Reflected xss on videostore.mtnonline.com

👉 https://hackerone.com/reports/1646248

🔹 Severity: High
🔹 Reported To: MTN Group
🔹 Reported By: #possowski
🔹 State: 🟢 Resolved
🔹 Disclosed: September 25, 2022, 7:10pm (UTC)

Main Domain Takeover at https://www.marketo.net/

👉 https://hackerone.com/reports/1661914

🔹 Severity: Critical
🔹 Reported To: Adobe
🔹 Reported By: #gdattacker
🔹 State: 🟢 Resolved
🔹 Disclosed: September 26, 2022, 3:05pm (UTC)

XSS Reflected on reddit.com via url path

👉 https://hackerone.com/reports/1051373

🔹 Severity: High | 💰 5,000 USD
🔹 Reported To: Reddit
🔹 Reported By: #criptex
🔹 State: 🟢 Resolved
🔹 Disclosed: September 27, 2022, 4:04pm (UTC)

insecure gitlab repositories at ████████ [HtUS]

👉 https://hackerone.com/reports/1624152

🔹 Severity: High | 💰 500 USD
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #thpless
🔹 State: 🟢 Resolved
🔹 Disclosed: September 27, 2022, 6:18pm (UTC)

password field autocomplete enabled

👉 https://hackerone.com/reports/1023773

🔹 Severity: Medium
🔹 Reported To: Yelp
🔹 Reported By: #er_salil
🔹 State: ⚪️ Informative
🔹 Disclosed: September 27, 2022, 11:26pm (UTC)

CORS Misconfiguration on Yelp

👉 https://hackerone.com/reports/1707616

🔹 Severity: Medium
🔹 Reported To: Yelp
🔹 Reported By: #qualwin3001
🔹 State: ⚪️ Informative
🔹 Disclosed: September 28, 2022, 3:43am (UTC)

Directory Listing vulnerability on █.packet8.net/php/include/

👉 https://hackerone.com/reports/790846

🔹 Severity: Low
🔹 Reported To: 8x8
🔹 Reported By: #rajauzairabdullah
🔹 State: 🟢 Resolved
🔹 Disclosed: September 28, 2022, 4:41am (UTC)

Server-side request forgery (ssrf)

👉 https://hackerone.com/reports/1712240

🔹 Severity: Medium
🔹 Reported To: Yelp
🔹 Reported By: #raja404
🔹 State: 🔴 N/A
🔹 Disclosed: September 28, 2022, 7:54am (UTC)

DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)

👉 https://hackerone.com/reports/1632921

🔹 Severity: High
🔹 Reported To: Node.js
🔹 Reported By: #zeyu2001
🔹 State: 🟢 Resolved
🔹 Disclosed: September 28, 2022, 8:38am (UTC)

Take over subdomains of r2.dev using R2 custom domains

👉 https://hackerone.com/reports/1700276

🔹 Severity: Medium | 💰 1,125 USD
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: #albertspedersen
🔹 State: 🟢 Resolved
🔹 Disclosed: September 28, 2022, 12:49pm (UTC)

CSV export/import functionality allows administrators to modify member and message content of a workspace

👉 https://hackerone.com/reports/1661310

🔹 Severity: No Rating | 💰 250 USD
🔹 Reported To: Slack
🔹 Reported By: #security_warrior
🔹 State: ⚪️ Informative
🔹 Disclosed: September 28, 2022, 8:30pm (UTC)

XSS in Widget Review Form Preview in settings

👉 https://hackerone.com/reports/1595905

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Judge.me
🔹 Reported By: #penguinshelp
🔹 State: 🟢 Resolved
🔹 Disclosed: September 29, 2022, 8:35am (UTC)

no rate limit in forgot password session

👉 https://hackerone.com/reports/1714970

🔹 Severity: Medium
🔹 Reported To: Yelp
🔹 Reported By: #irfadps
🔹 State: 🔴 N/A
🔹 Disclosed: September 29, 2022, 6:17pm (UTC)

Open Redirect

👉 https://hackerone.com/reports/1581258

🔹 Severity: Low | 💰 258 USD
🔹 Reported To: Flickr
🔹 Reported By: #stevejubs
🔹 State: 🟢 Resolved
🔹 Disclosed: September 29, 2022, 10:51pm (UTC)

Password Policy Restriction Bypass

👉 https://hackerone.com/reports/1675730

🔹 Severity: Low | 💰 250 USD
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: #lohigowda
🔹 State: 🟢 Resolved
🔹 Disclosed: September 30, 2022, 8:50am (UTC)

Lack of Packet Sanitation in Goflow Results in Multiple DoS Attack Vectors and Bugs

👉 https://hackerone.com/reports/1636320

🔹 Severity: High | 💰 500 USD
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: #path_network
🔹 State: 🟢 Resolved
🔹 Disclosed: September 30, 2022, 11:15am (UTC)

Unrestricted File Upload on reddit.secure.force.com

👉 https://hackerone.com/reports/1606957

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Reddit
🔹 Reported By: #heckintosh
🔹 State: 🟢 Resolved
🔹 Disclosed: September 30, 2022, 2:56pm (UTC)

IDOR allows an attacker to modify the links of any user

👉 https://hackerone.com/reports/1661113

🔹 Severity: High | 💰 5,000 USD
🔹 Reported To: Reddit
🔹 Reported By: #criptex
🔹 State: 🟢 Resolved
🔹 Disclosed: September 30, 2022, 3:09pm (UTC)

Open Redirect on www.redditinc.com via `failed` query param bypass after fixed bug #1257753

👉 https://hackerone.com/reports/1285081

🔹 Severity: Medium | 💰 200 USD
🔹 Reported To: Reddit
🔹 Reported By: #lu3ky-13
🔹 State: 🟢 Resolved
🔹 Disclosed: September 30, 2022, 3:11pm (UTC)

Bypassing authorization of linked Instagram account

👉 https://hackerone.com/reports/1199965

🔹 Severity: Low | 💰 170 USD
🔹 Reported To: TikTok
🔹 Reported By: #ckerha
🔹 State: 🟢 Resolved
🔹 Disclosed: September 30, 2022, 9:30pm (UTC)

Generated passwords are not fully validated by HIBPValidator

👉 https://hackerone.com/reports/1606961

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Nextcloud
🔹 Reported By: #bjoernv
🔹 State: 🟢 Resolved
🔹 Disclosed: October 1, 2022, 4:50am (UTC)