Firebase Database Takeover in https://pulseradio.mtn.co.ug/

👉 https://hackerone.com/reports/1447751

🔹 Severity: Critical
🔹 Reported To: MTN Group
🔹 Reported By: #shuvam321
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 10:52am (UTC)

Unprotected Direct Object Reference

👉 https://hackerone.com/reports/1536936

🔹 Severity: Critical
🔹 Reported To: MTN Group
🔹 Reported By: #coyemerald
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 5:24pm (UTC)

Remove Every User, Admin, And Owner Out Of Their Teams on developers.mtn.com via IDOR + Information Disclosure

👉 https://hackerone.com/reports/1448550

🔹 Severity: Critical
🔹 Reported To: MTN Group
🔹 Reported By: #wallotry
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 5:34pm (UTC)

Subdomain Takeover at course.oberlo.com

👉 https://hackerone.com/reports/1690951

🔹 Severity: No Rating
🔹 Reported To: Shopify
🔹 Reported By: #m7mdharoun
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 7:22pm (UTC)

Read/Write arbitrary (non-HttpOnly) cookies on checkout pages via GoogleAnalyticsAdditionalScripts postMessage handler

👉 https://hackerone.com/reports/1081167

🔹 Severity: Medium | 💰 1,600 USD
🔹 Reported To: Shopify
🔹 Reported By: #bored-engineer
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 7:34pm (UTC)

Disconnecting an external login provider does not revoke session

👉 https://hackerone.com/reports/1547684

🔹 Severity: Medium | 💰 1,600 USD
🔹 Reported To: Shopify
🔹 Reported By: #attackerbhai
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 7:50pm (UTC)

Stored XSS in /admin/product and /admin/collections

👉 https://hackerone.com/reports/1147433

🔹 Severity: Medium | 💰 5,300 USD
🔹 Reported To: Shopify
🔹 Reported By: #ashketchum
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 10:44pm (UTC)

Authentication bypass in https://nin.mtn.ng

👉 https://hackerone.com/reports/1747146

🔹 Severity: Critical
🔹 Reported To: MTN Group
🔹 Reported By: #roland_hack
🔹 State: 🟢 Resolved
🔹 Disclosed: December 2, 2022, 1:00pm (UTC)

XSS in Acronis Cloud Manager Admin Portal

👉 https://hackerone.com/reports/1388788

🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: Acronis
🔹 Reported By: #mooimacow
🔹 State: 🟢 Resolved
🔹 Disclosed: December 2, 2022, 7:48pm (UTC)

POST following PUT confusion

👉 https://hackerone.com/reports/1752146

🔹 Severity: Medium | 💰 2,400 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #robbotic
🔹 State: 🟢 Resolved
🔹 Disclosed: December 2, 2022, 9:03pm (UTC)

Exposed Cortex API at https://cortex-ingest.shopifycloud.com/

👉 https://hackerone.com/reports/1258871

🔹 Severity: Medium | 💰 6,300 USD
🔹 Reported To: Shopify
🔹 Reported By: #ian
🔹 State: 🟢 Resolved
🔹 Disclosed: December 2, 2022, 10:25pm (UTC)

CVE-2022-35260: .netrc parser out-of-bounds access

👉 https://hackerone.com/reports/1753224

🔹 Severity: Low | 💰 480 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #kurohiro
🔹 State: 🟢 Resolved
🔹 Disclosed: December 3, 2022, 12:20am (UTC)

IDOR in Stats API Endpoint Allows Viewing Equity or Net Profit of Any MT Account

👉 https://hackerone.com/reports/1644436

🔹 Severity: No Rating | 💰 1,000 USD
🔹 Reported To: EXNESS
🔹 Reported By: #ashwarya
🔹 State: 🟢 Resolved
🔹 Disclosed: December 5, 2022, 3:50pm (UTC)