Archived / Deleted / Private Poll Can Be Viewed by Another Users [Crowdsignal WordPress plugins]

👉 https://hackerone.com/reports/1711318

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Automattic
🔹 Reported By: #apapedulimu
🔹 State: 🟢 Resolved
🔹 Disclosed: November 3, 2022, 11:41am (UTC)

Command injection in GitHub Actions ContainerStepHost

👉 https://hackerone.com/reports/1637621

🔹 Severity: No Rating | 💰 4,000 USD
🔹 Reported To: GitHub
🔹 Reported By: #jupenur
🔹 State: 🟢 Resolved
🔹 Disclosed: November 3, 2022, 3:33pm (UTC)

RepositoryPipeline allows importing of local git repos

👉 https://hackerone.com/reports/1685822

🔹 Severity: Medium | 💰 22,300 USD
🔹 Reported To: GitLab
🔹 Reported By: #vakzz
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2022, 3:43am (UTC)

DOS via move_issue

👉 https://hackerone.com/reports/1543584

🔹 Severity: Medium | 💰 2,300 USD
🔹 Reported To: GitLab
🔹 Reported By: #legit-security
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2022, 3:44am (UTC)

Path paths and file disclosure vulnerabilities at influxdb.quality.gitlab.net

👉 https://hackerone.com/reports/1643962

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: GitLab
🔹 Reported By: #otoyyy
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2022, 3:46am (UTC)

DOS via issue preview

👉 https://hackerone.com/reports/1543718

🔹 Severity: High | 💰 7,640 USD
🔹 Reported To: GitLab
🔹 Reported By: #legit-security
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2022, 3:47am (UTC)

CSS Injection via Client Side Path Traversal + Open Redirect leads to personal data exfiltration on Acronis Cloud

👉 https://hackerone.com/reports/1245165

🔹 Severity: Medium | 💰 250 USD
🔹 Reported To: Acronis
🔹 Reported By: #mr-medi
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2022, 7:38pm (UTC)

CVE-2022-35252: control code in cookie denial of service

👉 https://hackerone.com/reports/1686935

🔹 Severity: Low | 💰 480 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #haxatron1
🔹 State: 🟢 Resolved
🔹 Disclosed: November 5, 2022, 2:50pm (UTC)

Completely remove VPN profile from locked WARP iOS cient.

👉 https://hackerone.com/reports/1633231

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: #joshatmotion
🔹 State: 🟢 Resolved
🔹 Disclosed: November 7, 2022, 10:59am (UTC)

Bypass Cloudflare WARP lock on iOS.

👉 https://hackerone.com/reports/1542450

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: #joshatmotion
🔹 State: 🟢 Resolved
🔹 Disclosed: November 7, 2022, 11:02am (UTC)

I found another way to bypass Cloudflare Warp lock!

👉 https://hackerone.com/reports/1605847

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: #joshatmotion
🔹 State: 🟢 Resolved
🔹 Disclosed: November 7, 2022, 11:02am (UTC)

Exceed photo dimensions, Flickr.com

👉 https://hackerone.com/reports/1755552

🔹 Severity: Low | 💰 50 USD
🔹 Reported To: Flickr
🔹 Reported By: #0xcyborg
🔹 State: ⚪️ Informative
🔹 Disclosed: November 7, 2022, 5:53pm (UTC)

Subdomain Takeover via Unclaimed Amazon S3 Bucket (Musical.ly)

👉 https://hackerone.com/reports/1102537

🔹 Severity: Low | 💰 200 USD
🔹 Reported To: TikTok
🔹 Reported By: #daik0n
🔹 State: 🟢 Resolved
🔹 Disclosed: November 7, 2022, 9:34pm (UTC)

Public Github Repo Leaking Internal Credentials

👉 https://hackerone.com/reports/1763266

🔹 Severity: Critical
🔹 Reported To: Yelp
🔹 Reported By: #xinfohuggerx
🔹 State: ⚪️ Informative
🔹 Disclosed: November 7, 2022, 11:45pm (UTC)

[Kafka Connect] [JdbcSinkConnector][HttpSinkConnector] RCE by leveraging file upload via SQLite JDBC driver and SSRF to internal Jolokia

👉 https://hackerone.com/reports/1547877

🔹 Severity: Critical | 💰 5,000 USD
🔹 Reported To: Aiven Ltd
🔹 Reported By: #jarij
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2022, 6:29am (UTC)

Grafana RCE via SMTP server parameter injection

👉 https://hackerone.com/reports/1200647

🔹 Severity: Critical | 💰 5,000 USD
🔹 Reported To: Aiven Ltd
🔹 Reported By: #jarij
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2022, 6:29am (UTC)

Kafka Connect RCE via connector SASL JAAS JndiLoginModule configuration

👉 https://hackerone.com/reports/1529790

🔹 Severity: Critical | 💰 5,000 USD
🔹 Reported To: Aiven Ltd
🔹 Reported By: #jarij
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2022, 6:30am (UTC)

Apache Flink RCE via GET jar/plan API Endpoint

👉 https://hackerone.com/reports/1418891

🔹 Severity: Critical | 💰 6,000 USD
🔹 Reported To: Aiven Ltd
🔹 Reported By: #jarij
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2022, 6:30am (UTC)

Self-XSS on Suggest Tag dialog box

👉 https://hackerone.com/reports/1761505

🔹 Severity: Low | 💰 50 USD
🔹 Reported To: XVIDEOS
🔹 Reported By: #j3rry4unt
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2022, 7:19pm (UTC)

Host Header Injection Attack - www.xnxx.com

👉 https://hackerone.com/reports/1630073

🔹 Severity: No Rating
🔹 Reported To: XVIDEOS
🔹 Reported By: #cyber_anon
🔹 State: ⚪️ Informative
🔹 Disclosed: November 8, 2022, 7:25pm (UTC)

api keys leaked

👉 https://hackerone.com/reports/1762927

🔹 Severity: Medium
🔹 Reported To: Reddit
🔹 Reported By: #saibalajis6
🔹 State: ⚪️ Informative
🔹 Disclosed: November 10, 2022, 2:40pm (UTC)