浏览报告
10 份报告 · 本页赏金 $100 · 清除筛选
Able to see location coordinates in any event without permission to do so信息泄露FetLife低危—2024-09-25Able to see highest poll result without voting or view result信息泄露FetLife低危—2023-11-15fetlife.com/signup_step_profile expose access_token of mapbox.com密码学缺陷FetLife低危—2023-11-01Race condition in endpoint POST fetlife.com/users/invitation, allow attacker to generate unlimited invites业务逻辑FetLife低危—2022-03-09Able to access private picture/video/writing when requesting for their JSON response信息泄露FetLife低危—2021-12-16Able to detect if a user is FetLife supporter although this user hides their support badge in fetlife.com/conversations/{id} JSON response信息泄露FetLife低危—2022-02-11Specific Payload makes a Users Posts unavailable拒绝服务FetLife低危$1002022-01-26Stored XSS via Angular Expression injection via Subject while starting conversation with other users.跨站脚本FetLife低危—2021-03-07Stored XSS via `Create a Fetish` section.跨站脚本FetLife低危—2021-02-25Google API key leaked to Public信息泄露FetLife低危—2021-01-23