Browse / New Relic

New Relic

See its reports on the map

What gets reported to New Relic

• Access Control37
• Cross-site Scripting35
• Authentication30
• Information Disclosure20
• Insecure Direct Object Reference17
• Open Redirect17

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Password theft login.newrelic.com via Request SmugglingHTTP Request Smuggling
   $3,000490 votes
2. Unsafe charts embedding implementation leads to cross-account stored XSS and SSRFCross-site Scripting (XSS) - Stored
   225 votes
3. Account Takeover via Email ID Change and Forgot Password FunctionalityImproper Authentication - Generic
   $2,048214 votes
4. Cross-account stored XSS at embedded chartsCross-site Scripting (XSS) - Stored
   158 votes
5. Stored XSS in notes (charts) because of insecure chart data JSON generationCross-site Scripting (XSS) - Stored
   147 votes
6. Reflected XSS in VPN ApplianceCross-site Scripting (XSS) - Reflected
   104 votes
7. CSTI at Plugin page leading to active stored XSS (Publisher name)Cross-site Scripting (XSS) - Stored
   92 votes
8. Stored XSS via malicious key value of Synthetics monitor tag when visiting an Insights dashboard with filtering enabledCross-site Scripting (XSS) - Stored
   $2,12386 votes
9. Urgent! Stored XSS at plugin's violations leading to account takeoverCross-site Scripting (XSS) - Stored
   79 votes
10. IDOR via internal_api "users" endpoint Insecure Direct Object Reference (IDOR)
    $1,50077 votes
11. Host Header InjectionOpen Redirect
    70 votes
12. Insecure Infrastructure Integrations YML Loading leads to Windows Privilege EscalationPrivilege Escalation
    63 votes
13. Internal API endpoint discloses full account name of email address associated with unconfirmed userInsecure Direct Object Reference (IDOR)
    $1,50063 votes
14. [synthetics.newrelic.com] SMTP header injection leads to (mass) arbitrary email sendingCRLF Injection
    $50060 votes
15. (Prerelease UI) Stored XSS via role name in JSON chartCross-site Scripting (XSS) - Stored
    $2,50049 votes
16. Reflected Cross site Scripting (XSS) on https://one.newrelic.comCross-site Scripting (XSS) - Reflected
    42 votes
17. User can run monitors at private locations, which he has no access toInsecure Direct Object Reference (IDOR)
    40 votes
18. Untrusted deserialization issue when loading newrelic.yml file in Java agent leads to code execution on hostDeserialization of Untrusted Data
    $76839 votes
19. Stored XSS in Brower `name` field reflected in two pagesCross-site Scripting (XSS) - Stored
    $3,00039 votes
20. SSRF in alerts.newrelic.com exposes entire internal networkServer-Side Request Forgery (SSRF)
    39 votes
21. Account takeover by using abandoned email id of victim which has already been changed to new by victim himself on one.newrelic.comImproper Authentication - Generic
    $30038 votes
22. [NR Insights] Pull any Insights/NRQL data from any NR accountInsecure Direct Object Reference (IDOR)
    $2,50037 votes
23. Bypass of my three other reports #267636 + #255894 + #271861 - (IDOR) Ability to see full name associated with other New Relic accountsInsecure Direct Object Reference (IDOR)
    $1,50037 votes
24. removed user can still join the organizationBusiness Logic Errors
    $25036 votes
25. Users can enable API access for free via mass assignmentPrivilege Escalation
    34 votes
26. Adding your account to victim's app via deeplink
    $10029 votes
27. Sending thousands of notifications with single requestUncontrolled Resource Consumption
    $50029 votes
28. [NR Insights] IDOR - Modify the filter settings for any NR Insights dashboard through internal_api endpointInsecure Direct Object Reference (IDOR)
    $2,50028 votes
29. Cache-Control Misconfiguration Leads to Sensitive Information LeakageInformation Disclosure
    28 votes
30. The impossibility of inclusion of the trial (BROWSER)Information Exposure Through an Error Message
    $20026 votes
31. HTML injection at Alert emailCode Injection
    $25025 votes
32. User to Admin privilege escalation in Infrastructure Conditions - /v2/accounts/1835740/alerts/conditionsPrivilege Escalation
    $50019 votes
33. Open redirection Open Redirect
    18 votes
34. Stored XSS firing at the "Add chart to note" popupCross-site Scripting (XSS) - Stored
    17 votes
35. Stored XSS firing at transaction map (applicationName field)Cross-site Scripting (XSS) - Stored
    17 votes
36. [NR Synthetics] Restricted User can add/modify alert conditions on monitors without any synthetics privileges Privilege Escalation
    $75016 votes
37. NR Internal_API call allows me to read the events/violations/policies/messages of ANY New Relic account (AND pull data from infrastructure)Insecure Direct Object Reference (IDOR)
    $1,00016 votes
38. A user with restricted privileges is able to view Phone Number + Billing Email of account ownerImproper Authentication - Generic
    16 votes
39. Cache purge requests are not authenticatedImproper Authentication - Generic
    16 votes
40. Stored XSS via "my recent queries" selector in NRQL dashboard builderCross-site Scripting (XSS) - Stored
    $2,50015 votes
41. [NR Synthetics] (IDOR) Ability to see full name associated with other New Relic accounts through workaround of #255894Insecure Direct Object Reference (IDOR)
    $1,50015 votes
42. Mobile Authentication Endpoint Credentials Brute-Force VulnerabilityImproper Authentication - Generic
    15 votes
43. Full name of other accounts exposed through NR API Explorer (another workaround of #476958)Privilege Escalation
    $75014 votes
44. GET request to accounts.json on support site leaks the root account license key and the browser license key to a restricted userInformation Disclosure
    $75014 votes
45. [NR Alerts/Synthetics] IDOR through /policies.json with Synthetics exposes full name of other NR usersInsecure Direct Object Reference (IDOR)
    $1,50014 votes
46. Blind SSRF in Ticketing Integrations Jira webhooks leading to internal network enumeration and blind HTTP requestsServer-Side Request Forgery (SSRF)
    14 votes
47. Stored XSS at APM key transactions listCross-site Scripting (XSS) - Stored
    13 votes
48. Stored XSS at APM applications listingCross-site Scripting (XSS) - Stored
    13 votes
49. Giving myself access to NR1 UI / one.newrelic.com without the proper feature flags on my accountClient-Side Enforcement of Server-Side Security
    $50013 votes
50. Internal Ports Scanning via Blind SSRFInformation Disclosure
    13 votes
51. Blind SSRF on synthetics.newrelic.comInformation Disclosure
    13 votes
52. Missing rate limit on passwordImproper Authentication - Generic
    13 votes
53. Cross-account stored XSS at notes (through "swf" note parameter)Cross-site Scripting (XSS) - Stored
    12 votes
54. Swiftype key stored in JavaScript source
    12 votes
55. stamp2-azure-ext.newrelic.com is vulnerable to MS12-020Remote File Inclusion
    12 votes
56. SSO Authentication BypassImproper Authentication - Generic
    12 votes
57. APT repository is signed using weak digest (SHA-1)Cryptographic Issues - Generic
    12 votes
58. Upgrade menu exposes the mobile application token meant to only be visible to administrators Privilege Escalation
    $75011 votes
59. [NR Insights] Data app permissions setting does not fully prevent other users from modifying/changing changing data related to your data app Privilege Escalation
    $75011 votes
60. Captcha Bypass on SignUp FormPrivacy Violation
    11 votes
61. [docs-ra.newrelic.com] subdomain and Drupal takeover via unconfigured endpointPrivilege Escalation
    11 votes
62. newrelic.atlassian.net - jira information disclosureImproper Authentication - Generic
    11 votes
63. CSRF- delete all empty server policyCross-Site Request Forgery (CSRF)
    11 votes
64. Adding a new user discloses their full name in the "Users" section of NR Alerts notification channels pageInsecure Direct Object Reference (IDOR)
    $1,50010 votes
65. [NR Synthetics] Restricted user can view synthetics monitors and user permissions through .json endpoint at /permissions/securablemetadata/{GROUP ID}Privilege Escalation
    $75010 votes
66. Session Hijacking Improper Authentication - Generic
    10 votes
67. Sensitive information contained with New Relic APM iOS applicationInformation Disclosure
    10 votes
68. Vulnerable Link Leaks the User NamesImproper Authentication - Generic
    10 votes
69. No validation on account namesViolation of Secure Design Principles
    10 votes
70. GitHub Integration doesn't sanitize repository URLs which might be attacker-controlledCross-site Scripting (XSS) - Stored
    9 votes
71. Stored XSS at Synthetics private locations (planted through location label or description)Cross-site Scripting (XSS) - Stored
    9 votes
72. Stored XSS Via NRQL chartbuilder JSON view Cross-site Scripting (XSS) - Stored
    $2,5009 votes
73. Restricted User is able to edit Alert Conditions of Synthetics Monitors even if Synthetics Permissions is enabled by an adminImproper Authentication - Generic
    9 votes
74. One Click Remote Code Injection - *.blog.newrelic.comCode Injection
    8 votes
75. Stored XSS at Mobile (Versions tab)Cross-site Scripting (XSS) - Stored
    8 votes
76. Mixed content issues on newrelic.comMan-in-the-Middle
    8 votes
77. Passive stored XSS at Synthetics job result page (View resource)Cross-site Scripting (XSS) - Stored
    8 votes
78. Ability to view monitor names of other NR accounts through internal API (v3) via "monitor_id" parameter Insecure Direct Object Reference (IDOR)
    $2,0008 votes
79. Drupal admin takeover via install.php not being performed prior to install.Privilege Escalation
    8 votes
80. [NR Alerts/Synthetics?] User with no Synthetics permissions can view synthetic monitor details through /internal_api/ endpointPrivilege Escalation
    $7508 votes
81. Bypass of my two other reports #267636 + #255894 - (IDOR) Ability to see full name associated with other New Relic accountsInsecure Direct Object Reference (IDOR)
    8 votes
82. Logic flaw enables restricted account to access account license keyPrivilege Escalation
    $5008 votes
83. JIRA account misconfig causes internal info leakInformation Disclosure
    8 votes
84. https://rpm.newrelic.com/login vulnerable to host header attackOpen Redirect
    8 votes
85. HTML Injection In Email In one.newrelic.comCode Injection
    7 votes
86. [Bypass] Code injection to open redirect in https://insights.newrelic.com/accounts/2521182/dashboards/1026927Open Redirect
    7 votes
87. Restricted user can view all account invoices, payment method details, PII of account owner through zoura_api endpointsPrivilege Escalation
    $9007 votes
88. CSRF For Adding UsersCross-Site Request Forgery (CSRF)
    7 votes
89. CSRF vulnerability that allows an attacker to purge plugin metric dataCross-Site Request Forgery (CSRF)
    7 votes
90. Leaking license key in source codeInformation Disclosure
    7 votes
91. Session Management FlawImproper Authentication - Generic
    7 votes
92. SSRF on synthetics.newrelic.com permitting access to sensitive dataInformation Disclosure
    7 votes
93. Ability to run monitors' jobs of other accounts and to read these jobs content (including the secure credentials values)Insecure Direct Object Reference (IDOR)
    6 votes
94. NR-wide cross account access through misconfigured CORS-policy of multiple endpointsImproper Access Control - Generic
    6 votes
95. Stored XSS at APM transaction map (transactionName field)Cross-site Scripting (XSS) - Stored
    6 votes
96. CSRF at adding new role (user-management.service.newrelic.com)Cross-Site Request Forgery (CSRF)
    6 votes
97. IDOR allows accounts to view full name of other accounts based on email through share notes featurePrivilege Escalation
    $7506 votes
98. [NR Infrastructure] Restricted user can update integration provider account name via integrations APIPrivilege Escalation
    $7506 votes
99. [NR Alerts] Internal API exposes Synthetics monitor details to a restricted user without view monitor permissionsPrivilege Escalation
    $7506 votes
100. Restricted user can bypass permissions restriction to create NR Alert policiesPrivilege Escalation
     $5006 votes