RCE vulnerability in Hyperledger Fabric SDK for Java

👉 https://hackerone.com/reports/801370

🔹 Severity: Medium | 💰 200 USD
🔹 Reported To: Hyperledger
🔹 Reported By: #freskimo
🔹 State: 🟢 Resolved
🔹 Disclosed: August 6, 2022, 5:37pm (UTC)

HTTP PUT method is enabled downloader.ratelimited.me

👉 https://hackerone.com/reports/545136

🔹 Severity: High
🔹 Reported To: RATELIMITED
🔹 Reported By: #codeslayer137
🔹 State: 🟢 Resolved
🔹 Disclosed: August 7, 2022, 2:01am (UTC)

Brute Force of fabric-ca server admin account

👉 https://hackerone.com/reports/411364

🔹 Severity: High | 💰 1,500 USD
🔹 Reported To: Hyperledger
🔹 Reported By: #xiaoc
🔹 State: 🟢 Resolved
🔹 Disclosed: August 6, 2022, 5:36pm (UTC)

Enrolling to a CA that returns an empty response crashes the node process

👉 https://hackerone.com/reports/506412

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Hyperledger
🔹 Reported By: #mttrbrts
🔹 State: 🟢 Resolved
🔹 Disclosed: August 6, 2022, 5:37pm (UTC)

Anonymous access control - Payments Status

👉 https://hackerone.com/reports/1546726

🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: Omise
🔹 Reported By: #codeslayer137
🔹 State: 🟢 Resolved
🔹 Disclosed: August 7, 2022, 1:59am (UTC)

Lack of Rate limit while joining video call in talk section which is password protected

👉 https://hackerone.com/reports/1596673

🔹 Severity: Low | 💰 250 USD
🔹 Reported To: Nextcloud
🔹 Reported By: #error2001
🔹 State: 🟢 Resolved
🔹 Disclosed: August 8, 2022, 6:58am (UTC)

xmlrpc.php FILE IS enable it will used for Bruteforce attack and Denial of Service(DoS)

👉 https://hackerone.com/reports/1622867

🔹 Severity: Medium
🔹 Reported To: Top Echelon Software
🔹 Reported By: #anonymmert12
🔹 State: 🟢 Resolved
🔹 Disclosed: August 8, 2022, 1:35pm (UTC)

Ability to escape database transaction through SQL injection, leading to arbitrary code execution

👉 https://hackerone.com/reports/1663299

🔹 Severity: High
🔹 Reported To: HackerOne
🔹 Reported By: #jobert
🔹 State: 🟢 Resolved
🔹 Disclosed: August 9, 2022, 6:58pm (UTC)

[CRITICAL] Full account takeover without user interaction on sign with Apple flow

👉 https://hackerone.com/reports/1639802

🔹 Severity: Critical | 💰 3,000 USD
🔹 Reported To: Glassdoor
🔹 Reported By: #emanelyazji
🔹 State: 🟢 Resolved
🔹 Disclosed: August 9, 2022, 7:26pm (UTC)

Read-only administrator can change agent update settings

👉 https://hackerone.com/reports/1538004

🔹 Severity: Medium | 💰 200 USD
🔹 Reported To: Acronis
🔹 Reported By: #mega7
🔹 State: 🟢 Resolved
🔹 Disclosed: August 10, 2022, 9:38am (UTC)

many commands can be manipulated to delete identities or affiliations

👉 https://hackerone.com/reports/348090

🔹 Severity: Medium | 💰 500 USD
🔹 Reported To: Hyperledger
🔹 Reported By: #cet2000
🔹 State: 🟢 Resolved
🔹 Disclosed: August 10, 2022, 2:23pm (UTC)

Redirection in Repeater & Intruder Tab

👉 https://hackerone.com/reports/1541301

🔹 Severity: Low | 💰 150 USD
🔹 Reported To: PortSwigger Web Security
🔹 Reported By: #mr_vrush
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2022, 11:09am (UTC)

Disable xmlrpc.php file

👉 https://hackerone.com/reports/712321

🔹 Severity: Low
🔹 Reported To: Top Echelon Software
🔹 Reported By: #sohelahmed786
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2022, 12:50pm (UTC)

fix(security):Path Traversal Bug

👉 https://hackerone.com/reports/1664244

🔹 Severity: High
🔹 Reported To: Hyperledger
🔹 Reported By: #bhaskar_ram
🔹 State: 🔴 N/A
🔹 Disclosed: August 11, 2022, 7:53pm (UTC)

Admin panel Exposure without credential at https://plus-website.shopifycloud.com/admin.php

👉 https://hackerone.com/reports/1417288

🔹 Severity: Medium | 💰 2,900 USD
🔹 Reported To: Shopify
🔹 Reported By: #0x50d
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2022, 10:21pm (UTC)

Wordpress Users Disclosure (/wp-json/wp/v2/users/)

👉 https://hackerone.com/reports/1663363

🔹 Severity: Medium
🔹 Reported To: Top Echelon Software
🔹 Reported By: #hammodmt
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2022, 8:46pm (UTC)

Disabling context isolation, nodeIntegrationInSubFrames using an unauthorised frame.

👉 https://hackerone.com/reports/1647287

🔹 Severity: Medium | 💰 2,400 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #s1r1u5
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2022, 11:08pm (UTC)

Reflected XSS at https://stories.showmax.com/wp-content/themes/theme-internal_ss/blocks/ajax/a.php via `ss_country_filter` param

👉 https://hackerone.com/reports/1663202

🔹 Severity: Medium | 💰 150 USD
🔹 Reported To: Showmax
🔹 Reported By: #miron666
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2022, 12:51pm (UTC)

Cross Site Scripting Vulnerability in fabric-sdk-py source code

👉 https://hackerone.com/reports/1670187

🔹 Severity: No Rating
🔹 Reported To: Hyperledger
🔹 Reported By: #bhaskar_ram
🔹 State: ⚪️ Informative
🔹 Disclosed: August 17, 2022, 2:53pm (UTC)

Delimiter injection in GitHub Actions core.exportVariable

👉 https://hackerone.com/reports/1625652

🔹 Severity: Medium | 💰 4,617 USD
🔹 Reported To: GitHub
🔹 Reported By: #jupenur
🔹 State: 🟢 Resolved
🔹 Disclosed: August 18, 2022, 7:44pm (UTC)

CSRF Account Takeover

👉 https://hackerone.com/reports/1253462

🔹 Severity: High | 💰 2,373 USD
🔹 Reported To: TikTok
🔹 Reported By: #s3c
🔹 State: 🟢 Resolved
🔹 Disclosed: August 16, 2022, 9:04pm (UTC)