Off-by-slash vulnerability in nodejs.org and iojs.org

👉 https://hackerone.com/reports/1631350

🔹 Severity: Medium
🔹 Reported To: Node.js
🔹 Reported By: #nagaro
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2022, 2:11pm (UTC)

Golang expvar Information Disclosure

👉 https://hackerone.com/reports/1650035

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: Uber
🔹 Reported By: #mustafa_farrag
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2022, 3:44pm (UTC)

Reflected XSS on pages.email.sel.sony.com/page.aspx via jobid parameter

👉 https://hackerone.com/reports/1309949

🔹 Severity: Medium
🔹 Reported To: Sony
🔹 Reported By: #leo_rac
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2022, 5:59pm (UTC)

NordVPN Linux Client - Unsafe service file permissions leads to Local Privilege Escalation

👉 https://hackerone.com/reports/1218523

🔹 Severity: Medium | 💰 700 USD
🔹 Reported To: Nord Security
🔹 Reported By: #bashketchum
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2022, 6:48pm (UTC)

Pause-based desync in Apache HTTPD

👉 https://hackerone.com/reports/1667974

🔹 Severity: High | 💰 4,000 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #albinowax
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2022, 7:02am (UTC)

Default Login Credentials on https://broadbandmaps.mtn.com.gh/

👉 https://hackerone.com/reports/1297480

🔹 Severity: Critical
🔹 Reported To: MTN Group
🔹 Reported By: #theranger
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2022, 11:05am (UTC)

Non-revoked API Key Information disclosure via Stripo_report()

👉 https://hackerone.com/reports/1613714

🔹 Severity: Medium
🔹 Reported To: Stripo Inc
🔹 Reported By: #deb0con
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2022, 11:05am (UTC)

Unauthorized access

👉 https://hackerone.com/reports/1669176

🔹 Severity: Medium
🔹 Reported To: GitLab
🔹 Reported By: #mega7
🔹 State: ⚪️ Informative
🔹 Disclosed: August 25, 2022, 2:14pm (UTC)

Privilege Escalation - "Analyst" Role Can View Email Domains of a Company - [GET /voyager/api/voyagerOrganizationDashEmailDomainMappings]

👉 https://hackerone.com/reports/1572591

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: LinkedIn
🔹 Reported By: #naaash
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2022, 6:38pm (UTC)

weak protection against brute-forcing on login api leads to account takeover

👉 https://hackerone.com/reports/766875

🔹 Severity: Critical
🔹 Reported To: Palo Alto Software
🔹 Reported By: #zer0code
🔹 State: 🟢 Resolved
🔹 Disclosed: August 29, 2022, 6:23pm (UTC)

TikTok's pixel/sdk.js leaks current URL from websites using postMessage

👉 https://hackerone.com/reports/1598749

🔹 Severity: Medium | 💰 1,500 USD
🔹 Reported To: TikTok
🔹 Reported By: #fransrosen
🔹 State: 🟢 Resolved
🔹 Disclosed: August 30, 2022, 6:25pm (UTC)

Blind SSRF on platform.dash.cloudflare.com Due to Sentry misconfiguration

👉 https://hackerone.com/reports/1467044

🔹 Severity: Low | 💰 200 USD
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: #lohigowda
🔹 State: 🟢 Resolved
🔹 Disclosed: August 31, 2022, 10:54am (UTC)

CVE-2022-35252: control code in cookie denial of service

👉 https://hackerone.com/reports/1613943

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: #haxatron1
🔹 State: 🟢 Resolved
🔹 Disclosed: August 31, 2022, 10:55am (UTC)

Enable 2Fa verification without verifying email leads account takeover

👉 https://hackerone.com/reports/1618021

🔹 Severity: Medium | 💰 350 USD
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: #motu-vai
🔹 State: 🟢 Resolved
🔹 Disclosed: August 31, 2022, 3:43pm (UTC)

Password reset tokens sent to CSP reporting endpoints

👉 https://hackerone.com/reports/1626281

🔹 Severity: Low | 💰 250 USD
🔹 Reported To: Snapchat
🔹 Reported By: #mahfujwhh
🔹 State: 🟢 Resolved
🔹 Disclosed: August 31, 2022, 11:53pm (UTC)

Any expired reset password link can still be used to reset the password

👉 https://hackerone.com/reports/1615790

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Acronis
🔹 Reported By: #mrccrqr
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2022, 9:31am (UTC)

Remote denial of service in HyperLedger Fabric

👉 https://hackerone.com/reports/1635854

🔹 Severity: High | 💰 1,500 USD
🔹 Reported To: Hyperledger
🔹 Reported By: #fatal0
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2022, 2:05pm (UTC)

API Key reported in #1465145 not rotated and thus is still valid and can be used by anyone

👉 https://hackerone.com/reports/1591770

🔹 Severity: Low
🔹 Reported To: Adobe
🔹 Reported By: #aneeeketh
🔹 State: ⚪️ Informative
🔹 Disclosed: September 1, 2022, 4:05pm (UTC)

Remote code execution due to unvalidated file upload

👉 https://hackerone.com/reports/1164452

🔹 Severity: Critical
🔹 Reported To: MTN Group
🔹 Reported By: #aliyugombe
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2022, 5:29pm (UTC)

Password reset token leak on third party website via Referer header [cloudivr.mtnbusiness.com.ng]

👉 https://hackerone.com/reports/1320242

🔹 Severity: Medium
🔹 Reported To: MTN Group
🔹 Reported By: #ibrahimatix0x01
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2022, 8:21pm (UTC)