Possibility to force an admin to install recommended applications

👉 https://hackerone.com/reports/1403614

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Nextcloud
🔹 Reported By: #igorpyan
🔹 State: 🟢 Resolved
🔹 Disclosed: April 29, 2022, 11:50am (UTC)

SQL INJECTION in https://████/██████████

👉 https://hackerone.com/reports/723044

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #mido0x0x
🔹 State: 🟢 Resolved
🔹 Disclosed: April 29, 2022, 1:56pm (UTC)

Blind SQL Injection

👉 https://hackerone.com/reports/771215

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #mido0x0x
🔹 State: 🟢 Resolved
🔹 Disclosed: April 29, 2022, 1:57pm (UTC)

██████████ vulnerable to CVE-2022-22954

👉 https://hackerone.com/reports/1537543

🔹 Severity: Critical
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #null_bytes
🔹 State: 🟢 Resolved
🔹 Disclosed: April 29, 2022, 1:58pm (UTC)

SSRF due to CVE-2021-27905 in www.████████

👉 https://hackerone.com/reports/1183472

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #fdeleite
🔹 State: 🟢 Resolved
🔹 Disclosed: April 29, 2022, 2:00pm (UTC)

Sensitive data exposure via /secure/QueryComponent!Default.jspa endpoint on ████████

👉 https://hackerone.com/reports/1278977

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #njmulsqb
🔹 State: 🟢 Resolved
🔹 Disclosed: April 29, 2022, 2:03pm (UTC)

lfi in filePathDownload parameter via ███████

👉 https://hackerone.com/reports/1542734

🔹 Severity: High
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #exploitmsf
🔹 State: 🟢 Resolved
🔹 Disclosed: April 29, 2022, 2:04pm (UTC)

Reflected XSS [███]

👉 https://hackerone.com/reports/1309237

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #fdeleite
🔹 State: 🟢 Resolved
🔹 Disclosed: April 29, 2022, 2:05pm (UTC)

Reflected XSS [██████]

👉 https://hackerone.com/reports/1309385

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #fdeleite
🔹 State: 🟢 Resolved
🔹 Disclosed: April 29, 2022, 2:06pm (UTC)

Hardcoded AWS credentials in ███████.msi

👉 https://hackerone.com/reports/1368690

🔹 Severity: Critical
🔹 Reported To: 8x8
🔹 Reported By: #chip_sec
🔹 State: 🟢 Resolved
🔹 Disclosed: April 29, 2022, 5:01pm (UTC)

Reflected XSS due to vulnerable version of sockjs

👉 https://hackerone.com/reports/1100326

🔹 Severity: Medium | 💰 250 USD
🔹 Reported To: Automattic
🔹 Reported By: #chip_sec
🔹 State: 🟢 Resolved
🔹 Disclosed: April 29, 2022, 5:38pm (UTC)

com.nextcloud.client bypass the protection lock in andoid app v 3.18.1 latest version.

👉 https://hackerone.com/reports/1450368

🔹 Severity: Low | 💰 200 USD
🔹 Reported To: Nextcloud
🔹 Reported By: #dashingjaved
🔹 State: 🟢 Resolved
🔹 Disclosed: April 30, 2022, 11:56am (UTC)

Enumerate class codes via yahoo dork - Can access any course under teacher - Sensitive information leaked

👉 https://hackerone.com/reports/1514356

🔹 Severity: High
🔹 Reported To: Khan Academy
🔹 Reported By: #bughunterpol
🔹 State: 🟢 Resolved
🔹 Disclosed: May 1, 2022, 6:05pm (UTC)

XSS at videostore.mtnonline.com/GL/*.aspx via all parameters

👉 https://hackerone.com/reports/1244731

🔹 Severity: Medium
🔹 Reported To: MTN Group
🔹 Reported By: #homosec
🔹 State: 🟢 Resolved
🔹 Disclosed: May 1, 2022, 9:20pm (UTC)

XSS at https://nextapps.mtnonline.com/search/suggest/q/{xss payload}

👉 https://hackerone.com/reports/1244722

🔹 Severity: Medium
🔹 Reported To: MTN Group
🔹 Reported By: #homosec
🔹 State: 🟢 Resolved
🔹 Disclosed: May 1, 2022, 9:20pm (UTC)

Self-DoS due to template injection via email field in password reset form on access.acronis.com

👉 https://hackerone.com/reports/1265344

🔹 Severity: No Rating
🔹 Reported To: Acronis
🔹 Reported By: #sudo_bash
🔹 State: ⚪️ Informative
🔹 Disclosed: May 3, 2022, 6:41am (UTC)

Blind XSS via Feedback form.

👉 https://hackerone.com/reports/1339034

🔹 Severity: High | 💰 1,250 USD
🔹 Reported To: Judge.me
🔹 Reported By: #b3hlull
🔹 State: 🟢 Resolved
🔹 Disclosed: May 3, 2022, 9:36am (UTC)

URL Scheme misconfiguration on TikTok for IOS

👉 https://hackerone.com/reports/1437294

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: TikTok
🔹 Reported By: #glassplant
🔹 State: 🟢 Resolved
🔹 Disclosed: May 4, 2022, 10:17pm (UTC)

One Click Account Hijacking via Unvalidated Deeplink

👉 https://hackerone.com/reports/1500614

🔹 Severity: High | 💰 10,000 USD
🔹 Reported To: TikTok
🔹 Reported By: #fr4via
🔹 State: 🟢 Resolved
🔹 Disclosed: May 4, 2022, 10:23pm (UTC)

Clickjacking Vulnerability Can Leads To Delete Developer APP

👉 https://hackerone.com/reports/1416612

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: TikTok
🔹 Reported By: #rioncool22
🔹 State: 🟢 Resolved
🔹 Disclosed: May 4, 2022, 10:25pm (UTC)

Github Account Takeover which is used as gradle vcs in "github.com/palantir/gradle-launch-config-plugin"

👉 https://hackerone.com/reports/1525578

🔹 Severity: Low | 💰 250 USD
🔹 Reported To: Palantir Public
🔹 Reported By: #codermak
🔹 State: 🟢 Resolved
🔹 Disclosed: May 5, 2022, 1:54pm (UTC)