 2021, 11:38am (UTC)

Email Spoofing on sifchain.finance

👉 https://hackerone.com/reports/1191209

🔹 Severity: Low
🔹 Reported To: Sifchain
🔹 Reported By: #ibrahimauwal1
🔹 State: 🟤 Duplicate
🔹 Disclosed: May 11, 2021, 2:23pm (UTC)

Members Personal Information Leak Due to IDOR

👉 https://hackerone.com/reports/847185

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #r00tpgp
🔹 State: 🟢 Resolved
🔹 Disclosed: May 11, 2021, 8:13pm (UTC)

DOM Based XSS on https://████ via backURL param

👉 https://hackerone.com/reports/1159255

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #nagli
🔹 State: 🟢 Resolved
🔹 Disclosed: May 11, 2021, 8:15pm (UTC)

Path Traversal - [ CVE-2020-3452 ]

👉 https://hackerone.com/reports/1137321

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #khun_myat
🔹 State: 🟢 Resolved
🔹 Disclosed: May 11, 2021, 8:16pm (UTC)

https://████ is vulnerable to cve-2020-3452

👉 https://hackerone.com/reports/998925

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #moon_shadow
🔹 State: 🟢 Resolved
🔹 Disclosed: May 11, 2021, 8:18pm (UTC)

XSS via X-Forwarded-Host header

👉 https://hackerone.com/reports/882220

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #geeknik
🔹 State: 🟢 Resolved
🔹 Disclosed: May 11, 2021, 8:19pm (UTC)

███ on https://████ enable ███ scraping, injection, stored XSS

👉 https://hackerone.com/reports/1048571

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #skarsom
🔹 State: 🟢 Resolved
🔹 Disclosed: May 11, 2021, 8:25pm (UTC)

Moodle XSS on evolve.glovoapp.com

👉 https://hackerone.com/reports/1165540

🔹 Severity: Medium
🔹 Reported To: Glovo
🔹 Reported By: #sn3akysnak3
🔹 State: 🟢 Resolved
🔹 Disclosed: May 12, 2021, 7:41am (UTC)

Path traversal lead to LFR via [CVE-2019-3394]

👉 https://hackerone.com/reports/980881

🔹 Severity: Critical | 💰 1,500 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #tounsi_007
🔹 State: 🟢 Resolved
🔹 Disclosed: May 12, 2021, 2:09pm (UTC)

Получение локального пути до файла [geekbrains.ru]

👉 https://hackerone.com/reports/1012644

🔹 Severity: Low
🔹 Reported To: Mail.ru
🔹 Reported By: #lobity
🔹 State: 🟢 Resolved
🔹 Disclosed: May 12, 2021, 2:14pm (UTC)

Wrong Url in Main Page

👉 https://hackerone.com/reports/1188629

🔹 Severity: Low | 💰 200 USD
🔹 Reported To: Sifchain
🔹 Reported By: #n33dm0n3y
🔹 State: 🟢 Resolved
🔹 Disclosed: May 12, 2021, 3:25pm (UTC)

SSRF at jira.plazius.ru - CVE-2019-8451

👉 https://hackerone.com/reports/900618

🔹 Severity: High | 💰 1,200 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #cutedoggo
🔹 State: 🟢 Resolved
🔹 Disclosed: May 12, 2021, 3:48pm (UTC)

Social media links not working

👉 https://hackerone.com/reports/1189282

🔹 Severity: No Rating
🔹 Reported To: Sifchain
🔹 Reported By: #tefa_
🔹 State: 🟤 Duplicate
🔹 Disclosed: May 12, 2021, 5:41pm (UTC)