HexBrain
Sign in

Browse / Misconfiguration

Misconfiguration

1,263disclosed reports
15weaknesses
$117,847paid in bounties

See it on the mapBypass libraryPayloads

Weaknesses in this class

Often found together with

Most upvoted Misconfiguration reports

AllValidInformativeN/ADuplicate

  1. URL link spoofingPhishing · low · Slack
    $250362 votes
  2. Web cache poisoning attack leads to user information and moreViolation of Secure Design Principles · Postmates
    $500343 votes
  3. Cross-site Scripting (XSS) - Stored in RDoc wiki pagesUI Redressing (Clickjacking) · high · GitLab
    $3,500282 votes
  4. DoS Vulnerability via Cache Poisoning on cdn.shopify.com and shopify-assets.shopifycdn.comCache Poisoning · medium · Shopify
    $3,800266 votes
  5. Bruteforce password recovery codeViolation of Secure Design Principles · Bumble
    258 votes
  6. [www.zomato.com] CORS Misconfiguration, could lead to disclosure of sensitive informationMisconfiguration · medium · Eternal
    $550246 votes
  7. Spring Actuator endpoints publicly available and broken authenticationMisconfiguration · critical · LY Corporation
    $12,500234 votes
  8. Internal Access to Hackerone confluence DocsMisconfiguration · high · HackerOne
    $12,500227 votes
  9. Github Account hijack through broken link in developer.twitter.comPhishing · high · X / xAI
    222 votes
  10. Ability To Delete User(s) Account Without User InteractionMisconfiguration · high · GitLab
    221 votes
  11. Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's originMisconfiguration · critical · Superhuman (formerly Grammarly)
    202 votes
  12. Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photosViolation of Secure Design Principles · medium · HackerOne
    194 votes
  13. Account creation with invalid email addresses / email is accepting % and %0d%0a line termination charsViolation of Secure Design Principles · low · HackerOne
    $3,750176 votes
  14. Hacker.One Subdomain TakeoverViolation of Secure Design Principles · low · HackerOne
    154 votes
  15. Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONPViolation of Secure Design Principles · HackerOne
    153 votes
  16. Access Token Smuggling from my.playstation.com via Referer HeaderViolation of Secure Design Principles · high · PlayStation
    $1,000147 votes
  17. Twitter Periscope Clickjacking VulnerabilityUI Redressing (Clickjacking) · medium · X / xAI
    $1,120144 votes
  18. Spring Actuator endpoints publicly available, leading to account takeoverMisconfiguration · critical · LY Corporation
    $5,000143 votes
  19. Account Takeover at worki.ruViolation of Secure Design Principles · Mail.ru
    $1,500143 votes
  20. Highly wormable clickjacking in player cardUI Redressing (Clickjacking) · X / xAI
    134 votes
  21. Unrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/imageViolation of Secure Design Principles · medium · Semrush
    133 votes
  22. Session Cookie Leakage via Static Header Field in WebViewerFragmentMisconfiguration · high · LinkedIn
    131 votes
  23. Email Verification bypass on signupViolation of Secure Design Principles · high · Automattic
    127 votes
  24. Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domainViolation of Secure Design Principles · Slack
    120 votes
  25. Wordpress unzip_file path traversalViolation of Secure Design Principles · medium · WordPress
    119 votes
  26. [Critical] Delete any account Violation of Secure Design Principles · OLX
    115 votes
  27. IDOR leading to downloading of any attachmentViolation of Secure Design Principles · low · BCM Messenger
    114 votes
  28. Subdomain takeover on http://fastly.sc-cdn.net/Violation of Secure Design Principles · Snapchat
    $3,000114 votes
  29. Leak of authorization urls leads to account takeoverViolation of Secure Design Principles · Bumble
    109 votes
  30. Recently added 'Country' field doesn't send email notification when changedViolation of Secure Design Principles · low · HackerOne
    108 votes
  31. Wordpress Takeover using setup configuration at http://████.edu [HtUS]Misconfiguration · critical · U.S. Dept Of Defense
    $1,000102 votes
  32. Mass account takeover!Misconfiguration · high · Stripe
    101 votes
  33. Exposed Cortex API at https://cortex-ingest.shopifycloud.com/Misconfiguration · medium · Shopify
    $6,300101 votes
  34. Lack of URL normalization renders Blocked-Previews feature ineffectualSecurity Through Obscurity · medium · Slack
    $1,000100 votes
  35. Safe Redirect Bypass Security Through Obscurity · low · X / xAI
    $56098 votes
  36. Cross-origin resource sharing misconfig | steal user information Misconfiguration · medium · Semrush
    97 votes
  37. Race Condition : Exploiting the loyalty claim https://xxx.vendhq.com/loyalty/claim/email/xxxxx url and gain x amount of loyalty bonus/cashViolation of Secure Design Principles · medium · Vend VDP
    96 votes
  38. Subdomain takeover of resources.hackerone.comMisconfiguration · low · HackerOne
    $50095 votes
  39. Password not checked when disabling 2FA on HackerOneViolation of Secure Design Principles · low · HackerOne
    95 votes
  40. Complete Admin account takeover due to PhpDebugBar turned on in Uber's production serverMisconfiguration · medium · Uber
    90 votes
  41. Clickjacking on donation pageUI Redressing (Clickjacking) · low · WordPress
    90 votes
  42. Create any military unit in any ageImproper Check or Handling of Exceptional Conditions · InnoGames
    $1,10089 votes
  43. URL Path Manipulation Enables Cache Poisoning of Amazon Affiliate Products in Shopify LinkpopCache Poisoning · low · Shopify
    $50088 votes
  44. Twitter broken link hijacking in thewild.comOrigin Validation Error · low · Autodesk
    87 votes
  45. Incorrect security UI of files' download source on brave MacOSUser Interface (UI) Misrepresentation of Critical Information · high · Brave Software
    87 votes
  46. Send Fax from Anyone's HelloFax Account Due to Misconfigured Email ValidationViolation of Secure Design Principles · Dropbox
    $4,91385 votes
  47. CORS misconfiguration allows to steal customers data Violation of Secure Design Principles · LocalTapiola
    84 votes
  48. Text Injection/ Content Spoofing on https://cloud.e.khanacademy.org by breaking out of input tag.Violation of Secure Design Principles · low · Khan Academy
    83 votes
  49. Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on MobileViolation of Secure Design Principles · low · HackerOne
    82 votes
  50. Cache Poisoning via uppercase letters in invalid pathViolation of Secure Design Principles · InnoGames
    $55082 votes
  51. User password left in memory in plain text after GUI launchViolation of Secure Design Principles · Nord Security
    82 votes
  52. [hackerone.com] Program's old handles are not blacklisted like usernames and allows reclaim over past handles for potential abuseInformativeViolation of Secure Design Principles · medium · HackerOne
    81 votes
  53. Clickjacking in main domain https://topechelon.com/UI Redressing (Clickjacking) · high · Top Echelon Software
    80 votes
  54. Subdomain takeover in Gitlab pagesMisconfiguration · low · GitLab
    79 votes
  55. Subdomain takeover on one of the subdomain under mozaws.netMisconfiguration · medium · Mozilla
    79 votes
  56. Broken Link on Urban Company's Vulnerability Submission FormViolation of Secure Design Principles · low · Urban Company
    79 votes
  57. Cache Poisoning DoS on updates.rockstargames.comViolation of Secure Design Principles · medium · Rockstar Games
    77 votes
  58. Subdomain Takeover on demo.greenhouse.io pointing to unbouncepagesPhishing · high · Greenhouse.io
    76 votes
  59. Ability to verify any email address you don't own - accounts.shopify.comViolation of Secure Design Principles · Shopify
    76 votes
  60. Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)Violation of Secure Design Principles · HackerOne
    76 votes
  61. Non-Production API Endpoints for the Forecast Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationInsufficient Logging · medium · AWS VDP
    75 votes
  62. Subdomain takeover on a subdomain under firefox.comMisconfiguration · medium · Mozilla
    $50075 votes
  63. Subdomain takeover dew to missconfigured project settings for Custom domain .Misconfiguration · Flock
    75 votes
  64. Authorization Token on PlayStation Network Leaks via postMessage functionViolation of Secure Design Principles · high · PlayStation
    $1,00074 votes
  65. Error Page Content Spoofing or Text Injection Violation of Secure Design Principles · low · Smule
    74 votes
  66. Subdomain Takeover at test.shipt.comMisconfiguration · Shipt
    $75073 votes
  67. Remove obsolete domain from handbook subdomainMisconfiguration · low · GitLab
    72 votes
  68. Homograph fix Bypass Violation of Secure Design Principles · medium · HackerOne
    71 votes
  69. clickjacing can lead to account takeoverUI Redressing (Clickjacking) · low · pixiv
    $20070 votes
  70. Chained open redirects and use of Ideographic Full Stop defeat Twitter's approach to blocking linksSecurity Through Obscurity · medium · X / xAI
    $56070 votes
  71. Non-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission EnumerationInsufficient Logging · medium · AWS VDP
    69 votes
  72. Exposure of Private Personal Information to an Unauthorized Actor - PII and soldier data (mos, schools, and speciality training)Violation of Secure Design Principles · critical · U.S. Dept Of Defense
    69 votes
  73. Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████Misconfiguration · critical · Essity
    68 votes
  74. [ addons-preview-cdn.mozilla.net ] A subdomain takeover is available via unregistered domain in FastlyMisconfiguration · medium · Mozilla
    $50066 votes
  75. Viral Direct Message Clickjacking via link truncation leading to capture of both Google credentials & installation of malicious 3rd party Twitter AppUI Redressing (Clickjacking) · high · X / xAI
    64 votes
  76. web cache deception in https://tradus.com lead to name/user_id enumeration and other infoViolation of Secure Design Principles · OLX
    63 votes
  77. Parameter pollution in social sharing buttonsViolation of Secure Design Principles · HackerOne
    $50062 votes
  78. Subdomain Takeover of brand.zen.lyMisconfiguration · medium · Zenly
    $75061 votes
  79. Remote Code Execution (upload)Violation of Secure Design Principles · Legal Robot
    60 votes
  80. No SPF/DMARC records on mb-cosmos.comViolation of Secure Design Principles · medium · Malwarebytes
    59 votes
  81. DNS Setup allows sending mail on behalf of other customersViolation of Secure Design Principles · medium · Basecamp
    58 votes
  82. XSS Stored via Upload avatar PNG [HTML] File in accounts.shopify.comViolation of Secure Design Principles · low · Shopify
    58 votes
  83. plugins.trac.wordpress.org likely vulnerable to Cross Site Tracing (xst), TRACE HTTP method should be disabledViolation of Secure Design Principles · WordPress
    58 votes
  84. Double Clickjacking Attack on WakaTime OAuth Authorization Flow at https://wakatime.com/oauth/authorizeViolation of Secure Design Principles · medium · WakaTime
    57 votes
  85. Broken Link on TikTokUS.InfoViolation of Secure Design Principles · low · TikTok
    57 votes
  86. Invalid Host detection at https://hackerone.com/redirectViolation of Secure Design Principles · low · HackerOne
    57 votes
  87. (Part 2) Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationInsufficient Logging · medium · AWS VDP
    56 votes
  88. Register & create a ticket as somebody else on HackerOne Support Misconfiguration · HackerOne
    56 votes
  89. Graphql introspection is enabled and leaks details about the schemaMisconfiguration · low · On
    56 votes
  90. DOS via cache poisoning on [developer.mozilla.org]Cache Poisoning · low · Mozilla
    55 votes
  91. Bypass Email Verification using Salesforce -- Reproducible in gitlab.comViolation of Secure Design Principles · high · GitLab
    55 votes
  92. Sensitive Clickjacking on admin login page.UI Redressing (Clickjacking) · Shipt
    55 votes
  93. Debug Deep Link Abuse Allows Repeated Forced Logout and Application DisruptionViolation of Secure Design Principles · low · Yelp
    54 votes
  94. 2M Reports on HackerOne Celebration! - Ability to bulk-submit many reports.Misconfiguration · low · HackerOne
    54 votes
  95. Bypassing Recaptcha Protection in `https://connect.acronis.com`Violation of Secure Design Principles · low · Acronis
    54 votes
  96. [www.drive2.ru] There is no rate limit for comments endpoints.Violation of Secure Design Principles · low · DRIVE.NET, Inc.
    54 votes
  97. Subdomain takeover ██████Violation of Secure Design Principles · critical · U.S. Dept Of Defense
    53 votes
  98. Brave Shields Domain Reordering Leads to Origin ConfusionViolation of Secure Design Principles · low · Brave Software
    52 votes
  99. Subdomain takeover on one of the subdomains under mozaws.netMisconfiguration · medium · Mozilla
    52 votes
  100. Lack of quarantine meta-attribute for downloaded files leads to GateKeeper bypassViolation of Secure Design Principles · low · Brave Software
    52 votes