Improper Authentication - any user can login as other user with otp/logout & otp/login

👉 https://hackerone.com/reports/921780

🔹 Severity: Critical | 💰 25,000 USD
🔹 Reported To: Snapchat
🔹 Reported By: #korniltsev
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2021, 9:12am (UTC)

Protocol Smuggling over LDAP password field

👉 https://hackerone.com/reports/1054282

🔹 Severity: Low | 💰 50 USD
🔹 Reported To: ownCloud
🔹 Reported By: #pabl00nicarres
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2021, 1:20pm (UTC)

Payment method token being sent to 3rd party analytics service

👉 https://hackerone.com/reports/637267

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: Upserve
🔹 Reported By: #ctulhu
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2021, 3:06pm (UTC)

Possible to invite any team member without being logged in. [ Session Management Issue ]

👉 https://hackerone.com/reports/1319892

🔹 Severity: Medium
🔹 Reported To: Courier
🔹 Reported By: #bugera
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2021, 7:28pm (UTC)

Google Maps API Key Leakage

👉 https://hackerone.com/reports/1321830

🔹 Severity: High
🔹 Reported To: Uber
🔹 Reported By: #batman9
🔹 State: ⚪️ Informative
🔹 Disclosed: September 3, 2021, 8:39pm (UTC)

No Limit on Email Subnoscription

👉 https://hackerone.com/reports/1085079

🔹 Severity: Low
🔹 Reported To: OpenMage
🔹 Reported By: #thecyberjerry
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2021, 7:05am (UTC)

XSS Stored in Cacheable response

👉 https://hackerone.com/reports/1011093

🔹 Severity: Medium | 💰 50 USD
🔹 Reported To: Acronis
🔹 Reported By: #dj4ng0d2
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2021, 1:47am (UTC)

Подмена фотографий автомобиля [city-mobil.ru/taxiserv/]

👉 https://hackerone.com/reports/1130528

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #lobity
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2021, 10:51am (UTC)

informations disclosure(Email,Numbers,Agreements, admin Sessions and more ...) through a PostgreSQL database belongs to (legium-back.corp.mail.ru)

👉 https://hackerone.com/reports/1241637

🔹 Severity: Medium | 💰 150 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #yukusawa18
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2021, 11:41am (UTC)

Node Validation Admission does not observe all oldObject fields

👉 https://hackerone.com/reports/1095612

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: Kubernetes
🔹 Reported By: #ariellima
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2021, 11:17pm (UTC)

Holes in EndpointSlice Validation Enable Host Network Hijack

👉 https://hackerone.com/reports/1145044

🔹 Severity: Low | 💰 200 USD
🔹 Reported To: Kubernetes
🔹 Reported By: #howardjohn
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2021, 11:29pm (UTC)

XSS on ub.icq.net

👉 https://hackerone.com/reports/1064587

🔹 Severity: Low
🔹 Reported To: Mail.ru
🔹 Reported By: #nightmare_msf
🔹 State: 🟢 Resolved
🔹 Disclosed: September 6, 2021, 12:53pm (UTC)

Social Oauth Disconnect CSRF at znakcup.ru

👉 https://hackerone.com/reports/1074869

🔹 Severity: Medium
🔹 Reported To: Mail.ru
🔹 Reported By: #nightmare_msf
🔹 State: 🟢 Resolved
🔹 Disclosed: September 6, 2021, 1:28pm (UTC)

Bootstrap library is vulnerable

👉 https://hackerone.com/reports/1198203

🔹 Severity: Low
🔹 Reported To: Sifchain
🔹 Reported By: #sathish87
🔹 State: 🔴 N/A
🔹 Disclosed: September 6, 2021, 4:40pm (UTC)

subdomain takeover disney.samokat.ru

👉 https://hackerone.com/reports/1052819

🔹 Severity: Medium
🔹 Reported To: Mail.ru
🔹 Reported By: #nanwn
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2021, 9:29am (UTC)

Path Traversal in dict-fs and no-check Escape Character in oauth2-jwt

👉 https://hackerone.com/reports/1132160

🔹 Severity: Medium | 💰 982 USD
🔹 Reported To: Open-Xchange
🔹 Reported By: #northsea
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2021, 10:10am (UTC)

HTML Injection @ /[restaurant]/order endpoint.

👉 https://hackerone.com/reports/738810

🔹 Severity: Low | 💰 150 USD
🔹 Reported To: Zomato
🔹 Reported By: #mr_edwards
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2021, 11:28am (UTC)

HTML injection leads to reflected XSS

👉 https://hackerone.com/reports/743345

🔹 Severity: Low | 💰 150 USD
🔹 Reported To: Zomato
🔹 Reported By: #haxor5392
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2021, 11:29am (UTC)

Subdomain Takeover on 1c-start.tochka.com pointing to unbouncepages

👉 https://hackerone.com/reports/1266659

🔹 Severity: High | 💰 50 USD
🔹 Reported To: QIWI
🔹 Reported By: #uddeshaya001
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2021, 5:02pm (UTC)

Access to alerta.khanacademy.org leak sensitive data

👉 https://hackerone.com/reports/1061664

🔹 Severity: Critical
🔹 Reported To: Khan Academy
🔹 Reported By: #nightmare_msf
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2021, 8:36am (UTC)

SQL injection on jd.mail.ru

👉 https://hackerone.com/reports/365011

🔹 Severity: High | 💰 300 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #pisarenko
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2021, 9:30am (UTC)