subdomain takeover disney.samokat.ru

👉 https://hackerone.com/reports/1052819

🔹 Severity: Medium
🔹 Reported To: Mail.ru
🔹 Reported By: #nanwn
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2021, 9:29am (UTC)

Path Traversal in dict-fs and no-check Escape Character in oauth2-jwt

👉 https://hackerone.com/reports/1132160

🔹 Severity: Medium | 💰 982 USD
🔹 Reported To: Open-Xchange
🔹 Reported By: #northsea
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2021, 10:10am (UTC)

HTML Injection @ /[restaurant]/order endpoint.

👉 https://hackerone.com/reports/738810

🔹 Severity: Low | 💰 150 USD
🔹 Reported To: Zomato
🔹 Reported By: #mr_edwards
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2021, 11:28am (UTC)

HTML injection leads to reflected XSS

👉 https://hackerone.com/reports/743345

🔹 Severity: Low | 💰 150 USD
🔹 Reported To: Zomato
🔹 Reported By: #haxor5392
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2021, 11:29am (UTC)

Subdomain Takeover on 1c-start.tochka.com pointing to unbouncepages

👉 https://hackerone.com/reports/1266659

🔹 Severity: High | 💰 50 USD
🔹 Reported To: QIWI
🔹 Reported By: #uddeshaya001
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2021, 5:02pm (UTC)

Access to alerta.khanacademy.org leak sensitive data

👉 https://hackerone.com/reports/1061664

🔹 Severity: Critical
🔹 Reported To: Khan Academy
🔹 Reported By: #nightmare_msf
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2021, 8:36am (UTC)

SQL injection on jd.mail.ru

👉 https://hackerone.com/reports/365011

🔹 Severity: High | 💰 300 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #pisarenko
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2021, 9:30am (UTC)

Information disclosure -> 2fa bypass -> POST exploitation

👉 https://hackerone.com/reports/1276373

🔹 Severity: Medium | 💰 300 USD
🔹 Reported To: Algolia
🔹 Reported By: #akashhamal0x01
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2021, 1:40pm (UTC)

[185.30.178.57:8080] - Vulnerable to Jetleak

👉 https://hackerone.com/reports/1289029

🔹 Severity: Critical | 💰 250 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #xaleraf4ra
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2021, 4:43pm (UTC)

DNS Miconfiguration Leads to Subdomain Takeover - max1.liveplan.com

👉 https://hackerone.com/reports/1294492

🔹 Severity: High
🔹 Reported To: Palo Alto Software
🔹 Reported By: #melbadry9
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2021, 4:45pm (UTC)

Underrepresentation Bias through Twitter's Cropping Algorithm

👉 https://hackerone.com/reports/1294062

🔹 Severity: Critical
🔹 Reported To: Twitter Algorithmic Bias
🔹 Reported By: #cyberqueenmeg
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2021, 10:50pm (UTC)

Underrepresentation Bias through Twitter's Cropping Algorithm #2: Favoring Animals over Black People

👉 https://hackerone.com/reports/1294242

🔹 Severity: Critical
🔹 Reported To: Twitter Algorithmic Bias
🔹 Reported By: #cyberqueenmeg
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2021, 10:50pm (UTC)

Economic Harm through Twitter's Cropping Algorithm

👉 https://hackerone.com/reports/1290872

🔹 Severity: Critical
🔹 Reported To: Twitter Algorithmic Bias
🔹 Reported By: #cyberqueenmeg
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2021, 10:50pm (UTC)

RCE Apache Struts2 remote command execution (S2-045) on [wifi-partner.mtn.com.gh]

👉 https://hackerone.com/reports/1070532

🔹 Severity: High
🔹 Reported To: MTN Group
🔹 Reported By: #pisarenko
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2021, 11:34am (UTC)

blind sql on [selfcare.mtn.com.af]

👉 https://hackerone.com/reports/925007

🔹 Severity: Medium
🔹 Reported To: MTN Group
🔹 Reported By: #pisarenko
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2021, 11:39am (UTC)

SQL injection [futexpert.mtngbissau.com]

👉 https://hackerone.com/reports/924855

🔹 Severity: High
🔹 Reported To: MTN Group
🔹 Reported By: #pisarenko
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2021, 11:40am (UTC)

link.avito.ru - Bypass of restrictions on external links.

👉 https://hackerone.com/reports/956449

🔹 Severity: Medium
🔹 Reported To: Avito
🔹 Reported By: #hen51
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2021, 5:25pm (UTC)

Subdomain takeover of ███

👉 https://hackerone.com/reports/892667

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #simplyrishabh
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2021, 7:55pm (UTC)

XSS due to CVE-2020-3580 [██████]

👉 https://hackerone.com/reports/1277392

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #fdeleite
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2021, 7:56pm (UTC)

XSS due to CVE-2020-3580 [███]

👉 https://hackerone.com/reports/1277389

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #fdeleite
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2021, 7:57pm (UTC)

Sensitive data exposure via https://███████/jira//secure/QueryComponent!Default.jspa - CVE-2020-14179

👉 https://hackerone.com/reports/1153817

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #lu3ky-13
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2021, 7:58pm (UTC)