BYPASSING COMMENTING ON RESTRICTED AUDIENCE VIDEOS

👉 https://hackerone.com/reports/1337351

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: TikTok
🔹 Reported By: #boynamedboy
🔹 State: 🟢 Resolved
🔹 Disclosed: November 18, 2021, 1:47am (UTC)

Stored XSS via Mermaid Prototype Pollution vulnerability

👉 https://hackerone.com/reports/1280002

🔹 Severity: High | 💰 3,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #misha98857
🔹 State: 🟢 Resolved
🔹 Disclosed: November 18, 2021, 2:03am (UTC)

Stored XSS in Email Templates via link

👉 https://hackerone.com/reports/1376672

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Judge.me
🔹 Reported By: #rioncool22
🔹 State: 🟢 Resolved
🔹 Disclosed: November 18, 2021, 6:05am (UTC)

Open Redirect in www.shopify.dev Environment

👉 https://hackerone.com/reports/842035

🔹 Severity: Medium
🔹 Reported To: Shopify
🔹 Reported By: #beerboy_ankit
🔹 State: 🟢 Resolved
🔹 Disclosed: November 18, 2021, 7:12pm (UTC)

The Host Authorization middleware in Action Pack is vulnerable to crafted X-Forwarded-Host values

👉 https://hackerone.com/reports/1374512

🔹 Severity: Medium | 💰 1,200 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #mshtawythug
🔹 State: 🟢 Resolved
🔹 Disclosed: November 18, 2021, 9:03pm (UTC)

Apache Flink Dashboard exposure at https://streaming-sales-model-production.flink.shopifykloud.com

👉 https://hackerone.com/reports/1262907

🔹 Severity: No Rating | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #savik
🔹 State: 🟢 Resolved
🔹 Disclosed: November 18, 2021, 9:19pm (UTC)

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)

👉 https://hackerone.com/reports/1400238

🔹 Severity: Critical | 💰 1,000 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #fms
🔹 State: 🟢 Resolved
🔹 Disclosed: November 19, 2021, 12:14am (UTC)

Ruby - Regular Expression Denial of Service Vulnerability of Date Parsing Methods

👉 https://hackerone.com/reports/1404789

🔹 Severity: Medium | 💰 1,200 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #svalkanov
🔹 State: 🟢 Resolved
🔹 Disclosed: November 19, 2021, 3:50pm (UTC)

Clickjacking ar https://hackers.upchieve.org/login

👉 https://hackerone.com/reports/1400405

🔹 Severity: Low
🔹 Reported To: UPchieve
🔹 Reported By: #maisanisnotyours
🔹 State: 🔴 N/A
🔹 Disclosed: November 19, 2021, 4:06pm (UTC)

Reflected XSS on av.ru via `q` parameter at https://av.ru/collections/*

👉 https://hackerone.com/reports/965663

🔹 Severity: Medium | 💰 150 USD
🔹 Reported To: Azbuka Vkusa
🔹 Reported By: #ronr
🔹 State: 🟢 Resolved
🔹 Disclosed: November 19, 2021, 4:21pm (UTC)

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.50

👉 https://hackerone.com/reports/1404731

🔹 Severity: Critical | 💰 1,000 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #itsecurityco
🔹 State: 🟢 Resolved
🔹 Disclosed: November 19, 2021, 11:45pm (UTC)

Non privileged user is able to approve his own app himself leading to mass privilege escalations.

👉 https://hackerone.com/reports/1168475

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: Lark Technologies
🔹 Reported By: #imran_nisar
🔹 State: 🟢 Resolved
🔹 Disclosed: November 20, 2021, 2:06am (UTC)

[jitsi-meet] Authentication Bypass when using JWT w/ public keys

👉 https://hackerone.com/reports/1210502

🔹 Severity: Medium
🔹 Reported To: 8x8
🔹 Reported By: #plokta
🔹 State: 🟢 Resolved
🔹 Disclosed: November 20, 2021, 2:55pm (UTC)

Full account takeover of any user through GET /checkout/psp/auth_response?

👉 https://hackerone.com/reports/978542

🔹 Severity: Critical | 💰 2,500 USD
🔹 Reported To: A.S. Watson Group
🔹 Reported By: #sachin_kumar_
🔹 State: 🟢 Resolved
🔹 Disclosed: November 21, 2021, 8:02am (UTC)

Staff who only have apps and channels permission can do a takeover account at the wholesale store (Bypass get invitation link)

👉 https://hackerone.com/reports/1266828

🔹 Severity: Medium | 💰 1,600 USD
🔹 Reported To: Shopify
🔹 Reported By: #hydraxanon82
🔹 State: 🟢 Resolved
🔹 Disclosed: November 21, 2021, 2:59pm (UTC)

No-Rate limit of current password on delete account endpoint(https://www.xvideos.com/account/close)

👉 https://hackerone.com/reports/1392287

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: XVIDEOS
🔹 Reported By: #rajput__16
🔹 State: 🟢 Resolved
🔹 Disclosed: November 23, 2021, 11:02am (UTC)

Blind XSS via Digital Ocean Partner account creation form.

👉 https://hackerone.com/reports/880591

🔹 Severity: High
🔹 Reported To: DigitalOcean
🔹 Reported By: #wshadow
🔹 State: ⚪️ Informative
🔹 Disclosed: November 23, 2021, 6:20pm (UTC)

Cross-site Scripting (XSS) - Stored

👉 https://hackerone.com/reports/1318395

🔹 Severity: High
🔹 Reported To: Mail.ru
🔹 Reported By: #ghost_shell
🔹 State: 🟢 Resolved
🔹 Disclosed: November 25, 2021, 7:42am (UTC)

WordPress Plugin Update Confusion at trafficfactory.com

👉 https://hackerone.com/reports/1364851

🔹 Severity: Low | 💰 200 USD
🔹 Reported To: Traffic Factory
🔹 Reported By: #vavkamil
🔹 State: 🟢 Resolved
🔹 Disclosed: November 25, 2021, 9:11am (UTC)

Sidekiq dashboard exposed at notary.shopifycloud.com

👉 https://hackerone.com/reports/1405673

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #youstin
🔹 State: 🟢 Resolved
🔹 Disclosed: November 25, 2021, 7:28pm (UTC)

A non-privileged user may create an admin account in Stocky

👉 https://hackerone.com/reports/1245736

🔹 Severity: Medium | 💰 1,600 USD
🔹 Reported To: Shopify
🔹 Reported By: #stapia
🔹 State: 🟢 Resolved
🔹 Disclosed: November 25, 2021, 8:43pm (UTC)