← 返回地图破甲

浏览报告

仅含 CVE

72 份报告 · 本页赏金 $29,100 · 清除筛选

Exposed proxy allows to access internal reddit domains访问控制Reddit中危$7,5002025-02-24 IDOR lets a malicious user reveal the unpinned achievement badges of any Reddit user不安全的直接对象引用Reddit低危—2024-08-09 Infromation Disclosure To Use of Hard-coded Cryptographic Key密码学缺陷Reddit低危—2024-02-06 Huge amount of Subdomains Takeovers at Reddit.com访问控制Reddit低危—2023-05-18 Regression on dest parameter sanitization doesn't check scheme/websafe destinations跨站脚本Reddit低危$5002023-06-03 [accounts.reddit.com] Redirect parameter allows for XSS跨站脚本Reddit中危$5,0002023-05-18 Blind SSRF to internal services in matrix preview_link API服务端请求伪造Reddit中危$6,0002023-04-26 RichText parser vulnerability in scheduled posts allows XSS跨站脚本Reddit中危$5,0002023-04-20 Reflected XSS via File Upload跨站脚本Reddit低危—2023-05-18 oauth misconfigration lead to account takeover访问控制Reddit未评级—2023-05-18 CVE-2020-11022跨站脚本Reddit低危—2023-05-18 api keys leaked访问控制Reddit低危—2022-11-10 read and message other user's messages不安全的直接对象引用Reddit高危—2023-05-18 HTML injection in API response including request url代码执行Reddit高危—2023-05-18 sensitive data exposure信息泄露Reddit中危—2022-11-10 IDOR allows an attacker to modify the links of any user不安全的直接对象引用Reddit中危—2022-09-30 Getting access of mod logs from any public or restricted subreddit with IDOR vulnerability不安全的直接对象引用Reddit中危$5,0002022-08-04 Reddit talk promotion offers don't expire, allowing users to accept them after being demoted不安全的直接对象引用Reddit低危—2022-10-03 Can use the Reddit android app as usual even though revoking the access of it from reddit.com身份认证Reddit高危—2022-07-16 Rate limit is implemented in Reddit , but its not working .身份认证Reddit低危—2023-05-18 Unrestricted File Upload on reddit.secure.force.com其他弱点Reddit低危$1002022-09-30 Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.访问控制Reddit中危—2022-11-14 Several Subdomains Takeover错误配置Reddit中危—2022-06-08 Misconfigurated login page able to lock login action for any account without user interaction身份认证Reddit高危—2022-06-06 One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.com访问控制Reddit高危—2022-08-02