Vulnerability Name: URL Redirection / Unvalidate Open Redirect

👉 https://hackerone.com/reports/1182824

🔹 Severity: No Rating
🔹 Reported To: Reddit
🔹 Reported By: #hasnain_123
🔹 State: 🔴 N/A
🔹 Disclosed: October 21, 2021, 7:55pm (UTC)

Broken Authendication And Session Management

👉 https://hackerone.com/reports/1167029

🔹 Severity: No Rating
🔹 Reported To: Reddit
🔹 Reported By: #kedibeauty
🔹 State: 🔴 N/A
🔹 Disclosed: October 21, 2021, 7:56pm (UTC)

GPS metadata preserved when converting HEIF to PNG

👉 https://hackerone.com/reports/1069039

🔹 Severity: High | 💰 5,000 USD
🔹 Reported To: Reddit
🔹 Reported By: #ianonavy
🔹 State: 🟢 Resolved
🔹 Disclosed: October 21, 2021, 7:57pm (UTC)

S3 bucket Upload on studio.redditinc.com (s3-r-w.ap-east-1.amazonaws.com)

👉 https://hackerone.com/reports/1276733

🔹 Severity: Low
🔹 Reported To: Reddit
🔹 Reported By: #dinesh07
🔹 State: ⚪️ Informative
🔹 Disclosed: October 21, 2021, 8:00pm (UTC)

Misuse of groups feature allows workspace members to join private channels without being invited

👉 https://hackerone.com/reports/1248852

🔹 Severity: High | 💰 3,500 USD
🔹 Reported To: Slack
🔹 Reported By: #kmap
🔹 State: 🟢 Resolved
🔹 Disclosed: October 21, 2021, 8:08pm (UTC)

Reflected XSS in TikTok endpoints

👉 https://hackerone.com/reports/1350887

🔹 Severity: Medium | 💰 4,500 USD
🔹 Reported To: TikTok
🔹 Reported By: #sh1yo
🔹 State: 🟢 Resolved
🔹 Disclosed: October 22, 2021, 1:44am (UTC)

Broken link profile in the website leads to identity theft.

👉 https://hackerone.com/reports/1343733

🔹 Severity: Medium
🔹 Reported To: Lacework
🔹 Reported By: #spyata
🔹 State: 🟢 Resolved
🔹 Disclosed: October 22, 2021, 5:35pm (UTC)

[Java] CWE-502: Unsafe deserialization with three JSON frameworks

👉 https://hackerone.com/reports/1368720

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #luchua
🔹 State: 🟢 Resolved
🔹 Disclosed: October 22, 2021, 10:21pm (UTC)

[Python]: CWE-117 Log Injection

👉 https://hackerone.com/reports/1368721

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #jessforfun
🔹 State: 🟢 Resolved
🔹 Disclosed: October 22, 2021, 10:21pm (UTC)

[cpp] CWE-787: query to detect unsigned integer to signed integer conversions used in pointer arithmetics

👉 https://hackerone.com/reports/1378946

🔹 Severity: High
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #not_specified
🔹 State: 🟢 Resolved
🔹 Disclosed: October 22, 2021, 10:21pm (UTC)

[Java] CWE-552: Unsafe url forward

👉 https://hackerone.com/reports/1378947

🔹 Severity: Medium
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #not_specified
🔹 State: 🟢 Resolved
🔹 Disclosed: October 22, 2021, 10:22pm (UTC)

XSS on tiktok.com

👉 https://hackerone.com/reports/1322104

🔹 Severity: Medium | 💰 2,000 USD
🔹 Reported To: TikTok
🔹 Reported By: #arifmkhls
🔹 State: 🟢 Resolved
🔹 Disclosed: October 23, 2021, 12:36am (UTC)

Script breaking tag (Forces website to render blank) (Informative)

👉 https://hackerone.com/reports/1355537

🔹 Severity: Low | 💰 150 USD
🔹 Reported To: XVIDEOS
🔹 Reported By: #ch1ck3n42
🔹 State: 🟢 Resolved
🔹 Disclosed: October 23, 2021, 2:50pm (UTC)

Image queue default key of 'None' and GraphQL unhandled type exception

👉 https://hackerone.com/reports/996041

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Reddit
🔹 Reported By: #moblig
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2021, 2:04pm (UTC)

Outsider can affect Upvote Percentage of private subreddit post by calling /api/vote API

👉 https://hackerone.com/reports/1298902

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Reddit
🔹 Reported By: #trieulieuf9
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2021, 2:05pm (UTC)

Race condition leads to Inflation of coins when bought via Google Play Store at endpoint https://oauth.reddit.com/api/v2/gold/android/verify_purchase

👉 https://hackerone.com/reports/801743

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Reddit
🔹 Reported By: #yashrs
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2021, 2:08pm (UTC)

Third party app could steal access token as well as protected files using inAppBrowser

👉 https://hackerone.com/reports/1122177

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Reddit
🔹 Reported By: #rahulkankrale
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2021, 2:10pm (UTC)

Content Spoofing/Text Injection at https://gateway-production.dubsmash.com

👉 https://hackerone.com/reports/1166770

🔹 Severity: No Rating
🔹 Reported To: Reddit
🔹 Reported By: #karthik86
🔹 State: 🔴 N/A
🔹 Disclosed: October 27, 2021, 2:11pm (UTC)

Missing rate limit in current password change settings leads to Account takeover

👉 https://hackerone.com/reports/1170522

🔹 Severity: Medium
🔹 Reported To: Reddit
🔹 Reported By: #m0hacks
🔹 State: 🟤 Duplicate
🔹 Disclosed: October 27, 2021, 2:12pm (UTC)

Exposed PHP dependencies at ██.8x8.com

👉 https://hackerone.com/reports/1132457

🔹 Severity: Low
🔹 Reported To: 8x8
🔹 Reported By: #ian
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2021, 4:12pm (UTC)

Dependency on private SSH keys in public github

👉 https://hackerone.com/reports/974176

🔹 Severity: High
🔹 Reported To: Agoric
🔹 Reported By: #pacmanx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2021, 4:18pm (UTC)