No Rate Limit protection in user subnoscription form

👉 https://hackerone.com/reports/1195429

🔹 Severity: Low
🔹 Reported To: Sifchain
🔹 Reported By: #aliyugombe
🔹 State: 🟤 Duplicate
🔹 Disclosed: May 14, 2021, 4:58pm (UTC)

Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employees

👉 https://hackerone.com/reports/1063022

🔹 Severity: Medium | 💰 1,250 USD
🔹 Reported To: Uber
🔹 Reported By: #bubbounty
🔹 State: 🟢 Resolved
🔹 Disclosed: May 14, 2021, 5:02pm (UTC)

Unrestricted File Upload Results in Cross-Site Scripting Attacks

👉 https://hackerone.com/reports/1005355

🔹 Severity: Medium | 💰 2,000 USD
🔹 Reported To: Uber
🔹 Reported By: #hunt4p1zza
🔹 State: 🟢 Resolved
🔹 Disclosed: May 14, 2021, 5:04pm (UTC)

No Valid SPF Records/don't have DMARC record

👉 https://hackerone.com/reports/1194598

🔹 Severity: No Rating
🔹 Reported To: Sifchain
🔹 Reported By: #himan253
🔹 State: 🟤 Duplicate
🔹 Disclosed: May 14, 2021, 5:19pm (UTC)

Request Access for Uber Device Returns Management Platform (https://www.eats-devicereturns.com/request-access/) Bypass Allows Access to PII

👉 https://hackerone.com/reports/1010787

🔹 Severity: High | 💰 750 USD
🔹 Reported To: Uber
🔹 Reported By: #hunt4p1zza
🔹 State: 🟢 Resolved
🔹 Disclosed: May 14, 2021, 5:24pm (UTC)

Subdomain takeover of ████.jitsi.net

👉 https://hackerone.com/reports/1197013

🔹 Severity: High
🔹 Reported To: 8x8
🔹 Reported By: #ian
🔹 State: 🟢 Resolved
🔹 Disclosed: May 14, 2021, 5:35pm (UTC)

RCE when removing metadata with ExifTool

👉 https://hackerone.com/reports/1154542

🔹 Severity: Critical | 💰 20,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #vakzz
🔹 State: 🟢 Resolved
🔹 Disclosed: May 14, 2021, 8:08pm (UTC)

Full account takeover of any user through reset password

👉 https://hackerone.com/reports/1175081

🔹 Severity: Critical
🔹 Reported To: UPchieve
🔹 Reported By: #saajanbhujel
🔹 State: 🟤 Duplicate
🔹 Disclosed: May 14, 2021, 9:28pm (UTC)

Zero click account Takeover due to Api misconfiguration 🏂🎩

👉 https://hackerone.com/reports/1166500

🔹 Severity: Critical
🔹 Reported To: UPchieve
🔹 Reported By: #zero_or_1
🔹 State: 🟢 Resolved
🔹 Disclosed: May 14, 2021, 9:36pm (UTC)

private passenger information is exposed to the Uber Driver app during ride dispatch ("Ping") events

👉 https://hackerone.com/reports/174404

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: Uber
🔹 Reported By: #beezlewaxin
🔹 State: 🟢 Resolved
🔹 Disclosed: May 14, 2021, 10:35pm (UTC)

Information Disclosure on https://rpc.sifchain.finance/

👉 https://hackerone.com/reports/1197035

🔹 Severity: No Rating
🔹 Reported To: Sifchain
🔹 Reported By: #bringing2021
🔹 State: 🟤 Duplicate
🔹 Disclosed: May 15, 2021, 4:04am (UTC)

Open S3 Bucket | information leakage

👉 https://hackerone.com/reports/1186897

🔹 Severity: No Rating
🔹 Reported To: Sifchain
🔹 Reported By: #b29z
🔹 State: 🔴 N/A
🔹 Disclosed: May 15, 2021, 7:58pm (UTC)

User enumeration through forget password

👉 https://hackerone.com/reports/1166054

🔹 Severity: High
🔹 Reported To: UPchieve
🔹 Reported By: #mr-zero
🔹 State: 🟢 Resolved
🔹 Disclosed: May 16, 2021, 1:59am (UTC)

Cross site noscripting

👉 https://hackerone.com/reports/1095797

🔹 Severity: High
🔹 Reported To: Informatica
🔹 Reported By: #rawezh_ali
🔹 State: 🟢 Resolved
🔹 Disclosed: May 17, 2021, 1:56pm (UTC)

Privilege Escalation via REST API to Administrator leads to RCE

👉 https://hackerone.com/reports/1107282

🔹 Severity: High | 💰 1,125 USD
🔹 Reported To: WordPress
🔹 Reported By: #hoangkien1020
🔹 State: 🟢 Resolved
🔹 Disclosed: May 17, 2021, 4:34pm (UTC)

CS:GO Server -> Client RCE through OOB access in CSVCMsg_SplitScreen + Info leak in HTTP download

👉 https://hackerone.com/reports/1070835

🔹 Severity: Critical | 💰 7,500 USD
🔹 Reported To: Valve
🔹 Reported By: #simonscannell
🔹 State: 🟢 Resolved
🔹 Disclosed: May 17, 2021, 10:01pm (UTC)

Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using Chrome

👉 https://hackerone.com/reports/1113559

🔹 Severity: High | 💰 1,050 USD
🔹 Reported To: Starbucks
🔹 Reported By: #elber
🔹 State: 🟢 Resolved
🔹 Disclosed: May 18, 2021, 3:08am (UTC)

Authenticated XXE

👉 https://hackerone.com/reports/1095645

🔹 Severity: Medium | 💰 600 USD
🔹 Reported To: WordPress
🔹 Reported By: #sonarsource
🔹 State: 🟢 Resolved
🔹 Disclosed: May 18, 2021, 1:52pm (UTC)

Previously created sessions continue being valid after MFA activation

👉 https://hackerone.com/reports/1185479

🔹 Severity: Medium
🔹 Reported To: CS Money
🔹 Reported By: #gatolouco
🔹 State: ⚪️ Informative
🔹 Disclosed: May 18, 2021, 4:04pm (UTC)

Bypass t.co link shortener in Twitter direct messages

👉 https://hackerone.com/reports/1148548

🔹 Severity: Low | 💰 560 USD
🔹 Reported To: Twitter
🔹 Reported By: #iambouali
🔹 State: 🟢 Resolved
🔹 Disclosed: May 18, 2021, 4:19pm (UTC)

No Valid SPF Records/don't have DMARC record

👉 https://hackerone.com/reports/1198439

🔹 Severity: Critical
🔹 Reported To: UPchieve
🔹 Reported By: #shoaib_18
🔹 State: 🟢 Resolved
🔹 Disclosed: May 18, 2021, 6:49pm (UTC)