weak protection against brute-forcing on login api leads to account takeover

👉 https://hackerone.com/reports/766875

🔹 Severity: Critical
🔹 Reported To: Palo Alto Software
🔹 Reported By: #zer0code
🔹 State: 🟢 Resolved
🔹 Disclosed: August 29, 2022, 6:23pm (UTC)

TikTok's pixel/sdk.js leaks current URL from websites using postMessage

👉 https://hackerone.com/reports/1598749

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: TikTok
🔹 Reported By: #fransrosen
🔹 State: 🟢 Resolved
🔹 Disclosed: August 30, 2022, 6:25pm (UTC)

Blind SSRF on platform.dash.cloudflare.com Due to Sentry misconfiguration

👉 https://hackerone.com/reports/1467044

🔹 Severity: Low | 💰 200 USD
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: #lohigowda
🔹 State: 🟢 Resolved
🔹 Disclosed: August 31, 2022, 10:54am (UTC)

CVE-2022-35252: control code in cookie denial of service

👉 https://hackerone.com/reports/1613943

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: #haxatron1
🔹 State: 🟢 Resolved
🔹 Disclosed: August 31, 2022, 10:55am (UTC)

Enable 2Fa verification without verifying email leads account takeover

👉 https://hackerone.com/reports/1618021

🔹 Severity: Medium | 💰 350 USD
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: #motu-vai
🔹 State: 🟢 Resolved
🔹 Disclosed: August 31, 2022, 3:43pm (UTC)

Password reset tokens sent to CSP reporting endpoints

👉 https://hackerone.com/reports/1626281

🔹 Severity: Low | 💰 250 USD
🔹 Reported To: Snapchat
🔹 Reported By: #mahfujwhh
🔹 State: 🟢 Resolved
🔹 Disclosed: August 31, 2022, 11:53pm (UTC)

Any expired reset password link can still be used to reset the password

👉 https://hackerone.com/reports/1615790

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Acronis
🔹 Reported By: #mrccrqr
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2022, 9:31am (UTC)

Remote denial of service in HyperLedger Fabric

👉 https://hackerone.com/reports/1635854

🔹 Severity: High | 💰 1,500 USD
🔹 Reported To: Hyperledger
🔹 Reported By: #fatal0
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2022, 2:05pm (UTC)

API Key reported in #1465145 not rotated and thus is still valid and can be used by anyone

👉 https://hackerone.com/reports/1591770

🔹 Severity: Low
🔹 Reported To: Adobe
🔹 Reported By: #aneeeketh
🔹 State: ⚪️ Informative
🔹 Disclosed: September 1, 2022, 4:05pm (UTC)

Remote code execution due to unvalidated file upload

👉 https://hackerone.com/reports/1164452

🔹 Severity: Critical
🔹 Reported To: MTN Group
🔹 Reported By: #aliyugombe
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2022, 5:29pm (UTC)

Password reset token leak on third party website via Referer header [cloudivr.mtnbusiness.com.ng]

👉 https://hackerone.com/reports/1320242

🔹 Severity: Medium
🔹 Reported To: MTN Group
🔹 Reported By: #ibrahimatix0x01
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2022, 8:21pm (UTC)

Default Admin Username and Password on remedysso.mtncameroon.net

👉 https://hackerone.com/reports/1397786

🔹 Severity: High
🔹 Reported To: MTN Group
🔹 Reported By: #dh0pe
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2022, 8:50pm (UTC)

Sensitive Information Disclosure Through Config File

👉 https://hackerone.com/reports/1397788

🔹 Severity: High
🔹 Reported To: MTN Group
🔹 Reported By: #dh0pe
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2022, 8:50pm (UTC)

IDOR on TikTok Ads Endpoint

👉 https://hackerone.com/reports/1527906

🔹 Severity: Medium | 💰 2,500 USD
🔹 Reported To: TikTok
🔹 Reported By: #sinayeganeh
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2022, 9:23pm (UTC)

Wordpress users disclosure from json and xml file

👉 https://hackerone.com/reports/1408589

🔹 Severity: Low
🔹 Reported To: MTN Group
🔹 Reported By: #drak3hft7
🔹 State: 🟢 Resolved
🔹 Disclosed: September 2, 2022, 9:25am (UTC)

Weak/Auto Fill Password

👉 https://hackerone.com/reports/817331

🔹 Severity: Critical
🔹 Reported To: MTN Group
🔹 Reported By: #harrisoft
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2022, 12:23am (UTC)

Federated share accepting/declining is not logged in audit log

👉 https://hackerone.com/reports/1200815

🔹 Severity: Low
🔹 Reported To: Nextcloud
🔹 Reported By: #rtod
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2022, 6:12am (UTC)

Password disclosure in initial setup of Mail App

👉 https://hackerone.com/reports/1561471

🔹 Severity: Low
🔹 Reported To: Nextcloud
🔹 Reported By: #anna_larch
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2022, 6:23am (UTC)

Brute force protections don't work

👉 https://hackerone.com/reports/1596918

🔹 Severity: Low
🔹 Reported To: Nextcloud
🔹 Reported By: #nickvergessen
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2022, 6:25am (UTC)

Unauthenticated SSRF in 3rd party module "cerdic/csstidy"

👉 https://hackerone.com/reports/1595006

🔹 Severity: Medium | 💰 250 USD
🔹 Reported To: Nextcloud
🔹 Reported By: #eg42
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2022, 6:29am (UTC)

path traversal vulnerability in Grafana 8.x allows " local file read "

👉 https://hackerone.com/reports/1427086

🔹 Severity: Critical
🔹 Reported To: MTN Group
🔹 Reported By: #a-heybati
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2022, 12:14pm (UTC)