Self XSS on Acronis Cyber Cloud

👉 https://hackerone.com/reports/957229

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Acronis
🔹 Reported By: #sbakhour
🔹 State: 🟢 Resolved
🔹 Disclosed: June 28, 2021, 3:12am (UTC)

Exposed data of credit card details to hacker or attacker.

👉 https://hackerone.com/reports/1245094

🔹 Severity: Medium
🔹 Reported To: Urban Company
🔹 Reported By: #nispat
🔹 State: 🔴 N/A
🔹 Disclosed: June 28, 2021, 4:53am (UTC)

Bypass of SSRF Vulnerability

👉 https://hackerone.com/reports/879803

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #njgadhiya
🔹 State: 🟤 Duplicate
🔹 Disclosed: June 28, 2021, 8:34am (UTC)

Prototype Pollution Vulnerability in noble Package

👉 https://hackerone.com/reports/390857

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #cris_semmle
🔹 State: 🟢 Resolved
🔹 Disclosed: June 28, 2021, 8:38am (UTC)

Server-side Template Injection in lodash.js

👉 https://hackerone.com/reports/904672

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #zerohex
🔹 State: ⚪️ Informative
🔹 Disclosed: June 28, 2021, 8:43am (UTC)

clickjacking at brew.sh

👉 https://hackerone.com/reports/1245972

🔹 Severity: Low
🔹 Reported To: Homebrew
🔹 Reported By: #sai545
🔹 State: 🔴 N/A
🔹 Disclosed: June 28, 2021, 9:56am (UTC)

Open URL Redirection

👉 https://hackerone.com/reports/1238684

🔹 Severity: Medium | 💰 300 USD
🔹 Reported To: Unikrn
🔹 Reported By: #stark303
🔹 State: 🟢 Resolved
🔹 Disclosed: June 28, 2021, 10:03am (UTC)

F5 BIG-IP Cookie potentially reveal BigIP pool name, backend's IP address and port, routed domain.

👉 https://hackerone.com/reports/1211094

🔹 Severity: Low
🔹 Reported To: Informatica
🔹 Reported By: #k4b33r_
🔹 State: 🟢 Resolved
🔹 Disclosed: June 28, 2021, 11:19am (UTC)

Untrusted deserialization issue when loading newrelic.yml file in Java agent leads to code execution on host

👉 https://hackerone.com/reports/1109620

🔹 Severity: Low | 💰 768 USD
🔹 Reported To: New Relic
🔹 Reported By: #j0v
🔹 State: 🟢 Resolved
🔹 Disclosed: June 28, 2021, 1:00pm (UTC)

Account Takeover via Email ID Change and Forgot Password Functionality

👉 https://hackerone.com/reports/1089467

🔹 Severity: High | 💰 2,048 USD
🔹 Reported To: New Relic
🔹 Reported By: #dsdh
🔹 State: 🟢 Resolved
🔹 Disclosed: June 28, 2021, 2:44pm (UTC)

Responsible Disclosure of Privacy Leakage Issue

👉 https://hackerone.com/reports/1089914

🔹 Severity: High
🔹 Reported To: GitLab
🔹 Reported By: #mzaheri
🔹 State: ⚪️ Informative
🔹 Disclosed: June 29, 2021, 6:31am (UTC)

Unauthenticated SSRF in jira.tochka.com leading to RCE in confluence.bank24.int

👉 https://hackerone.com/reports/713900

🔹 Severity: Critical | 💰 1,000 USD
🔹 Reported To: QIWI
🔹 Reported By: #alexeypetrenko
🔹 State: 🟢 Resolved
🔹 Disclosed: June 29, 2021, 8:43am (UTC)

Cross-Site Scripting thorough XSSJacking/PasteJacking Technique

👉 https://hackerone.com/reports/893240

🔹 Severity: No Rating
🔹 Reported To: Zivver
🔹 Reported By: #njgadhiya
🔹 State: ⚪️ Informative
🔹 Disclosed: June 29, 2021, 10:37am (UTC)

Google Maps API key stored as plain text leading to DOS and financial damage

👉 https://hackerone.com/reports/1093667

🔹 Severity: Medium | 💰 750 USD
🔹 Reported To: Zenly
🔹 Reported By: #sdushantha
🔹 State: 🟢 Resolved
🔹 Disclosed: June 29, 2021, 10:56am (UTC)

PIN bypass

👉 https://hackerone.com/reports/1242212

🔹 Severity: Critical
🔹 Reported To: MyEtherWallet
🔹 Reported By: #tushar_9905
🔹 State: ⚪️ Informative
🔹 Disclosed: June 29, 2021, 8:19pm (UTC)

CORS misconfiguration

👉 https://hackerone.com/reports/1187543

🔹 Severity: No Rating
🔹 Reported To: Sifchain
🔹 Reported By: #coptech77
🔹 State: ⚪️ Informative
🔹 Disclosed: June 29, 2021, 11:12pm (UTC)

Post-Auth Stored XSS with User Interaction leads to Remote Code Execution

👉 https://hackerone.com/reports/1132202

🔹 Severity: High
🔹 Reported To: Rocket.Chat
🔹 Reported By: #sonarsource
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 10:55am (UTC)

SQL Injection at /displayPDF.php (printshop.engelvoelkers.com)

👉 https://hackerone.com/reports/914427

🔹 Severity: Critical
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #djurado
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 12:51pm (UTC)

Publicly accessible .SVN repository allows downloading entire source code

👉 https://hackerone.com/reports/914194

🔹 Severity: Low
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #djurado
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 12:57pm (UTC)

Information Exposure at https://printshop.engelvoelkers.com/

👉 https://hackerone.com/reports/805642

🔹 Severity: Medium
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #luisk2
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 12:58pm (UTC)

Improper authentication on phpmyadmin portal which is hosted in https://eventapp.engelvoelkers.com

👉 https://hackerone.com/reports/915813

🔹 Severity: Low
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #n0nce
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 1:01pm (UTC)