System Error Reveals SQL Information

👉 https://hackerone.com/reports/1272095

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #miguel_santareno
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2021, 7:59pm (UTC)

SQL injection located in `███` in POST param `████████`

👉 https://hackerone.com/reports/1262757

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #brumens
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2021, 8:00pm (UTC)

Stored XSS on top.mail.ru

👉 https://hackerone.com/reports/1241107

🔹 Severity: Medium
🔹 Reported To: Mail.ru
🔹 Reported By: #savproga
🔹 State: 🟢 Resolved
🔹 Disclosed: September 10, 2021, 7:18am (UTC)

[play.mtn.co.za] Application level DoS via xmlrpc.php

👉 https://hackerone.com/reports/925519

🔹 Severity: Medium
🔹 Reported To: MTN Group
🔹 Reported By: #devhug
🔹 State: 🟢 Resolved
🔹 Disclosed: September 10, 2021, 4:21pm (UTC)

Improper handling of untypical characters in domain names

👉 https://hackerone.com/reports/1178337

🔹 Severity: High
🔹 Reported To: Node.js
🔹 Reported By: #philippjeitner
🔹 State: 🟢 Resolved
🔹 Disclosed: September 10, 2021, 5:51pm (UTC)

Built-in TLS module unexpectedly treats "rejectUnauthorized: undefined" as "rejectUnauthorized: false", disabling all certificate validation

👉 https://hackerone.com/reports/1278254

🔹 Severity: Low
🔹 Reported To: Node.js
🔹 Reported By: #pimterry
🔹 State: 🟢 Resolved
🔹 Disclosed: September 10, 2021, 5:53pm (UTC)

Create free Shopify application credits.

👉 https://hackerone.com/reports/1257428

🔹 Severity: Medium | 💰 2,900 USD
🔹 Reported To: Shopify
🔹 Reported By: #jmp_35p
🔹 State: 🟢 Resolved
🔹 Disclosed: September 10, 2021, 9:53pm (UTC)

Hardware Wallets Do Not Check Unlock TIme

👉 https://hackerone.com/reports/817245

🔹 Severity: Medium
🔹 Reported To: Monero
🔹 Reported By: #thecharlatan
🔹 State: 🟢 Resolved
🔹 Disclosed: September 12, 2021, 8:36am (UTC)

Unix time unlock_time values have dangerous validation rules enabling a number of exploits

👉 https://hackerone.com/reports/854726

🔹 Severity: High
🔹 Reported To: Monero
🔹 Reported By: #thecharlatan
🔹 State: 🟢 Resolved
🔹 Disclosed: September 12, 2021, 8:36am (UTC)

Privilege Escalation leading to post in channel without having privilege

👉 https://hackerone.com/reports/1114617

🔹 Severity: Low | 💰 150 USD
🔹 Reported To: Mattermost
🔹 Reported By: #fuzzsqlb0f
🔹 State: 🟢 Resolved
🔹 Disclosed: September 13, 2021, 5:36am (UTC)

No Rate Limit On Regenerate Password on Portswigger

👉 https://hackerone.com/reports/1337425

🔹 Severity: No Rating
🔹 Reported To: PortSwigger Web Security
🔹 Reported By: #thespiritman
🔹 State: ⚪️ Informative
🔹 Disclosed: September 13, 2021, 1:03pm (UTC)

Buffer overrun in Steam SILK voice decoder

👉 https://hackerone.com/reports/1180252

🔹 Severity: Critical | 💰 7,500 USD
🔹 Reported To: Valve
🔹 Reported By: #slidybat
🔹 State: 🟢 Resolved
🔹 Disclosed: September 13, 2021, 5:56pm (UTC)

[Java]: Add XXE sinks

👉 https://hackerone.com/reports/1339787

🔹 Severity: Medium
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #not_specified
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2021, 9:29pm (UTC)

CSRF in Account Deletion feature (https://www.flickr.com/account/delete)

👉 https://hackerone.com/reports/615448

🔹 Severity: High | 💰 750 USD
🔹 Reported To: Flickr
🔹 Reported By: #asad0x01_
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2021, 9:59pm (UTC)

[Java] CWE-079: Query to detect XSS with JavaServer Faces (JSF)

👉 https://hackerone.com/reports/1339898

🔹 Severity: Medium
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #not_specified
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2021, 12:07am (UTC)

Webview address bar spoofing in LINE client for iOS

👉 https://hackerone.com/reports/1082991

🔹 Severity: Low
🔹 Reported To: LINE
🔹 Reported By: #reinforchu
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2021, 1:17am (UTC)

Use of a Broken or Risky Cryptographic Algorithm

👉 https://hackerone.com/reports/1306942

🔹 Severity: Medium
🔹 Reported To: Revive Adserver
🔹 Reported By: #418sec
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2021, 12:51pm (UTC)

Stored XSS in main page of a project caused by arbitrary noscript payload in group "Default initial branch name"

👉 https://hackerone.com/reports/1256777

🔹 Severity: High | 💰 3,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #joaxcar
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2021, 1:44pm (UTC)

CVE-2021-22945: UAF and double-free in MQTT sending

👉 https://hackerone.com/reports/1269242

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: curl
🔹 Reported By: #z2_
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2021, 2:24pm (UTC)

Bypassing Rate limit for forgot password by using different ip addresses

👉 https://hackerone.com/reports/889246

🔹 Severity: Low
🔹 Reported To: Zivver
🔹 Reported By: #dhirenkumar8280
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2021, 7:36pm (UTC)

[3] Bypassing IP Based Rate Limit Blocking leads to rate limit bypass in Courier Login Panel

👉 https://hackerone.com/reports/1320976

🔹 Severity: No Rating
🔹 Reported To: Courier
🔹 Reported By: #bugera
🔹 State: 🟢 Resolved
🔹 Disclosed: September 16, 2021, 5:31pm (UTC)