Path traversal, to RCE

👉 https://hackerone.com/reports/733072

🔹 Severity: High | 💰 12,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #saltyyolk
🔹 State: 🟢 Resolved
🔹 Disclosed: June 7, 2022, 2:16pm (UTC)

Open redirect on https://www.glassdoor.com/profile/siwa.htm via state parameter

👉 https://hackerone.com/reports/1097208

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Glassdoor
🔹 Reported By: #0x7
🔹 State: 🟢 Resolved
🔹 Disclosed: June 8, 2022, 11:44am (UTC)

Reflected XSS on https://help.glassdoor.com/gd_requestsubmitpage

👉 https://hackerone.com/reports/1094224

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Glassdoor
🔹 Reported By: #0x7
🔹 State: 🟢 Resolved
🔹 Disclosed: June 8, 2022, 11:46am (UTC)

Reflected XSS on https://www.glassdoor.com/parts/header.htm

👉 https://hackerone.com/reports/1073712

🔹 Severity: Medium | 💰 600 USD
🔹 Reported To: Glassdoor
🔹 Reported By: #0x7
🔹 State: 🟢 Resolved
🔹 Disclosed: June 8, 2022, 12:00pm (UTC)

Stored XSS on issue comments and other pages which contain notes

👉 https://hackerone.com/reports/1398305

🔹 Severity: High | 💰 3,000 USD
🔹 Reported To: GitLab
🔹 Reported By: #jarij
🔹 State: 🟢 Resolved
🔹 Disclosed: June 8, 2022, 2:02pm (UTC)

"External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request

👉 https://hackerone.com/reports/1375393

🔹 Severity: Medium | 💰 610 USD
🔹 Reported To: GitLab
🔹 Reported By: #joaxcar
🔹 State: 🟢 Resolved
🔹 Disclosed: June 8, 2022, 2:04pm (UTC)

Gitlab Pages token theft using service workers

👉 https://hackerone.com/reports/1439552

🔹 Severity: Medium | 💰 1,680 USD
🔹 Reported To: GitLab
🔹 Reported By: #ehhthing
🔹 State: 🟢 Resolved
🔹 Disclosed: June 8, 2022, 2:06pm (UTC)

XSS by clicking Jira's link

👉 https://hackerone.com/reports/1194254

🔹 Severity: Medium | 💰 1,130 USD
🔹 Reported To: GitLab
🔹 Reported By: #ooooooo_q
🔹 State: 🟢 Resolved
🔹 Disclosed: June 8, 2022, 2:07pm (UTC)

Several Subdomains Takeover

👉 https://hackerone.com/reports/1591085

🔹 Severity: High
🔹 Reported To: Reddit
🔹 Reported By: #3amii
🔹 State: 🔴 N/A
🔹 Disclosed: June 8, 2022, 8:36pm (UTC)

match

👉 https://hackerone.com/reports/1555440

🔹 Severity: High
🔹 Reported To: curl
🔹 Reported By: #maslahhunter
🔹 State: 🔴 N/A
🔹 Disclosed: June 9, 2022, 7:09am (UTC)

Integer overflows in unescape_word()

👉 https://hackerone.com/reports/1564922

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: #ddme
🔹 State: 🔴 N/A
🔹 Disclosed: June 9, 2022, 7:10am (UTC)

Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic

👉 https://hackerone.com/reports/1520685

🔹 Severity: Low | 💰 100 USD
🔹 Reported To: Nextcloud
🔹 Reported By: #michag86
🔹 State: 🟢 Resolved
🔹 Disclosed: June 9, 2022, 12:42pm (UTC)

RXSS on █████████

👉 https://hackerone.com/reports/1555582

🔹 Severity: Medium
🔹 Reported To: U.S. Dept Of Defense
🔹 Reported By: #tmz900
🔹 State: 🟢 Resolved
🔹 Disclosed: June 10, 2022, 2:44pm (UTC)

bd-j exploit chain

👉 https://hackerone.com/reports/1379975

🔹 Severity: High | 💰 20,000 USD
🔹 Reported To: PlayStation
🔹 Reported By: #theflow0
🔹 State: 🟢 Resolved
🔹 Disclosed: June 10, 2022, 8:26pm (UTC)

Email address disclosure via invite token validatiion

👉 https://hackerone.com/reports/1560072

🔹 Severity: Low | 💰 250 USD
🔹 Reported To: TikTok
🔹 Reported By: #noob_but_cut3
🔹 State: 🟢 Resolved
🔹 Disclosed: June 11, 2022, 12:28am (UTC)

disclosure the live_analytics information of any livestream.

👉 https://hackerone.com/reports/1561299

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: TikTok
🔹 Reported By: #datph4m
🔹 State: 🟢 Resolved
🔹 Disclosed: June 11, 2022, 12:33am (UTC)

CVE-2022-27779: cookie for trailing dot TLD

👉 https://hackerone.com/reports/1565615

🔹 Severity: Medium | 💰 2,400 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #haxatron1
🔹 State: 🟢 Resolved
🔹 Disclosed: June 11, 2022, 6:58pm (UTC)

CVE-2022-27780: percent-encoded path separator in URL host

👉 https://hackerone.com/reports/1565619

🔹 Severity: Medium | 💰 2,400 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #haxatron1
🔹 State: 🟢 Resolved
🔹 Disclosed: June 11, 2022, 6:58pm (UTC)

CVE-2022-30115: HSTS bypass via trailing dot

👉 https://hackerone.com/reports/1565622

🔹 Severity: Medium | 💰 2,400 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #haxatron1
🔹 State: 🟢 Resolved
🔹 Disclosed: June 11, 2022, 6:58pm (UTC)

All user password hash can be seen from admin panel

👉 https://hackerone.com/reports/1489892

🔹 Severity: Medium
🔹 Reported To: UPchieve
🔹 Reported By: #dark_haxor
🔹 State: 🟢 Resolved
🔹 Disclosed: June 11, 2022, 11:31pm (UTC)

lack of rate limit on athentification login page & forgot password page

👉 https://hackerone.com/reports/1591764

🔹 Severity: Medium
🔹 Reported To: Showmax
🔹 Reported By: #saidkira
🔹 State: ⚪️ Informative
🔹 Disclosed: June 13, 2022, 7:09am (UTC)