CORS misconfiguration

👉 https://hackerone.com/reports/1187543

🔹 Severity: No Rating
🔹 Reported To: Sifchain
🔹 Reported By: #coptech77
🔹 State: ⚪️ Informative
🔹 Disclosed: June 29, 2021, 11:12pm (UTC)

Post-Auth Stored XSS with User Interaction leads to Remote Code Execution

👉 https://hackerone.com/reports/1132202

🔹 Severity: High
🔹 Reported To: Rocket.Chat
🔹 Reported By: #sonarsource
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 10:55am (UTC)

SQL Injection at /displayPDF.php (printshop.engelvoelkers.com)

👉 https://hackerone.com/reports/914427

🔹 Severity: Critical
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #djurado
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 12:51pm (UTC)

Publicly accessible .SVN repository allows downloading entire source code

👉 https://hackerone.com/reports/914194

🔹 Severity: Low
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #djurado
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 12:57pm (UTC)

Information Exposure at https://printshop.engelvoelkers.com/

👉 https://hackerone.com/reports/805642

🔹 Severity: Medium
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #luisk2
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 12:58pm (UTC)

Improper authentication on phpmyadmin portal which is hosted in https://eventapp.engelvoelkers.com

👉 https://hackerone.com/reports/915813

🔹 Severity: Low
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #n0nce
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 1:01pm (UTC)

SPF Misconfiguration

👉 https://hackerone.com/reports/916170

🔹 Severity: Low
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #meme-man
🔹 State: ⚪️ Informative
🔹 Disclosed: June 30, 2021, 1:03pm (UTC)

Information disclosure via Spring Boot Actuators on gonext-stage.engelvoelkers.com

👉 https://hackerone.com/reports/914719

🔹 Severity: Critical
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #b1ackgamba
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 1:19pm (UTC)

reflected xss in ██████

👉 https://hackerone.com/reports/909576

🔹 Severity: Medium
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #ahmedalroky
🔹 State: 🟤 Duplicate
🔹 Disclosed: June 30, 2021, 1:20pm (UTC)

XSS reflected

👉 https://hackerone.com/reports/1030397

🔹 Severity: High
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #er_salil
🔹 State: ⚪️ Informative
🔹 Disclosed: June 30, 2021, 1:23pm (UTC)

CSS-Reflected

👉 https://hackerone.com/reports/1032001

🔹 Severity: High
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #er_salil
🔹 State: ⚪️ Informative
🔹 Disclosed: June 30, 2021, 1:24pm (UTC)

rXSS on https://mackeeperapp.mackeeper.com/landings/download-blue/

👉 https://hackerone.com/reports/1206020

🔹 Severity: Low | 💰 50 USD
🔹 Reported To: Clario
🔹 Reported By: #trungnd95
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 1:25pm (UTC)

XXE on www.publish.engelvoelkers.com

👉 https://hackerone.com/reports/914801

🔹 Severity: High
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #b1ackgamba
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 1:32pm (UTC)

Blind SSRF on infodesk.engelvoelkers.com via proxy.php

👉 https://hackerone.com/reports/1051431

🔹 Severity: High
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #mikkocarreon
🔹 State: ⚪️ Informative
🔹 Disclosed: June 30, 2021, 1:37pm (UTC)

CVE-2019-11248 on alertmanager.ev-cloud-platform.engelvoelkers.com

👉 https://hackerone.com/reports/1102283

🔹 Severity: Low
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #iamthefrogy
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 1:39pm (UTC)

Grafana default username password authentication into the Grafana platform of the grafana.ev-cloud-platform.engelvoelkers.com

👉 https://hackerone.com/reports/1102297

🔹 Severity: High
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #iamthefrogy
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 1:41pm (UTC)

Remote Code Execution (RCE) at "juid" parameter in /get_zip.php (printshop.engelvoelkers.com)

👉 https://hackerone.com/reports/914392

🔹 Severity: Critical
🔹 Reported To: Engel & Völkers Technology GmbH
🔹 Reported By: #djurado
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 2:09pm (UTC)

Report Bulk endpoint "agree-on-going-public" action may reveal Report disclosure state for invite-only programs

👉 https://hackerone.com/reports/1219011

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: HackerOne
🔹 Reported By: #clubbable
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 2:21pm (UTC)

[█████████] Reflected Cross-Site Scripting Vulnerability

👉 https://hackerone.com/reports/1196989

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #celesian
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 8:38pm (UTC)

Unauthorized access to admin panel of the Questionmark Perception system at https://██████████

👉 https://hackerone.com/reports/1026146

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #qdoan95
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 8:41pm (UTC)

[www.███] Reflected Cross-Site Scripting

👉 https://hackerone.com/reports/1184644

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #celesian
🔹 State: 🟢 Resolved
🔹 Disclosed: June 30, 2021, 8:42pm (UTC)