Subdomain takeover at http://test.www.midigator.com

👉 https://hackerone.com/reports/1718371

🔹 Severity: High
🔹 Reported To: Equifax
🔹 Reported By: #valluvarsploit_h1
🔹 State: 🟢 Resolved
🔹 Disclosed: November 12, 2022, 4:05pm (UTC)

Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.

👉 https://hackerone.com/reports/1596663

🔹 Severity: High | 💰 5,000 USD
🔹 Reported To: Reddit
🔹 Reported By: #41bin
🔹 State: 🟢 Resolved
🔹 Disclosed: November 14, 2022, 4:34am (UTC)

Open redirect at mc-beta-cloud-acronis.com

👉 https://hackerone.com/reports/846389

🔹 Severity: No Rating
🔹 Reported To: Acronis
🔹 Reported By: #angeltsvetkov
🔹 State: 🟢 Resolved
🔹 Disclosed: November 15, 2022, 9:49am (UTC)

New /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fields

👉 https://hackerone.com/reports/1578400

🔹 Severity: High | 💰 13,950 USD
🔹 Reported To: GitLab
🔹 Reported By: #cryptopone
🔹 State: 🟢 Resolved
🔹 Disclosed: November 16, 2022, 1:07am (UTC)

XSS: `v-safe-html` is not safe enough

👉 https://hackerone.com/reports/1579645

🔹 Severity: High | 💰 6,580 USD
🔹 Reported To: GitLab
🔹 Reported By: #yvvdwf
🔹 State: 🟢 Resolved
🔹 Disclosed: November 16, 2022, 1:08am (UTC)

CSP-bypass XSS in project settings page

👉 https://hackerone.com/reports/1588732

🔹 Severity: High | 💰 10,270 USD
🔹 Reported To: GitLab
🔹 Reported By: #yvvdwf
🔹 State: 🟢 Resolved
🔹 Disclosed: November 16, 2022, 1:08am (UTC)

RCE via github import

👉 https://hackerone.com/reports/1672388

🔹 Severity: Critical | 💰 33,510 USD
🔹 Reported To: GitLab
🔹 Reported By: #yvvdwf
🔹 State: 🟢 Resolved
🔹 Disclosed: November 16, 2022, 1:10am (UTC)

Ability to bypass locked Cloudflare WARP on wifi networks.

👉 https://hackerone.com/reports/1635748

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: #joshatmotion
🔹 State: 🟢 Resolved
🔹 Disclosed: November 16, 2022, 8:59am (UTC)

[Git Gud] GitHub.com Svnbridge memcached deserialization vulnerability chain leading to Remote Code Execution

👉 https://hackerone.com/reports/1593913

🔹 Severity: Medium | 💰 17,500 USD
🔹 Reported To: GitHub
🔹 Reported By: #ajxchapman
🔹 State: 🟢 Resolved
🔹 Disclosed: November 16, 2022, 9:22pm (UTC)

CSRF in AppSearch allows creation of "curations"

👉 https://hackerone.com/reports/1477050

🔹 Severity: Medium | 💰 833 USD
🔹 Reported To: Elastic
🔹 Reported By: #dee-see
🔹 State: 🟢 Resolved
🔹 Disclosed: November 17, 2022, 1:26pm (UTC)

Directory Listing at https://█.█.█.█

👉 https://hackerone.com/reports/1771051

🔹 Severity: Low
🔹 Reported To: 8x8
🔹 Reported By: #shuvam321
🔹 State: 🟢 Resolved
🔹 Disclosed: November 18, 2022, 1:49am (UTC)

Default password on 34.120.209.175

👉 https://hackerone.com/reports/1415241

🔹 Severity: Medium | 💰 245 USD
🔹 Reported To: Elastic
🔹 Reported By: #newspaper
🔹 State: 🟢 Resolved
🔹 Disclosed: November 18, 2022, 8:14am (UTC)

LOGJ4 VUlnerability [HtUS]

👉 https://hackerone.com/reports/1624137

🔹 Severity: Critical | 💰 1,000 USD
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #fklet
🔹 State: 🟢 Resolved
🔹 Disclosed: November 18, 2022, 6:07pm (UTC)

Reflected XSS | https://████████

👉 https://hackerone.com/reports/1736433

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #x3ph_
🔹 State: 🟢 Resolved
🔹 Disclosed: November 18, 2022, 6:33pm (UTC)

Reflected XSS | https://████

👉 https://hackerone.com/reports/1736432

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #x3ph_
🔹 State: 🟢 Resolved
🔹 Disclosed: November 18, 2022, 6:34pm (UTC)

IDOR on ███████ [HtUS]

👉 https://hackerone.com/reports/1627974

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #nightm4re
🔹 State: 🟢 Resolved
🔹 Disclosed: November 18, 2022, 6:36pm (UTC)

Open Redirect at █████

👉 https://hackerone.com/reports/1634105

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #angeltsvetkov
🔹 State: 🟢 Resolved
🔹 Disclosed: November 18, 2022, 6:37pm (UTC)

Reflected XSS in chatbot

👉 https://hackerone.com/reports/1735622

🔹 Severity: Medium
🔹 Reported To: MTN Group
🔹 Reported By: #roland_hack
🔹 State: 🟢 Resolved
🔹 Disclosed: November 19, 2022, 3:56pm (UTC)

No rate limiting for Remove Account lead to huge Mass mailings

👉 https://hackerone.com/reports/1723445

🔹 Severity: No Rating
🔹 Reported To: Weblate
🔹 Reported By: #tanvir_0x
🔹 State: 🟢 Resolved
🔹 Disclosed: November 20, 2022, 9:08am (UTC)

Dependecy Confusion via Lookup Request Forwarding to PyPi.org

👉 https://hackerone.com/reports/1681275

🔹 Severity: No Rating
🔹 Reported To: GitLab
🔹 Reported By: #usd-responsible-disclosure
🔹 State: ⚪️ Informative
🔹 Disclosed: November 21, 2022, 3:49am (UTC)

Open redirect that can lead to malicious websites

👉 https://hackerone.com/reports/1771749

🔹 Severity: No Rating
🔹 Reported To: AMBER AI
🔹 Reported By: #mrdot404
🔹 State: ⚪️ Informative
🔹 Disclosed: November 21, 2022, 7:24am (UTC)