DOS via issue preview

👉 https://hackerone.com/reports/1543718

🔹 Severity: High | 💰 7,640 USD
🔹 Reported To: GitLab
🔹 Reported By: #legit-security
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2022, 3:47am (UTC)

CSS Injection via Client Side Path Traversal + Open Redirect leads to personal data exfiltration on Acronis Cloud

👉 https://hackerone.com/reports/1245165

🔹 Severity: Medium | 💰 250 USD
🔹 Reported To: Acronis
🔹 Reported By: #mr-medi
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2022, 7:38pm (UTC)

CVE-2022-35252: control code in cookie denial of service

👉 https://hackerone.com/reports/1686935

🔹 Severity: Low | 💰 480 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #haxatron1
🔹 State: 🟢 Resolved
🔹 Disclosed: November 5, 2022, 2:50pm (UTC)

Completely remove VPN profile from locked WARP iOS cient.

👉 https://hackerone.com/reports/1633231

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: #joshatmotion
🔹 State: 🟢 Resolved
🔹 Disclosed: November 7, 2022, 10:59am (UTC)

Bypass Cloudflare WARP lock on iOS.

👉 https://hackerone.com/reports/1542450

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: #joshatmotion
🔹 State: 🟢 Resolved
🔹 Disclosed: November 7, 2022, 11:02am (UTC)

I found another way to bypass Cloudflare Warp lock!

👉 https://hackerone.com/reports/1605847

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: #joshatmotion
🔹 State: 🟢 Resolved
🔹 Disclosed: November 7, 2022, 11:02am (UTC)

Exceed photo dimensions, Flickr.com

👉 https://hackerone.com/reports/1755552

🔹 Severity: Low | 💰 50 USD
🔹 Reported To: Flickr
🔹 Reported By: #0xcyborg
🔹 State: ⚪️ Informative
🔹 Disclosed: November 7, 2022, 5:53pm (UTC)

Subdomain Takeover via Unclaimed Amazon S3 Bucket (Musical.ly)

👉 https://hackerone.com/reports/1102537

🔹 Severity: Low | 💰 200 USD
🔹 Reported To: TikTok
🔹 Reported By: #daik0n
🔹 State: 🟢 Resolved
🔹 Disclosed: November 7, 2022, 9:34pm (UTC)

Public Github Repo Leaking Internal Credentials

👉 https://hackerone.com/reports/1763266

🔹 Severity: Critical
🔹 Reported To: Yelp
🔹 Reported By: #xinfohuggerx
🔹 State: ⚪️ Informative
🔹 Disclosed: November 7, 2022, 11:45pm (UTC)

[Kafka Connect] [JdbcSinkConnector][HttpSinkConnector] RCE by leveraging file upload via SQLite JDBC driver and SSRF to internal Jolokia

👉 https://hackerone.com/reports/1547877

🔹 Severity: Critical | 💰 5,000 USD
🔹 Reported To: Aiven Ltd
🔹 Reported By: #jarij
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2022, 6:29am (UTC)

Grafana RCE via SMTP server parameter injection

👉 https://hackerone.com/reports/1200647

🔹 Severity: Critical | 💰 5,000 USD
🔹 Reported To: Aiven Ltd
🔹 Reported By: #jarij
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2022, 6:29am (UTC)

Kafka Connect RCE via connector SASL JAAS JndiLoginModule configuration

👉 https://hackerone.com/reports/1529790

🔹 Severity: Critical | 💰 5,000 USD
🔹 Reported To: Aiven Ltd
🔹 Reported By: #jarij
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2022, 6:30am (UTC)

Apache Flink RCE via GET jar/plan API Endpoint

👉 https://hackerone.com/reports/1418891

🔹 Severity: Critical | 💰 6,000 USD
🔹 Reported To: Aiven Ltd
🔹 Reported By: #jarij
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2022, 6:30am (UTC)

Self-XSS on Suggest Tag dialog box

👉 https://hackerone.com/reports/1761505

🔹 Severity: Low | 💰 50 USD
🔹 Reported To: XVIDEOS
🔹 Reported By: #j3rry4unt
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2022, 7:19pm (UTC)

Host Header Injection Attack - www.xnxx.com

👉 https://hackerone.com/reports/1630073

🔹 Severity: No Rating
🔹 Reported To: XVIDEOS
🔹 Reported By: #cyber_anon
🔹 State: ⚪️ Informative
🔹 Disclosed: November 8, 2022, 7:25pm (UTC)

api keys leaked

👉 https://hackerone.com/reports/1762927

🔹 Severity: Medium
🔹 Reported To: Reddit
🔹 Reported By: #saibalajis6
🔹 State: ⚪️ Informative
🔹 Disclosed: November 10, 2022, 2:40pm (UTC)

sensitive data exposure

👉 https://hackerone.com/reports/1716249

🔹 Severity: High
🔹 Reported To: Reddit
🔹 Reported By: #saibalajis6
🔹 State: 🔴 N/A
🔹 Disclosed: November 10, 2022, 2:41pm (UTC)

Business Suite "Get Leads" Resulting in Revealing User Email & Phone

👉 https://hackerone.com/reports/1744194

🔹 Severity: High | 💰 5,500 USD
🔹 Reported To: TikTok
🔹 Reported By: #datph4m
🔹 State: 🟢 Resolved
🔹 Disclosed: November 10, 2022, 11:41pm (UTC)

Subdomain Takeover on delivey.yelp.com

👉 https://hackerone.com/reports/1715538

🔹 Severity: Low
🔹 Reported To: Yelp
🔹 Reported By: #racersaravanaa05
🔹 State: 🔴 N/A
🔹 Disclosed: November 12, 2022, 3:49pm (UTC)

Subdomain takeover at http://test.www.midigator.com

👉 https://hackerone.com/reports/1718371

🔹 Severity: High
🔹 Reported To: Equifax
🔹 Reported By: #valluvarsploit_h1
🔹 State: 🟢 Resolved
🔹 Disclosed: November 12, 2022, 4:05pm (UTC)