URN Request bypass ACL Checks

👉 https://hackerone.com/reports/824802

🔹 Severity: Critical | 💰 12,000 USD
🔹 Reported To: Squid Cache (IBB)
🔹 Reported By: #jeriko_one
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2021, 11:32pm (UTC)

UrnState Heap Overflow

👉 https://hackerone.com/reports/824771

🔹 Severity: Critical | 💰 12,000 USD
🔹 Reported To: Squid Cache (IBB)
🔹 Reported By: #jeriko_one
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2021, 11:36pm (UTC)

Squid leaks previous content from reusable buffer

👉 https://hackerone.com/reports/824163

🔹 Severity: High | 💰 6,000 USD
🔹 Reported To: Squid Cache (IBB)
🔹 Reported By: #jeriko_one
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2021, 11:37pm (UTC)

Basic Authentication Heap Overflow

👉 https://hackerone.com/reports/641240

🔹 Severity: High | 💰 6,000 USD
🔹 Reported To: Squid Cache (IBB)
🔹 Reported By: #jeriko_one
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2021, 11:39pm (UTC)

HTTP Smuggling multiple issues in Squid 3.x & squid 4.x

👉 https://hackerone.com/reports/758445

🔹 Severity: Critical | 💰 18,000 USD
🔹 Reported To: Squid Cache (IBB)
🔹 Reported By: #regilero
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2021, 11:57pm (UTC)

1-byte heap buffer overflow in DNS resolver

👉 https://hackerone.com/reports/1210450

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Nginx (IBB)
🔹 Reported By: #luismerino
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2021, 12:07am (UTC)

Information Exposure Through Directory Listing

👉 https://hackerone.com/reports/1316412

🔹 Severity: High
🔹 Reported To: Tor
🔹 Reported By: #sasikaran
🔹 State: 🔴 N/A
🔹 Disclosed: August 27, 2021, 11:15am (UTC)

No Rate Limit On Contact Us

👉 https://hackerone.com/reports/1166069

🔹 Severity: No Rating
🔹 Reported To: UPchieve
🔹 Reported By: #lu3ky-13
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2021, 5:23pm (UTC)

2 Bypass of #1067533 rate limit via X-Forwarded-For<space>: Source IP on ( www.trycourier.app )

👉 https://hackerone.com/reports/1206777

🔹 Severity: Medium
🔹 Reported To: Courier
🔹 Reported By: #bugera
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2021, 5:47pm (UTC)

HTTP Request Smuggling via HTTP/2

👉 https://hackerone.com/reports/1211724

🔹 Severity: Critical | 💰 7,500 USD
🔹 Reported To: Basecamp
🔹 Reported By: #neex
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2021, 7:21pm (UTC)

Publicly exposed HashiCorp Vault (Secrets management) at usec-gcp-staging.uberinternal.com & usec-gcp.uberinternal.com

👉 https://hackerone.com/reports/519044

🔹 Severity: No Rating | 💰 500 USD
🔹 Reported To: Uber
🔹 Reported By: #ayoubfathi_
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2021, 8:20pm (UTC)

Unauthenticated Arbitrary File Deletion (CVE-2020-3187)

👉 https://hackerone.com/reports/1056611

🔹 Severity: High
🔹 Reported To: MTN Group
🔹 Reported By: #logic_err0r
🔹 State: 🟢 Resolved
🔹 Disclosed: August 29, 2021, 3:25pm (UTC)

[Biz] [Mailer] Кроп любых* изображений расположенных на сервере

👉 https://hackerone.com/reports/1073485

🔹 Severity: Medium
🔹 Reported To: Mail.ru
🔹 Reported By: #rainbow_json
🔹 State: 🟢 Resolved
🔹 Disclosed: August 30, 2021, 4:17am (UTC)

Guest users can create new test cases

👉 https://hackerone.com/reports/1113289

🔹 Severity: Low | 💰 650 USD
🔹 Reported To: GitLab
🔹 Reported By: #maruthi12
🔹 State: 🟢 Resolved
🔹 Disclosed: August 30, 2021, 11:01am (UTC)

A profile page of a user can be denied from loading by appending .html to the username

👉 https://hackerone.com/reports/475098

🔹 Severity: Low | 💰 200 USD
🔹 Reported To: GitLab
🔹 Reported By: #maruthi12
🔹 State: 🟢 Resolved
🔹 Disclosed: August 30, 2021, 11:02am (UTC)

A deactivated user can access data through GraphQL

👉 https://hackerone.com/reports/1192460

🔹 Severity: Medium | 💰 1,370 USD
🔹 Reported To: GitLab
🔹 Reported By: #joaxcar
🔹 State: 🟢 Resolved
🔹 Disclosed: August 30, 2021, 1:25pm (UTC)

SSH server due to Improper Signature Verification

👉 https://hackerone.com/reports/1294043

🔹 Severity: High
🔹 Reported To: Sifchain
🔹 Reported By: #escanor56
🔹 State: 🔴 N/A
🔹 Disclosed: August 30, 2021, 2:35pm (UTC)

Index Out Of Bounds in protobuf unmarshalling

👉 https://hackerone.com/reports/1073363

🔹 Severity: No Rating | 💰 250 USD
🔹 Reported To: Kubernetes
🔹 Reported By: #pulpkk
🔹 State: 🟢 Resolved
🔹 Disclosed: August 30, 2021, 7:06pm (UTC)

Bypass of the installation sandbox by injecting keystrokes with TIOCSTI

👉 https://hackerone.com/reports/1283871

🔹 Severity: Low
🔹 Reported To: Homebrew
🔹 Reported By: #gedwards
🔹 State: 🟢 Resolved
🔹 Disclosed: August 30, 2021, 11:46pm (UTC)

Open Redirect

👉 https://hackerone.com/reports/1213580

🔹 Severity: Low | 💰 250 USD
🔹 Reported To: Affirm
🔹 Reported By: #litt1eb0y
🔹 State: 🟢 Resolved
🔹 Disclosed: August 31, 2021, 8:48am (UTC)

Failed to validate Session after Password Change

👉 https://hackerone.com/reports/1295187

🔹 Severity: Low
🔹 Reported To: UPchieve
🔹 Reported By: #aaruthra
🔹 State: 🟤 Duplicate
🔹 Disclosed: August 31, 2021, 9:15am (UTC)