readme.md

### Title
IDOR редактирование любого вишлиста
#### URL 
https://hackerone.com/reports/736065
#### Severity score
null
#### Reporter 
circuit
### Bounty paid
$500


---


### Title
Authorization issue on 'valtakirjat' (/e2/verkkopalvelu/)
#### URL 
https://hackerone.com/reports/307978
#### Severity score
7.2
#### Reporter 
muon4
### Bounty paid
$490


---


### Title
Insecure Direct Object Reference on in-scope .mil website
#### URL 
https://hackerone.com/reports/230026
#### Severity score
null
#### Reporter 
gamliel
### Bounty paid
null


---


### Title
IDOR zakazaka (состояние заказа и перезаказ)
#### URL 
https://hackerone.com/reports/956799
#### Severity score
null
#### Reporter 
moonwalker
### Bounty paid
$150


---


### Title
IDOR [partners.shopify.com] - User with ONLY Manage apps permission is able to get shops info and staff names from inside the shop
#### URL 
https://hackerone.com/reports/243943
#### Severity score
5
#### Reporter 
inhibitor181
### Bounty paid
$500


---


### Title
[city-mobil.ru/taxiserv/] Disclosure  information about drivers
#### URL 
https://hackerone.com/reports/747612
#### Severity score
4.3
#### Reporter 
act1on3
### Bounty paid
$1,500


---


### Title
IDOR in treat subscriptions
#### URL 
https://hackerone.com/reports/313050
#### Severity score
null
#### Reporter 
harsh13
### Bounty paid
$100


---


### Title
A manager of a determinate group of users still might have access to any user account from any group that he doesn't administrate anymore.
#### URL 
https://hackerone.com/reports/268228
#### Severity score
null
#### Reporter 
chaosbolt
### Bounty paid
$500


---


### Title
China - IDOR on Reservation Staging/Non Production Site - https://reservation.stg.starbucks.com.cn
#### URL 
https://hackerone.com/reports/715054
#### Severity score
6.1
#### Reporter 
seven6
### Bounty paid
null


---


### Title
Access to all █████████ files, including CAC authentication bypass
#### URL 
https://hackerone.com/reports/429000
#### Severity score
null
#### Reporter 
cablej_dds
### Bounty paid
null


---


### Title
Access control missing while viewing the attachments in the "All boards"
#### URL 
https://hackerone.com/reports/916704
#### Severity score
6.5
#### Reporter 
divyesh01
### Bounty paid
$150


---


### Title
[Razer Pay Mobile App] IDOR within /v1_IM/friends/queryDrawRedLog allowed unauthorised access to read logs
#### URL 
https://hackerone.com/reports/754044
#### Severity score
6.5
#### Reporter 
sambal0x
### Bounty paid
$500


---


### Title
IDOR in tracking driver logs at city-mobil.ru
#### URL 
https://hackerone.com/reports/847876
#### Severity score
3.8
#### Reporter 
r0hack
### Bounty paid
$150


---


### Title
Registered users can change app password permissions for any user
#### URL 
https://hackerone.com/reports/297751
#### Severity score
null
#### Reporter 
icewater
### Bounty paid
$100


---


### Title
IDOR in semrush academy
#### URL 
https://hackerone.com/reports/783708
#### Severity score
null
#### Reporter 
a_d_a_m
### Bounty paid
$505


---


### Title
Idor for firstpromoter service
#### URL 
https://hackerone.com/reports/959697
#### Severity score
null
#### Reporter 
kapkan
### Bounty paid
null


---


### Title
Bypass of my three other reports #267636 + #255894 + #271861 - (IDOR) Ability to see full name associated with other New Relic accounts
#### URL 
https://hackerone.com/reports/320173
#### Severity score
null
#### Reporter 
jon_bottarini
### Bounty paid
$1,500


---


### Title
Permissions leaks the full name of other NR accounts - Regression of #267636
#### URL 
https://hackerone.com/reports/347665
#### Severity score
null
#### Reporter 
jon_bottarini
### Bounty paid
$1,500


---


### Title
I found a way to instantly take over ads by other users and change them (IDOR)
#### URL 
https://hackerone.com/reports/253929
#### Severity score
7.1
#### Reporter 
kciredor
### Bounty paid
null


---


### Title
Internal API endpoint discloses full account name of email address associated with unconfirmed user
#### URL 
https://hackerone.com/reports/332381
#### Severity score
null
#### Reporter 
jon_bottarini
### Bounty paid
$1,500


---


### Title
Возможность просмотра коментариев к чужим обращениям [corporate.city-mobil.ru]
#### URL 
https://hackerone.com/reports/958769
#### Severity score
5
#### Reporter 
kwel
### Bounty paid
$150


---


### Title
A staff member with no permissions can edit Store Customer Email
#### URL 
https://hackerone.com/reports/980511
#### Severity score
null
#### Reporter 
ash_nz
### Bounty paid
$1,500


---


### Title
[www.zomato.com] IDOR - Gold Subscription Details, Able to view "Membership ID" and "Validity Details" of other Users
#### URL 
https://hackerone.com/reports/344145
#### Severity score
null
#### Reporter 
riya
### Bounty paid
$100


---


### Title
IDOR with Geolocation data not stripped from images
#### URL 
https://hackerone.com/reports/906907
#### Severity score
null
#### Reporter 
do_some_hack
### Bounty paid
$200


---


### Title
'cnvID' parameter vulnerable to Insecure Direct Object References
#### URL 
https://hackerone.com/reports/265284
#### Severity score
null
#### Reporter 
r3naissance
### Bounty paid
null


---


### Title
[Subgroups] Unprivileged User Can Disclose Private Group Names
#### URL 
https://hackerone.com/reports/215384
#### Severity score
null
#### Reporter 
ysx
### Bounty paid
null


---


### Title
IDOR on deleting drafts on https://apps.topcoder.com/wiki/users/viewmydrafts.action via discardDraftId parameter
#### URL 
https://hackerone.com/reports/868590
#### Severity score
5.7
#### Reporter 
powerpuff
### Bounty paid
null


---


### Title
Update any profile
#### URL 
https://hackerone.com/reports/260604
#### Severity score
0
#### Reporter 
samczsun
### Bounty paid
$100


---


### Title
[www.zomato.com] IDOR - Delete/Deactivate ANY/ALL Promos through a Post Request at **clients/promoDataHandler.php**
#### URL 
https://hackerone.com/reports/264754
#### Severity score
null
#### Reporter 
prateek_0490
### Bounty paid
$200


---


### Title
IDOR to cancel any table booking and leak sensitive information such as email,mobile number,uuid
#### URL 
https://hackerone.com/reports/265258
#### Severity score
null
#### Reporter 
darwinks
### Bounty paid
$250


---


### Title
IDOR leads to Edit Anyone's Blogs / Websites
#### URL 
https://hackerone.com/reports/974222
#### Severity score
null
#### Reporter 
mygf
### Bounty paid
$200


---


### Title
India - An Insecure Direct Object Reference (IDOR) allowed unauthorized access to view card index number and monetary balance
#### URL 
https://hackerone.com/reports/701160
#### Severity score
5
#### Reporter 
mr_intrusionist
### Bounty paid
$250


---


### Title
IDOR in changing shared file name
#### URL 
https://hackerone.com/reports/547663
#### Severity score
4.2
#### Reporter 
dhakal_ananda
### Bounty paid
null


---


### Title
[NR Insights] Pull any Insights/NRQL data from any NR account
#### URL 
https://hackerone.com/reports/397137
#### Severity score
null
#### Reporter 
jon_bottarini
### Bounty paid
$2,500


---


### Title
IDOR allow to extract all registered email
#### URL 
https://hackerone.com/reports/302485
#### Severity score
null
#### Reporter 
ranjit_p
### Bounty paid
$300


---


### Title
IDOR at 'media_code' when addings media to questions
#### URL 
https://hackerone.com/reports/915133
#### Severity score
null
#### Reporter 
bugra
### Bounty paid
$150


---


### Title
Singapore - Account Takeover via IDOR
#### URL 
https://hackerone.com/reports/876300
#### Severity score
9
#### Reporter 
ko2sec
### Bounty paid
$6,000


---


### Title
Replace other user files in Inbox messages 
#### URL 
https://hackerone.com/reports/322661
#### Severity score
5.7
#### Reporter 
rijalrojan
### Bounty paid
$1,000


---


### Title
IDOR on update user preferences
#### URL 
https://hackerone.com/reports/854290
#### Severity score
10
#### Reporter 
macasun
### Bounty paid
null


---


### Title
[NR Synthetics] (IDOR) Ability to see full name associated with other New Relic accounts through workaround of #255894
#### URL 
https://hackerone.com/reports/267636
#### Severity score
4.3
#### Reporter 
jon_bottarini
### Bounty paid
$1,500


---


### Title
A user can view the name and number of a customer in another company if the GUID is known
#### URL 
https://hackerone.com/reports/788375
#### Severity score
null
#### Reporter 
spaceraccoon
### Bounty paid
$250


---


### Title
View another user information with IDOR vulnerability 
#### URL 
https://hackerone.com/reports/1004745
#### Severity score
null
#### Reporter 
silentbreach
### Bounty paid
null


---


### Title
Insecure redirect rule results in bypassing ban redirect on certain pages
#### URL 
https://hackerone.com/reports/703058
#### Severity score
5.4
#### Reporter 
jfc5sb
### Bounty paid
$800


---


### Title
Moving a report to a different program doesn't reassign the Custom Field Values
#### URL 
https://hackerone.com/reports/511779
#### Severity score
3.4
#### Reporter 
jobert
### Bounty paid
null


---


### Title
Singapore - IDOR in campaign.starbucks.com.sg
#### URL 
https://hackerone.com/reports/783332
#### Severity score
4.4
#### Reporter 
bytebunny
### Bounty paid
null


---


### Title
Ability to generate shipping labels in another store orders
#### URL 
https://hackerone.com/reports/884159
#### Severity score
null
#### Reporter 
francisbeaudoin
### Bounty paid
$1,000


---


### Title
IDOR on partners.uber.com allows for a driver to override administrator documents
#### URL 
https://hackerone.com/reports/194594
#### Severity score
null
#### Reporter 
indoappsec
### Bounty paid
$500


---


### Title
Use any User to Follow you (Increase Followers) [IDOR]
#### URL 
https://hackerone.com/reports/245969
#### Severity score
null
#### Reporter 
bountypls
### Bounty paid
$50


---


### Title
[█████] Get all tickets (IDOR)
#### URL 
https://hackerone.com/reports/498351
#### Severity score
null
#### Reporter 
jarvis7
### Bounty paid
null


---


### Title
IDOR on Program Visibilty (Revealed / Concealed) against other team members
#### URL 
https://hackerone.com/reports/291721
#### Severity score
null
#### Reporter 
japz
### Bounty paid
null


---


### Title
IDOR when editing users leads to Account Takeover without User Interaction at CrowdSignal
#### URL 
https://hackerone.com/reports/915114
#### Severity score
null
#### Reporter 
bugra
### Bounty paid
$650


---


### Title
IDOR in Report CSV export discloses the IDs of Custom Field Attributes of Programs
#### URL 
https://hackerone.com/reports/510759
#### Severity score
3.8
#### Reporter 
jobert
### Bounty paid
null


---


### Title
████ █████ exposes highly sensitive information to public
#### URL 
https://hackerone.com/reports/388554
#### Severity score
null
#### Reporter 
cablej_dds
### Bounty paid
null


---


### Title
[IDOR]Ability to View/Delete/Edit (Forward to attachment archive) Email of other user if GUID is known.
#### URL 
https://hackerone.com/reports/808997
#### Severity score
null
#### Reporter 
base_64
### Bounty paid
$250


---


### Title
Full Account Take-Over of ████████ Members via IDOR
#### URL 
https://hackerone.com/reports/847452
#### Severity score
null
#### Reporter 
r00tpgp
### Bounty paid
null


---


### Title
idor on upload profile functionality 
#### URL 
https://hackerone.com/reports/741683
#### Severity score
null
#### Reporter 
risinghunter
### Bounty paid
null


---


### Title
Adding a new user discloses their full name in the "Users" section of NR Alerts notification channels page
#### URL 
https://hackerone.com/reports/344309
#### Severity score
null
#### Reporter 
jon_bottarini
### Bounty paid
$1,500


---


### Title
idor allows you to delete photos and album from a gallery
#### URL 
https://hackerone.com/reports/380410
#### Severity score
null
#### Reporter 
black_b
### Bounty paid
$1,500


---


### Title
IDOR on stocky application-Low Stock-Varient-Settings-Columns
#### URL 
https://hackerone.com/reports/853130
#### Severity score
4.6
#### Reporter 
sreeju_kc
### Bounty paid
$750


---


### Title
IDOR at https://account.mackeeper.com/at/load-reports/profile/<profile_id> leaks information about devices/licenses
#### URL 
https://hackerone.com/reports/783117
#### Severity score
5
#### Reporter 
m4-k
### Bounty paid
$300


---


### Title
[IDOR] The authenticated user can restart website build or view build logs on any another Federalist account
#### URL 
https://hackerone.com/reports/245872
#### Severity score
null
#### Reporter 
sp1d3rs
### Bounty paid
$350


---


### Title
IDOR widget.support.my.com
#### URL 
https://hackerone.com/reports/328337
#### Severity score
5.3
#### Reporter 
w2w
### Bounty paid
$1,000


---


### Title
Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent
#### URL 
https://hackerone.com/reports/717729
#### Severity score
5
#### Reporter 
jobert
### Bounty paid
null


---


### Title
[app.mavenlink.com] IDOR to view sensitive information
#### URL 
https://hackerone.com/reports/283419
#### Severity score
null
#### Reporter 
dyoon
### Bounty paid
$500


---


### Title
Participation of expired account holders in Projects can occure financial loss to Mavenlink 
#### URL 
https://hackerone.com/reports/261221
#### Severity score
2.6
#### Reporter 
rashedhasan007
### Bounty paid
$200


---


### Title
account takeover on 3.0.1 version
#### URL 
https://hackerone.com/reports/842625
#### Severity score
9.9
#### Reporter 
elfiman
### Bounty paid
null


---


### Title
Adding everyone to the repo due to the lack of rate limit
#### URL 
https://hackerone.com/reports/978768
#### Severity score
null
#### Reporter 
sadd_man
### Bounty paid
null


---


### Title
Account takeover through password reset in cups.mail.ru
#### URL 
https://hackerone.com/reports/843160
#### Severity score
8.4
#### Reporter 
weev3kyaw
### Bounty paid
$1,500


---


### Title
relap.io IDOR
#### URL 
https://hackerone.com/reports/749887
#### Severity score
null
#### Reporter 
shuraros
### Bounty paid
$750


---


### Title
IDOR create accounts and verify them with original account email
#### URL 
https://hackerone.com/reports/244636
#### Severity score
null
#### Reporter 
b3nac
### Bounty paid
null


---


### Title
User can run monitors at private locations, which he has no access to
#### URL 
https://hackerone.com/reports/681001
#### Severity score
null
#### Reporter 
skavans
### Bounty paid
$3,000


---


### Title
How the Bug stole hacking
#### URL 
https://hackerone.com/reports/762510
#### Severity score
null
#### Reporter 
the_arch_angel
### Bounty paid
null


---


### Title
[NR Alerts/Synthetics] IDOR through /policies.json with Synthetics exposes full name of other NR users
#### URL 
https://hackerone.com/reports/419875
#### Severity score
null
#### Reporter 
jon_bottarini
### Bounty paid
$1,500


---


### Title
IDOR in https://3d.cs.money/
#### URL 
https://hackerone.com/reports/990878
#### Severity score
null
#### Reporter 
khoabda1
### Bounty paid
$200


---


### Title
IDOR to update folder name of other user
#### URL 
https://hackerone.com/reports/587687
#### Severity score
3.4
#### Reporter 
toannc123
### Bounty paid
null


---


### Title
IDOR on notes to HTML injection
#### URL 
https://hackerone.com/reports/914331
#### Severity score
null
#### Reporter 
ph-hitachi
### Bounty paid
null


---


### Title
IDOR в списке пользователей по домену в relap.io
#### URL 
https://hackerone.com/reports/739752
#### Severity score
6.1
#### Reporter 
agametov
### Bounty paid
$500


---


### Title
Add and Access to Labels of any Private Projects/Groups of Gitlab(IDOR)
#### URL 
https://hackerone.com/reports/439729
#### Severity score
null
#### Reporter 
indoappsec
### Bounty paid
$1,000


---


### Title
IDOR and statistics leakage in Orders 
#### URL 
https://hackerone.com/reports/544329
#### Severity score
5.9
#### Reporter 
updatelap
### Bounty paid
$289


---


### Title
Stealing data from customers.gitlab.com without user interaction
#### URL 
https://hackerone.com/reports/674195
#### Severity score
8.1
#### Reporter 
rpadovani
### Bounty paid
$3,500


---


### Title
IDOR - User is able to download charts/dashboards from cross accounts
#### URL 
https://hackerone.com/reports/975749
#### Severity score
null
#### Reporter 
k3ne
### Bounty paid
null


---


### Title
Able to purchase a gift card with any amount
#### URL 
https://hackerone.com/reports/316789
#### Severity score
8.3
#### Reporter 
qwacsawd
### Bounty paid
null


---


### Title
Embedded submission form UUIDs can be enumerated through GraphQL node interface, exposing sensitive program details
#### URL 
https://hackerone.com/reports/447930
#### Severity score
7.5
#### Reporter 
jobert
### Bounty paid
null


---


### Title
Security@ email forwarding and Embedded Submission drafts can be used to obtain copy of deleted attachments from other HackerOne users
#### URL 
https://hackerone.com/reports/1034346
#### Severity score
7.5
#### Reporter 
jobert
### Bounty paid
null


---


### Title
IDOR allows any user to edit others videos
#### URL 
https://hackerone.com/reports/681473
#### Severity score
null
#### Reporter 
zerody
### Bounty paid
$1,500


---


### Title
Thailand - IDOR on www.starbuckscardth.in.th: A logged in user could view any Thailand Starbucks card balance if they knew that Starbucks card number
#### URL 
https://hackerone.com/reports/858662
#### Severity score
null
#### Reporter 
nnez
### Bounty paid
null


---


### Title
Organization Takeover via invitation API
#### URL 
https://hackerone.com/reports/835005
#### Severity score
null
#### Reporter 
azraelsec
### Bounty paid
$100


---


### Title
IDOR - setAttribute action of user object in API
#### URL 
https://hackerone.com/reports/285432
#### Severity score
null
#### Reporter 
logan5
### Bounty paid
$400


---


### Title
Share recipient can modify a share's expiration date
#### URL 
https://hackerone.com/reports/447494
#### Severity score
4.3
#### Reporter 
icewater
### Bounty paid
$100


---


### Title
NR Internal_API call allows me to read the events/violations/policies/messages of ANY New Relic account (AND pull data from infrastructure)
#### URL 
https://hackerone.com/reports/271393
#### Severity score
8.6
#### Reporter 
jon_bottarini
### Bounty paid
$1,000


---


### Title
View & add to cart unlisted items via IDOR
#### URL 
https://hackerone.com/reports/344284
#### Severity score
null
#### Reporter 
bigshaq
### Bounty paid
$100


---


### Title
[api-site.city-mobil.ru] Improper access control leads to information disclosure
#### URL 
https://hackerone.com/reports/977597
#### Severity score
8.3
#### Reporter 
act1on3
### Bounty paid
$5,000


---


### Title
IDOR on DoD Website exposes FTP users and passes linked to all accounts!
#### URL 
https://hackerone.com/reports/228383
#### Severity score
null
#### Reporter 
cdl
### Bounty paid
null


---


### Title
IDOR when editing email leads to Account Takeover on Atavist
#### URL 
https://hackerone.com/reports/950881
#### Severity score
null
#### Reporter 
bugra
### Bounty paid
$150


---


### Title
Web protection component in Anti-Virus products family uses predictable links for certificate warnings
#### URL 
https://hackerone.com/reports/469372
#### Severity score
null
#### Reporter 
palant
### Bounty paid
$2,500


---


### Title
В самокат имеется возможность просмотра суммы заказа и номера заказа по ID [smart.space]
#### URL 
https://hackerone.com/reports/959329
#### Severity score
3.1
#### Reporter 
kwel
### Bounty paid
$150


---


### Title
Ability to run monitors' jobs of other accounts and to read these jobs content (including the secure credentials values)
#### URL 
https://hackerone.com/reports/787886
#### Severity score
null
#### Reporter 
skavans
### Bounty paid
$2,500


---


### Title
Missing ownership check on remote wipe endpoint
#### URL 
https://hackerone.com/reports/819807
#### Severity score
7.7
#### Reporter 
hitman_47
### Bounty paid
$500


---


### Title
IDOR of contracts on dictor.mail.ru
#### URL 
https://hackerone.com/reports/923851
#### Severity score
0
#### Reporter 
tr3harder
### Bounty paid
$150


---


### Title
В самокате можно просматривать и изменять данные любого заказа без авторизации
#### URL 
https://hackerone.com/reports/948481
#### Severity score
6.5
#### Reporter 
kwel
### Bounty paid
$400


---


### Title
I.D.O.R TO EDIT ALL USER'S CREDIT CARD INFORMATION+(Partial credit card info disclosure)
#### URL 
https://hackerone.com/reports/361984
#### Severity score
4.3
#### Reporter 
hk755a
### Bounty paid
$500


---


### Title
Able to View other users income history
#### URL 
https://hackerone.com/reports/361133
#### Severity score
null
#### Reporter 
amaljacob
### Bounty paid
null


---


### Title
[IDOR]Ability to edit Description of api_key's of other users.
#### URL 
https://hackerone.com/reports/809967
#### Severity score
5
#### Reporter 
base_64
### Bounty paid
$250


---


### Title
IDOR позволяет изменить информацию о пользователе.
#### URL 
https://hackerone.com/reports/708182
#### Severity score
5.3
#### Reporter 
iframe
### Bounty paid
null


---


### Title
IDOR to view other user folder name
#### URL 
https://hackerone.com/reports/333767
#### Severity score
null
#### Reporter 
ranjit_p
### Bounty paid
$250


---


### Title
IDOR: Adding Contacts to Other User Groups
#### URL 
https://hackerone.com/reports/879960
#### Severity score
null
#### Reporter 
ameyanekar
### Bounty paid
null


---


### Title
IDOR in marketing calendar tool
#### URL 
https://hackerone.com/reports/797685
#### Severity score
5
#### Reporter 
a_d_a_m
### Bounty paid
$500


---


### Title
Possibility to view subdepartments for arbitrary domain
#### URL 
https://hackerone.com/reports/287378
#### Severity score
null
#### Reporter 
chaosbolt
### Bounty paid
$500


---


### Title
Any user with access to program can resume and suspend HackerOne Gateway
#### URL 
https://hackerone.com/reports/717716
#### Severity score
5
#### Reporter 
jobert
### Bounty paid
null


---


### Title
Ability to view monitor names of other NR accounts through internal API (v3) via "monitor_id" parameter 
#### URL 
https://hackerone.com/reports/462321
#### Severity score
null
#### Reporter 
jon_bottarini
### Bounty paid
$2,000


---


### Title
[api.pandao.ru] IDOR позволяет изменять адрес любого пользователя
#### URL 
https://hackerone.com/reports/484339
#### Severity score
7.5
#### Reporter 
eremeev
### Bounty paid
$1,000


---


### Title
[EE] change the author of post using the author_id
#### URL 
https://hackerone.com/reports/338477
#### Severity score
null
#### Reporter 
flex0geek
### Bounty paid
null


---


### Title
Read Access to all comments on unauthorized forums' discussions! IDOR! 
#### URL 
https://hackerone.com/reports/308610
#### Severity score
4.3
#### Reporter 
ta8ahi
### Bounty paid
$500


---


### Title
IDOR in activateFuelCard id allows bulk lookup of driver uuids
#### URL 
https://hackerone.com/reports/254151
#### Severity score
null
#### Reporter 
cablej
### Bounty paid
$500


---


### Title
Disclose anonymous accessible link on embedded files in paper dropbox sessions
#### URL 
https://hackerone.com/reports/462173
#### Severity score
8.3
#### Reporter 
karlito
### Bounty paid
null


---


### Title
[auto.mail.ru] IDOR на редактирование поста любого юзера.
#### URL 
https://hackerone.com/reports/651966
#### Severity score
5.3
#### Reporter 
bughd2
### Bounty paid
null


---


### Title
[api.pandao.ru] IDOR for order delivery address
#### URL 
https://hackerone.com/reports/723461
#### Severity score
null
#### Reporter 
n4sty
### Bounty paid
$3,000


---


### Title
IDOR in Bugs overview enables attacker to determine the date range a hackathon was active
#### URL 
https://hackerone.com/reports/663431
#### Severity score
3.8
#### Reporter 
jobert
### Bounty paid
null


---


### Title
IDOR of users 
#### URL 
https://hackerone.com/reports/743687
#### Severity score
5.9
#### Reporter 
tr3harder
### Bounty paid
$500


---


### Title
[city-mobil.ru/taxiserv/] IDOR leads to driver account takeover
#### URL 
https://hackerone.com/reports/751281
#### Severity score
5.8
#### Reporter 
act1on3
### Bounty paid
$8,000


---


### Title
Arbitary file download vulnerability on a DoD website
#### URL 
https://hackerone.com/reports/230714
#### Severity score
null
#### Reporter 
alyssa_herrera
### Bounty paid
null


---


### Title
IDOR in editing courses
#### URL 
https://hackerone.com/reports/227522
#### Severity score
null
#### Reporter 
kieran
### Bounty paid
$300


---


### Title
Arbitary file download vulnerability on a DoD website
#### URL 
https://hackerone.com/reports/230870
#### Severity score
null
#### Reporter 
alyssa_herrera
### Bounty paid
null


---


### Title
Comment restriction in subsection "Workshop" of domain "steamcommunity.com" can be bypassed using IDOR
#### URL 
https://hackerone.com/reports/365504
#### Severity score
null
#### Reporter 
ronak_9889
### Bounty paid
$200


---


### Title
[IDOR] Attacker user can Approve/Decline AFK on the behalf of other users
#### URL 
https://hackerone.com/reports/725569
#### Severity score
null
#### Reporter 
hodkasia_sachin
### Bounty paid
$100


---


### Title
IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/users
#### URL 
https://hackerone.com/reports/415081
#### Severity score
7.1
#### Reporter 
born2hack
### Bounty paid
$10,500


---


### Title
Unreleased CTF Levels are Revealed on /group/user/ID1?user=USERID endpoint
#### URL 
https://hackerone.com/reports/536853
#### Severity score
2.4
#### Reporter 
spaceraccoon
### Bounty paid
$500


---


### Title
User uploaded portfolio files can be accessed by any user even after deleted
#### URL 
https://hackerone.com/reports/300179
#### Severity score
null
#### Reporter 
tolo7010
### Bounty paid
$150


---


### Title
[www.zomato.com] IDOR - Leaking all Personal Details of all Zomato Users through an endpoint
#### URL 
https://hackerone.com/reports/269937
#### Severity score
7.5
#### Reporter 
prateek_0490
### Bounty paid
$750


---


### Title
Importing GitLab project archives can replace uploads of other users
#### URL 
https://hackerone.com/reports/534794
#### Severity score
7.5
#### Reporter 
ajxchapman
### Bounty paid
$5,000


---


### Title
IDOR when moving contents at CrowdSignal
#### URL 
https://hackerone.com/reports/915127
#### Severity score
null
#### Reporter 
bugra
### Bounty paid
$550


---


### Title
Metadata leakage via IDOR
#### URL 
https://hackerone.com/reports/762707
#### Severity score
4.3
#### Reporter 
0xskull
### Bounty paid
null


---


### Title
Access to Private Photos of Apps in App section(IDOR)
#### URL 
https://hackerone.com/reports/318751
#### Severity score
4.6
#### Reporter 
indoappsec
### Bounty paid
$500


---


### Title
IDOR + Account Takeover  [UNAUTHENTICATED]
#### URL 
https://hackerone.com/reports/1004750
#### Severity score
null
#### Reporter 
silentbreach
### Bounty paid
null


---


### Title
[IDOR]Ability to Pause & Resume the Invoice of other users If GUID is known.
#### URL 
https://hackerone.com/reports/811566
#### Severity score
5
#### Reporter 
base_64
### Bounty paid
$250


---


### Title
Read-Only user can delete users
#### URL 
https://hackerone.com/reports/888729
#### Severity score
null
#### Reporter 
amr321
### Bounty paid
$50


---


### Title
Amount Manipulation Buy Unlimited Credits in just $1.00
#### URL 
https://hackerone.com/reports/277377
#### Severity score
null
#### Reporter 
anonymousmian
### Bounty paid
null


---


### Title
Thailand - Insecure Direct Object Reference permits an unauthorized user to transfer funds from a victim using only the victims Starbucks card
#### URL 
https://hackerone.com/reports/766437
#### Severity score
7.6
#### Reporter 
nnez
### Bounty paid
null


---


### Title
[www.zomato.com] IDOR - Delete/Deactivate any special menu of any Restaurants from Zomato
#### URL 
https://hackerone.com/reports/264919
#### Severity score
null
#### Reporter 
prateek_0490
### Bounty paid
$100


---


### Title
Подмена SSL-сертификата для любой группы в секции Управление группой->Работа с API неавторизированным пользователем.
#### URL 
https://hackerone.com/reports/215326
#### Severity score
3.7
#### Reporter 
test_universe
### Bounty paid
$200


---


### Title
IDOR to Account Takeover on https://████/index.html
#### URL 
https://hackerone.com/reports/969223
#### Severity score
null
#### Reporter 
nagli
### Bounty paid
null


---


### Title
[NR Insights] IDOR - Modify the filter settings for any NR Insights dashboard through internal_api endpoint
#### URL 
https://hackerone.com/reports/459443
#### Severity score
null
#### Reporter 
jon_bottarini
### Bounty paid
$2,500


---


### Title
IDOR via internal_api "users" endpoint 
#### URL 
https://hackerone.com/reports/349291
#### Severity score
null
#### Reporter 
jon_bottarini
### Bounty paid
$1,500


---


### Title
IDOR on HackerOne Feedback Review
#### URL 
https://hackerone.com/reports/262661
#### Severity score
3.4
#### Reporter 
japz
### Bounty paid
null


---


### Title
IDOR to delete images from other stores
#### URL 
https://hackerone.com/reports/404797
#### Severity score
null
#### Reporter 
emitrani
### Bounty paid
$600


---


### Title
[capsula.mail.ru] overriding order info
#### URL 
https://hackerone.com/reports/859357
#### Severity score
null
#### Reporter 
anyday
### Bounty paid
null


---


### Title
IDOR allow access to payments data of any user
#### URL 
https://hackerone.com/reports/751577
#### Severity score
null
#### Reporter 
dakitu
### Bounty paid
$1,000


---


### Title
IDOR when creating App on [platform.streamlabs.com/api/v1/store/whitelist] with user_id field
#### URL 
https://hackerone.com/reports/983070
#### Severity score
null
#### Reporter 
bugra
### Bounty paid
$100


---


### Title
Bypass of my two other reports #267636 + #255894 - (IDOR) Ability to see full name associated with other New Relic accounts
#### URL 
https://hackerone.com/reports/271861
#### Severity score
null
#### Reporter 
jon_bottarini
### Bounty paid
null


---


### Title
Attacker can create new account inside any partnership with no approve from the Partnership owner
#### URL 
https://hackerone.com/reports/786109
#### Severity score
null
#### Reporter 
skavans
### Bounty paid
$695


---


### Title
information disclosure via IDOR on "https://target.my.com/api/v2/coverage/segment.json?id={id}" endpoint
#### URL 
https://hackerone.com/reports/763258
#### Severity score
0
#### Reporter 
shuraros
### Bounty paid
null


---


### Title
idor leads to leak order information
#### URL 
https://hackerone.com/reports/791289
#### Severity score
3.8
#### Reporter 
risinghunter
### Bounty paid
$150


---


### Title
I.D.O.R To Order,Book,Buy,reserve On YELP FOR FREE (UNAUTHORIZED USE OF OTHER USER'S CREDIT CARD)
#### URL 
https://hackerone.com/reports/391092
#### Severity score
null
#### Reporter 
hk755a
### Bounty paid
$2,500


---


### Title
IDOR bug to See hidden slowvote of any user even when you dont have access right
#### URL 
https://hackerone.com/reports/661978
#### Severity score
null
#### Reporter 
ranjit_p
### Bounty paid
$300


---


### Title
Possible to view and takeover other user's education and courses @ mijn.werkenbijdefensie.nl
#### URL 
https://hackerone.com/reports/217558
#### Severity score
5.4
#### Reporter 
jorik
### Bounty paid
$300


---


### Title
Able to bypass information requirements before launching a Chat.
#### URL 
https://hackerone.com/reports/450882
#### Severity score
null
#### Reporter 
ozzyoz
### Bounty paid
null


---


### Title
Identify unique user ID of all the profiles 
#### URL 
https://hackerone.com/reports/1005020
#### Severity score
null
#### Reporter 
covertlyovert
### Bounty paid
$300


---


### Title
Cross-account reading of Insights dashboards through GraphQL
#### URL 
https://hackerone.com/reports/765565
#### Severity score
null
#### Reporter 
skavans
### Bounty paid
$1,500


---


### Title
IDOR spam anyone's cellphone number through Cuvva app link
#### URL 
https://hackerone.com/reports/232562
#### Severity score
null
#### Reporter 
b3nac
### Bounty paid
null


---


### Title
Private videos can be added to our playlists
#### URL 
https://hackerone.com/reports/246819
#### Severity score
null
#### Reporter 
rahulztej
### Bounty paid
null


---


### Title
Idor on the DELETE /comments/
#### URL 
https://hackerone.com/reports/861849
#### Severity score
null
#### Reporter 
tandav
### Bounty paid
null


---


### Title
IDOR exposes receipts of all users.
#### URL 
https://hackerone.com/reports/283407
#### Severity score
9.3
#### Reporter 
cablej
### Bounty paid
null


---


### Title
███████ Site Exposes █████████ forms
#### URL 
https://hackerone.com/reports/395246
#### Severity score
null
#### Reporter 
cablej_dds
### Bounty paid
null


---


### Title
Access to information about any video and its owner via GraphQL endpoint [dictor.mail.ru]
#### URL 
https://hackerone.com/reports/924914
#### Severity score
null
#### Reporter 
organdonor
### Bounty paid
$2,500


---


### Title
IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email 
#### URL 
https://hackerone.com/reports/230328
#### Severity score
null
#### Reporter 
khizer47
### Bounty paid
null


---


### Title
Improper access control leading to deletion of Greeting videos on {https://smtp.8mar.mail.ru/}
#### URL 
https://hackerone.com/reports/834065
#### Severity score
0
#### Reporter 
dedsec69
### Bounty paid
null


---


### Title
Ability to edit the address of any company by its id on [corporate.city-mobil.ru]
#### URL 
https://hackerone.com/reports/952174
#### Severity score
0
#### Reporter 
organdonor
### Bounty paid
$150


---


### Title
IDOR in eform.molpay.com leads to see other users application forms with private data
#### URL 
https://hackerone.com/reports/790829
#### Severity score
null
#### Reporter 
fpatrik
### Bounty paid
$500


---


### Title
Improper access control on adding a Register to an Outlet
#### URL 
https://hackerone.com/reports/317332
#### Severity score
4.9
#### Reporter 
al88nsk
### Bounty paid
null


---