Subdomain takeover of ████.jitsi.net

👉 https://hackerone.com/reports/1197013

🔹 Severity: High
🔹 Reported To: 8x8
🔹 Reported By: #ian
🔹 State: 🟢 Resolved
🔹 Disclosed: May 14, 2021, 5:35pm (UTC)

RCE when removing metadata with ExifTool

👉 https://hackerone.com/reports/1154542

🔹 Severity: Critical | 💰 20,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #vakzz
🔹 State: 🟢 Resolved
🔹 Disclosed: May 14, 2021, 8:08pm (UTC)

Full account takeover of any user through reset password

👉 https://hackerone.com/reports/1175081

🔹 Severity: Critical
🔹 Reported To: UPchieve
🔹 Reported By: #saajanbhujel
🔹 State: 🟤 Duplicate
🔹 Disclosed: May 14, 2021, 9:28pm (UTC)

Zero click account Takeover due to Api misconfiguration 🏂🎩

👉 https://hackerone.com/reports/1166500

🔹 Severity: Critical
🔹 Reported To: UPchieve
🔹 Reported By: #zero_or_1
🔹 State: 🟢 Resolved
🔹 Disclosed: May 14, 2021, 9:36pm (UTC)

private passenger information is exposed to the Uber Driver app during ride dispatch ("Ping") events

👉 https://hackerone.com/reports/174404

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: Uber
🔹 Reported By: #beezlewaxin
🔹 State: 🟢 Resolved
🔹 Disclosed: May 14, 2021, 10:35pm (UTC)

Information Disclosure on https://rpc.sifchain.finance/

👉 https://hackerone.com/reports/1197035

🔹 Severity: No Rating
🔹 Reported To: Sifchain
🔹 Reported By: #bringing2021
🔹 State: 🟤 Duplicate
🔹 Disclosed: May 15, 2021, 4:04am (UTC)

Open S3 Bucket | information leakage

👉 https://hackerone.com/reports/1186897

🔹 Severity: No Rating
🔹 Reported To: Sifchain
🔹 Reported By: #b29z
🔹 State: 🔴 N/A
🔹 Disclosed: May 15, 2021, 7:58pm (UTC)

User enumeration through forget password

👉 https://hackerone.com/reports/1166054

🔹 Severity: High
🔹 Reported To: UPchieve
🔹 Reported By: #mr-zero
🔹 State: 🟢 Resolved
🔹 Disclosed: May 16, 2021, 1:59am (UTC)

Cross site noscripting

👉 https://hackerone.com/reports/1095797

🔹 Severity: High
🔹 Reported To: Informatica
🔹 Reported By: #rawezh_ali
🔹 State: 🟢 Resolved
🔹 Disclosed: May 17, 2021, 1:56pm (UTC)

Privilege Escalation via REST API to Administrator leads to RCE

👉 https://hackerone.com/reports/1107282

🔹 Severity: High | 💰 1,125 USD
🔹 Reported To: WordPress
🔹 Reported By: #hoangkien1020
🔹 State: 🟢 Resolved
🔹 Disclosed: May 17, 2021, 4:34pm (UTC)

CS:GO Server -> Client RCE through OOB access in CSVCMsg_SplitScreen + Info leak in HTTP download

👉 https://hackerone.com/reports/1070835

🔹 Severity: Critical | 💰 7,500 USD
🔹 Reported To: Valve
🔹 Reported By: #simonscannell
🔹 State: 🟢 Resolved
🔹 Disclosed: May 17, 2021, 10:01pm (UTC)

Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using Chrome

👉 https://hackerone.com/reports/1113559

🔹 Severity: High | 💰 1,050 USD
🔹 Reported To: Starbucks
🔹 Reported By: #elber
🔹 State: 🟢 Resolved
🔹 Disclosed: May 18, 2021, 3:08am (UTC)

Authenticated XXE

👉 https://hackerone.com/reports/1095645

🔹 Severity: Medium | 💰 600 USD
🔹 Reported To: WordPress
🔹 Reported By: #sonarsource
🔹 State: 🟢 Resolved
🔹 Disclosed: May 18, 2021, 1:52pm (UTC)

Previously created sessions continue being valid after MFA activation

👉 https://hackerone.com/reports/1185479

🔹 Severity: Medium
🔹 Reported To: CS Money
🔹 Reported By: #gatolouco
🔹 State: ⚪️ Informative
🔹 Disclosed: May 18, 2021, 4:04pm (UTC)

Bypass t.co link shortener in Twitter direct messages

👉 https://hackerone.com/reports/1148548

🔹 Severity: Low | 💰 560 USD
🔹 Reported To: Twitter
🔹 Reported By: #iambouali
🔹 State: 🟢 Resolved
🔹 Disclosed: May 18, 2021, 4:19pm (UTC)

No Valid SPF Records/don't have DMARC record

👉 https://hackerone.com/reports/1198439

🔹 Severity: Critical
🔹 Reported To: UPchieve
🔹 Reported By: #shoaib_18
🔹 State: 🟢 Resolved
🔹 Disclosed: May 18, 2021, 6:49pm (UTC)

Pre-Auth Blind NoSQL Injection leading to Remote Code Execution

👉 https://hackerone.com/reports/1130721

🔹 Severity: Critical
🔹 Reported To: Rocket.Chat
🔹 Reported By: #sonarsource
🔹 State: 🟢 Resolved
🔹 Disclosed: May 18, 2021, 8:36pm (UTC)

Improper Access Control on Lark Footer Feature

👉 https://hackerone.com/reports/1169340

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: Lark Technologies
🔹 Reported By: #imran_nisar
🔹 State: 🟢 Resolved
🔹 Disclosed: May 18, 2021, 9:42pm (UTC)

Account takeover just through csrf in https://booking.qiwi.kz/profile

👉 https://hackerone.com/reports/1066189

🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: QIWI
🔹 Reported By: #sniper302
🔹 State: 🟢 Resolved
🔹 Disclosed: May 20, 2021, 1:53pm (UTC)

Weak password policy leading to exposure of administrator account access

👉 https://hackerone.com/reports/1168104

🔹 Severity: Critical
🔹 Reported To: U.S. General Services Administration
🔹 Reported By: #rajeshpatil
🔹 State: 🟢 Resolved
🔹 Disclosed: May 20, 2021, 2:45pm (UTC)

Several domains on kaspersky.com are vulnerable to Web Cache Deception attack

👉 https://hackerone.com/reports/1185028

🔹 Severity: Medium
🔹 Reported To: Kaspersky
🔹 Reported By: #golim
🔹 State: 🟢 Resolved
🔹 Disclosed: May 20, 2021, 4:20pm (UTC)