One Click XSS in [www.shopify.com]

👉 https://hackerone.com/reports/1563334

🔹 Severity: No Rating | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #comwrg
🔹 State: 🟢 Resolved
🔹 Disclosed: July 13, 2022, 6:13am (UTC)

Undici ProxyAgent vulnerable to MITM

👉 https://hackerone.com/reports/1599063

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #pimterry
🔹 State: 🟢 Resolved
🔹 Disclosed: July 13, 2022, 1:20pm (UTC)

Undici does not use CONNECT or otherwise validate upstream HTTPS certificates when using a proxy

👉 https://hackerone.com/reports/1583680

🔹 Severity: High
🔹 Reported To: Node.js
🔹 Reported By: #pimterry
🔹 State: 🟢 Resolved
🔹 Disclosed: July 13, 2022, 2:47pm (UTC)

Stored XSS for Grafana dashboard URL

👉 https://hackerone.com/reports/684268

🔹 Severity: High | 💰 2,500 USD
🔹 Reported To: GitLab
🔹 Reported By: #xanbanx
🔹 State: 🟢 Resolved
🔹 Disclosed: July 13, 2022, 3:12pm (UTC)

[h1-2102] shopApps query from the graphql at /users/api returns all existing created apps, including private ones

👉 https://hackerone.com/reports/1085332

🔹 Severity: Medium | 💰 1,900 USD
🔹 Reported To: Shopify
🔹 Reported By: #inhibitor181
🔹 State: 🟢 Resolved
🔹 Disclosed: July 15, 2022, 8:23am (UTC)

POST BASED REFLECTED XSS IN dailydeals.mtn.co.za

👉 https://hackerone.com/reports/1451394

🔹 Severity: High
🔹 Reported To: MTN Group
🔹 Reported By: #shuvam321
🔹 State: 🟢 Resolved
🔹 Disclosed: July 15, 2022, 9:56am (UTC)

Add me email address Authentication bypass

👉 https://hackerone.com/reports/1607645

🔹 Severity: No Rating
🔹 Reported To: LinkedIn
🔹 Reported By: #raajeevrathnam
🔹 State: ⚪️ Informative
🔹 Disclosed: July 15, 2022, 4:33pm (UTC)

Insecure Object Permissions for Guest User leads to access to internal documents!

👉 https://hackerone.com/reports/1089583

🔹 Severity: Critical
🔹 Reported To: IBM
🔹 Reported By: #mocr7
🔹 State: 🟢 Resolved
🔹 Disclosed: July 15, 2022, 5:40pm (UTC)

Can use the Reddit android app as usual even though revoking the access of it from reddit.com

👉 https://hackerone.com/reports/1632186

🔹 Severity: Critical
🔹 Reported To: Reddit
🔹 Reported By: #sateeshn
🔹 State: ⚪️ Informative
🔹 Disclosed: July 16, 2022, 11:10am (UTC)

Information disclosure ( Google Sales Channel )

👉 https://hackerone.com/reports/1584718

🔹 Severity: No Rating | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #hydraxanon82
🔹 State: 🟢 Resolved
🔹 Disclosed: July 17, 2022, 2:10pm (UTC)

Open Redirect ███.8x8.com

👉 https://hackerone.com/reports/1637571

🔹 Severity: Low
🔹 Reported To: 8x8
🔹 Reported By: #mr_k0anti
🔹 State: 🟢 Resolved
🔹 Disclosed: July 17, 2022, 11:54pm (UTC)

Public Apache Tomcat /examples example directory

👉 https://hackerone.com/reports/1622624

🔹 Severity: Medium
🔹 Reported To: 8x8
🔹 Reported By: #mr_k0anti
🔹 State: 🟢 Resolved
🔹 Disclosed: July 18, 2022, 12:04am (UTC)

CVE-2019-11248 on http://█.█.█.█:9100/debug/pprof/goroutine

👉 https://hackerone.com/reports/1607940

🔹 Severity: Low
🔹 Reported To: 8x8
🔹 Reported By: #mr_k0anti
🔹 State: 🟢 Resolved
🔹 Disclosed: July 18, 2022, 12:14am (UTC)

Cross-site noscripting (DOM-based)

👉 https://hackerone.com/reports/1512644

🔹 Severity: Medium
🔹 Reported To: OneWeb
🔹 Reported By: #thewikiii
🔹 State: ⚪️ Informative
🔹 Disclosed: July 18, 2022, 9:50am (UTC)

unauth mosquitto ( client emails, ips, license keys exposure )

👉 https://hackerone.com/reports/1578574

🔹 Severity: Medium | 💰 150 USD
🔹 Reported To: Acronis
🔹 Reported By: #second_grade_pentester
🔹 State: 🟢 Resolved
🔹 Disclosed: July 18, 2022, 11:39am (UTC)

subdomain takeover at odoo-staging.exness.io

👉 https://hackerone.com/reports/1540252

🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: EXNESS
🔹 Reported By: #omer
🔹 State: 🟢 Resolved
🔹 Disclosed: July 18, 2022, 2:43pm (UTC)

Without verifying email and activate account, user can perform all action which are not supposed to be done

👉 https://hackerone.com/reports/1272305

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Stripe
🔹 Reported By: #tabaahi
🔹 State: 🟢 Resolved
🔹 Disclosed: July 18, 2022, 3:44pm (UTC)

HTML Injection in E-mail Not Resolved ()

👉 https://hackerone.com/reports/1600720

🔹 Severity: Medium
🔹 Reported To: Acronis
🔹 Reported By: #thewikiii
🔹 State: 🟢 Resolved
🔹 Disclosed: July 19, 2022, 9:11am (UTC)

LFI via Jolokia at https://█.█.█.█:1293

👉 https://hackerone.com/reports/1641661

🔹 Severity: Medium
🔹 Reported To: 8x8
🔹 Reported By: #shuvam321
🔹 State: 🟢 Resolved
🔹 Disclosed: July 20, 2022, 12:30am (UTC)

Can access the job name, creator name and can report any draft/under review/rejected job

👉 https://hackerone.com/reports/1581528

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: LinkedIn
🔹 Reported By: #sachin_kumar_
🔹 State: 🟢 Resolved
🔹 Disclosed: July 20, 2022, 6:08pm (UTC)

Internal Employee informations Disclosure via TikTok Athena api

👉 https://hackerone.com/reports/1575560

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: TikTok
🔹 Reported By: #hein_thant
🔹 State: 🟢 Resolved
🔹 Disclosed: July 20, 2022, 11:38pm (UTC)