SSRF & Blind XSS in Gravatar email

👉 https://hackerone.com/reports/1100096

🔹 Severity: High | 💰 750 USD
🔹 Reported To: Automattic
🔹 Reported By: #rockybandana
🔹 State: 🟢 Resolved
🔹 Disclosed: January 17, 2022, 8:44pm (UTC)

DOM XSS through ads

👉 https://hackerone.com/reports/889041

🔹 Severity: Medium
🔹 Reported To: Urban Dictionary
🔹 Reported By: #bemodtwz
🔹 State: 🟢 Resolved
🔹 Disclosed: January 18, 2022, 12:56am (UTC)

Exposed Golang debugger on tier3.riot.mail.ru:9090, 9080

👉 https://hackerone.com/reports/1247910

🔹 Severity: Medium
🔹 Reported To: Mail.ru
🔹 Reported By: #ian
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 7:48am (UTC)

Dom Xss vulnerability

👉 https://hackerone.com/reports/1448616

🔹 Severity: High
🔹 Reported To: Recorded Future
🔹 Reported By: #fornex
🔹 State: ⚪️ Informative
🔹 Disclosed: January 19, 2022, 11:00am (UTC)

User can pay using archived price by manipulating the request sent to `POST /v1/payment_pages/for_plink`

👉 https://hackerone.com/reports/1328278

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: Stripe
🔹 Reported By: #gregxsunday
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 3:19pm (UTC)

Wrong settings in ADF Faces leads to information disclosure

👉 https://hackerone.com/reports/1422641

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #h3xr
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 7:28pm (UTC)

XSS Reflected - ██████████

👉 https://hackerone.com/reports/1223577

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #drauschkolb
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 7:29pm (UTC)

Reflected XSS in https://███████ via hidden parameter "████████"

👉 https://hackerone.com/reports/1029238

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #supr4s
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 7:30pm (UTC)

Reflected XSS on https://███/████via hidden parameter "█████████"

👉 https://hackerone.com/reports/1029243

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #supr4s
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 7:31pm (UTC)

██████████ running a vulnerable log4j

👉 https://hackerone.com/reports/1423496

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #alex_gaynor
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 7:33pm (UTC)

███ ████████ running a vulnerable log4j

👉 https://hackerone.com/reports/1438393

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #alex_gaynor
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 7:35pm (UTC)

[Java] CWE-552: Query to detect unsafe request dispatcher usage

👉 https://hackerone.com/reports/1454582

🔹 Severity: Medium
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #not_specified
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:10pm (UTC)

[Java] CWE-089: MyBatis Mapper XML SQL Injection

👉 https://hackerone.com/reports/1442954

🔹 Severity: High | 💰 4,500 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #jessforfun
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:11pm (UTC)

[Javanoscript]: [Clipboard-based XSS]

👉 https://hackerone.com/reports/1448236

🔹 Severity: Medium
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #not_specified
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:11pm (UTC)

Java: Regex injection

👉 https://hackerone.com/reports/1443028

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #edvraa
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:12pm (UTC)

[Java] CWE-400: Query to detect uncontrolled thread resource consumption

👉 https://hackerone.com/reports/1413542

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #luchua
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:12pm (UTC)

[porcupiney.hairs]: [Python] Add Flask Path injection sinks

👉 https://hackerone.com/reports/1413541

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #porcupineyhairs
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:12pm (UTC)

ihsinme: CPP Add query for CWE-675 Duplicate Operations on Resource

👉 https://hackerone.com/reports/1413540

🔹 Severity: Low | 💰 1,000 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #ihsinme
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:13pm (UTC)

[Python]: JWT security-related queries

👉 https://hackerone.com/reports/1403263

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #jorgectf
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:13pm (UTC)

[Python]: CWE-079: HTTP Header injection

👉 https://hackerone.com/reports/1401159

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #jorgectf
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:13pm (UTC)

[GO]: [CWE-090: LDAP Injection All For One]

👉 https://hackerone.com/reports/1397942

🔹 Severity: Medium | 💰 1,800 USD
🔹 Reported To: GitHub Security Lab
🔹 Reported By: #pupiles
🔹 State: 🟢 Resolved
🔹 Disclosed: January 19, 2022, 10:13pm (UTC)