IDOR in family pairing API
TikTok disclosed a bug submitted by ahmedna126: https://hackerone.com/reports/1586950 - Bounty: $700 [Source]
Reflected Cross-site Scripting (XSS) at https://www.tiktok.com/
TikTok disclosed a bug submitted by mrhavit: https://hackerone.com/reports/1915808 - Bounty: $5000 [Source]
Reflected xss on https://
U.S. Dept Of Defense disclosed a bug submitted by rektile404: https://hackerone.com/reports/1988560 [Source]
DOM-XSS
U.S. Dept Of Defense disclosed a bug submitted by medokll0011: https://hackerone.com/reports/1982099 [Source]
Leaks of username and password leads to CVE-2018-18862 exploitation
U.S. Dept Of Defense disclosed a bug submitted by pll25: https://hackerone.com/reports/1990338 [Source]
Basic auth header on WebDAV requests is not bruteforce protected
Nextcloud disclosed a bug submitted by hackit_bharat: https://hackerone.com/reports/1879549 - Bounty: $750 [Source]