Stored xss on helpdesk using user's city

👉 https://hackerone.com/reports/971857

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Lark Technologies
🔹 Reported By: #imran_nisar
🔹 State: 🟢 Resolved
🔹 Disclosed: January 14, 2022, 8:36pm (UTC)

In orginization stored xss using location (Larksuite survey app)

👉 https://hackerone.com/reports/998138

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Lark Technologies
🔹 Reported By: #imran_nisar
🔹 State: 🟢 Resolved
🔹 Disclosed: January 14, 2022, 8:41pm (UTC)

Lack of URL normalization renders Blocked-Previews feature ineffectual

👉 https://hackerone.com/reports/1102764

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: Slack
🔹 Reported By: #jub0bs
🔹 State: 🟢 Resolved
🔹 Disclosed: January 16, 2022, 7:48am (UTC)

Clickjacking

👉 https://hackerone.com/reports/688546

🔹 Severity: No Rating
🔹 Reported To: Palo Alto Software
🔹 Reported By: #paramdham
🔹 State: 🟢 Resolved
🔹 Disclosed: January 17, 2022, 7:27am (UTC)

SSRF & Blind XSS in Gravatar email

👉 https://hackerone.com/reports/1100096

🔹 Severity: High | 💰 750 USD
🔹 Reported To: Automattic
🔹 Reported By: #rockybandana
🔹 State: 🟢 Resolved
🔹 Disclosed: January 17, 2022, 8:44pm (UTC)

DOM XSS through ads

👉 https://hackerone.com/reports/889041

🔹 Severity: Medium
🔹 Reported To: Urban Dictionary
🔹 Reported By: #bemodtwz
🔹 State: 🟢 Resolved
🔹 Disclosed: January 18, 2022, 12:56am (UTC)

Exposed Golang debugger on tier3.riot.mail.ru:9090, 9080

👉 https://hackerone.com/reports/1247910

🔹 Severity: Medium
🔹 Reported To: Mail.ru
🔹 Reported By: #ian
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 7:48am (UTC)

Dom Xss vulnerability

👉 https://hackerone.com/reports/1448616

🔹 Severity: High
🔹 Reported To: Recorded Future
🔹 Reported By: #fornex
🔹 State: ⚪️ Informative
🔹 Disclosed: January 19, 2022, 11:00am (UTC)

User can pay using archived price by manipulating the request sent to `POST /v1/payment_pages/for_plink`

👉 https://hackerone.com/reports/1328278

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: Stripe
🔹 Reported By: #gregxsunday
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 3:19pm (UTC)

Wrong settings in ADF Faces leads to information disclosure

👉 https://hackerone.com/reports/1422641

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #h3xr
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 7:28pm (UTC)

XSS Reflected - ██████████

👉 https://hackerone.com/reports/1223577

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #drauschkolb
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 7:29pm (UTC)

Reflected XSS in https://███████ via hidden parameter "████████"

👉 https://hackerone.com/reports/1029238

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #supr4s
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 7:30pm (UTC)

Reflected XSS on https://███/████via hidden parameter "█████████"

👉 https://hackerone.com/reports/1029243

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #supr4s
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 7:31pm (UTC)

██████████ running a vulnerable log4j

👉 https://hackerone.com/reports/1423496

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #alex_gaynor
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 7:33pm (UTC)

███ ████████ running a vulnerable log4j

👉 https://hackerone.com/reports/1438393

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #alex_gaynor
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 7:35pm (UTC)

[Java] CWE-552: Query to detect unsafe request dispatcher usage

👉 https://hackerone.com/reports/1454582

🔹 Severity: Medium
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #not_specified
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:10pm (UTC)

[Java] CWE-089: MyBatis Mapper XML SQL Injection

👉 https://hackerone.com/reports/1442954

🔹 Severity: High | 💰 4,500 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #jessforfun
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:11pm (UTC)

[Javanoscript]: [Clipboard-based XSS]

👉 https://hackerone.com/reports/1448236

🔹 Severity: Medium
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #not_specified
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:11pm (UTC)

Java: Regex injection

👉 https://hackerone.com/reports/1443028

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #edvraa
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:12pm (UTC)

[Java] CWE-400: Query to detect uncontrolled thread resource consumption

👉 https://hackerone.com/reports/1413542

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #luchua
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:12pm (UTC)

[porcupiney.hairs]: [Python] Add Flask Path injection sinks

👉 https://hackerone.com/reports/1413541

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #porcupineyhairs
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:12pm (UTC)