POJIA破甲
地图 / password field autocomplete enabled

password field autocomplete enabled

信息泄露 / 敏感信息不安全存储 / #1023773

厂商
Yelp
严重程度
低危 · CVSS 5.4
赏金
—
弱点
敏感信息不安全存储
研究员
@er_salil
披露日期
2022-09-27
资产
*.yelp.com
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(972 字符中的一小部分)
Summary: [Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications that employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Yelp 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @er_salil · 版权归作者与 Yelp 所有

同类报告

[Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoUber · 2021-02-25 · $40,000Chaining Bugs: Leakage of CSRF token which leads to Stored XSS and Account Takeover (xs1.tribalwars.cash)InnoGames · — · $1,100Adding phone number to profile By OTP brute forcingCoinMate.io · 2026-08-08 · $100Able to view hackerone reports attachmentsGitLab · 2022-07-11insecure storage of information, you can view any file uploaded to the server without authentication and only with a single linkRadancy · —Local File Disclosure on the █████ (https://████████.edu/) leads to the full source code disclosure and credentials leakU.S. Dept Of Defense · 2024-06-27