Browse / Misconfiguration

Misconfiguration

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Violation of Secure Design Principles839
• Misconfiguration173
• UI Redressing (Clickjacking)151
• Phishing41
• Insufficient Logging24
• Security Through Obscurity7
• Improper Check or Handling of Exceptional Conditions6
• User Interface (UI) Misrepresentation of Critical Information6
• Cache Poisoning4
• Insecure Temporary File4
• Acceptance of Extraneous Untrusted Data With Trusted Data3
• Using Components with Known Vulnerabilities2
• Origin Validation Error1
• Content Spoofing1
• Improper Handling of Exceptional Conditions1

Often found together with

• Access Control200
• Authentication153
• Information Disclosure123
• Cross-site Scripting122
• Cross-Site Request Forgery70
• Business Logic48
• Code Execution40
• Denial of Service31
• Insecure Direct Object Reference30

Most upvoted Misconfiguration reports

AllValidInformativeN/ADuplicate

1. [hackerone.com] Program's old handles are not blacklisted like usernames and allows reclaim over past handles for potential abuseInformativeViolation of Secure Design Principles · medium · HackerOne
   81 votes
2. CVE-2020-5902 InformativeUsing Components with Known Vulnerabilities · critical · AWS VDP
   43 votes
3. Error Page Content Spoofing or Text InjectionInformativeViolation of Secure Design Principles · XVIDEOS
   37 votes
4. RTSP RTP Interleaved Parser Assertion Failure (Zero-Length RTP Payload)InformativeImproper Check or Handling of Exceptional Conditions · curl
   28 votes
5. HSTS accepted from HTTP origin behind HTTPS proxyInformativeAcceptance of Extraneous Untrusted Data With Trusted Data · curl
   25 votes
6. 2fa can't be activated on app.pullrequest.comInformativeViolation of Secure Design Principles · HackerOne
   25 votes
7. Enumeration of usersInformativeViolation of Secure Design Principles · HackerOne
   20 votes
8. CORS Misconfiguration on YelpInformativeMisconfiguration · medium · Yelp
   19 votes
9. Enumerating HackerOne PentestsInformativeMisconfiguration · low · HackerOne
   16 votes
10. Host Header Injection Attack - www.xnxx.comInformativeViolation of Secure Design Principles · XVIDEOS
    14 votes
11. Address Bar Spoofing on TOR BrowserInformativePhishing · high · Tor
    14 votes
12. Subdomain Takeover on proxies.sifchain.finance pointing to vercelInformativeMisconfiguration · high · Sifchain
    12 votes
13. No Rate Limiting on stats.nextcloud.com loginInformativeViolation of Secure Design Principles · Nextcloud
    12 votes
14. Manipulate report timeline activity by using null byte.InformativeViolation of Secure Design Principles · HackerOne
    12 votes
15. 42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditionsInformativeImproper Check or Handling of Exceptional Conditions · curl
    11 votes
16. While adding a payment method - Notification email not sent to newly added email ID as well as there is no verification for new email id (Paypal)InformativeViolation of Secure Design Principles · low · HackerOne
    10 votes
17. Missing Password Confirmation at a Critical Function (Payout Method)InformativeViolation of Secure Design Principles · medium · HackerOne
    10 votes
18. Invalidate active sessions after password changeInformativeViolation of Secure Design Principles · low · Hiro
    9 votes
19. Error Page Content Spoofing or Text InjectionInformativeViolation of Secure Design Principles · Krisp
    8 votes
20. Missing SPF record on trycourier.appInformativeMisconfiguration · low · Courier
    8 votes
21. Wrong implementation of Telegram link on the main page for PC usersInformativeMisconfiguration · Sifchain
    8 votes
22. Content Spoofing or Text Injection in (403 forbidden page injection) and Nginx version disclosure via response headerInformativeViolation of Secure Design Principles · low · Ubiquiti Inc.
    8 votes
23. DNSSEC misconfigurationInformativeViolation of Secure Design Principles · Skyliner
    8 votes
24. Adding an user email address to the list before confirming.InformativeViolation of Secure Design Principles · HackerOne
    8 votes
25. Clickjacking on my.stripo.email for MailChimp credentials InformativeUI Redressing (Clickjacking) · medium · Stripo Inc
    7 votes
26. Click Jacking NextcloudInformativeUI Redressing (Clickjacking) · low · Nextcloud
    7 votes
27. Email Spoofing - SPF record set to NeutralInformativeViolation of Secure Design Principles · GSA Bounty
    7 votes
28. Host header InjectionInformativeViolation of Secure Design Principles · medium · Homebrew
    7 votes
29. Dependecy Confusion via Lookup Request Forwarding to PyPi.orgInformativeMisconfiguration · GitLab
    6 votes
30. Targeted phishing attacks in Login flow v2InformativePhishing · medium · Nextcloud
    6 votes
31. Passcode Protection in Android Devices Can be Bypassed.InformativeViolation of Secure Design Principles · medium · Nextcloud
    6 votes
32. Weak Password Policy on Signup at https://accounts.bistudio.com/authInformativeViolation of Secure Design Principles · BOHEMIA INTERACTIVE a.s.
    6 votes
33. Content spoofing onInformativeViolation of Secure Design Principles · low · Tor
    6 votes
34. Homo graphs attack InformativeViolation of Secure Design Principles · GSA Bounty
    6 votes
35. IDNs displayed in unicodeInformativeViolation of Secure Design Principles · medium · Quora
    6 votes
36. Issue with password reset functionality [Minor]InformativeViolation of Secure Design Principles · Paragon Initiative Enterprises
    6 votes
37. Content Injection error pageInformativeViolation of Secure Design Principles · Coinbase
    6 votes
38. Avatar image upload and bypass real image verification InformativeViolation of Secure Design Principles · Nextcloud
    6 votes
39. Flooding mailbox of userInformativeViolation of Secure Design Principles · HackerOne
    6 votes
40. frame injection on bittorrent.comInformativeUI Redressing (Clickjacking) · medium · BTFS
    5 votes
41. ClickjackingInformativeUI Redressing (Clickjacking) · Kubernetes
    5 votes
42. RTL override char allowed at khanacademy redirect pageInformativeViolation of Secure Design Principles · low · Khan Academy
    5 votes
43. Resolv::getaddresses bug that can be abused to bypass security measures. InformativeViolation of Secure Design Principles · Ruby
    5 votes
44. External links should be served in HTTPS.InformativeViolation of Secure Design Principles · low · Legal Robot
    5 votes
45. clickjacking on https://gratipay.com/on/npm/[text]InformativeUI Redressing (Clickjacking) · Gratipay
    5 votes
46. RTLO character allowed in shared filesInformativeUI Redressing (Clickjacking) · medium · Nextcloud
    5 votes
47. Address bar spoofing in Brave browser via. window close warningsInformativeViolation of Secure Design Principles · medium · Brave Software
    5 votes
48. No Security check at changing password and at adding mobile number which leads to account takeover and spamInformativeViolation of Secure Design Principles · medium · Khan Academy
    5 votes
49. Enumerating emails through "Forgot Password" formInformativeViolation of Secure Design Principles · Phabricator
    5 votes
50. HTTP-Basic Authentication on logs.nextcloud.comInformativeViolation of Secure Design Principles · Nextcloud
    5 votes
51. Username can be used to trick the victim on the name of www.gratipay.comInformativeViolation of Secure Design Principles · Gratipay
    5 votes
52. User enumeration via Password reset page [Minor]InformativeViolation of Secure Design Principles · Paragon Initiative Enterprises
    5 votes
53. Email Address EnumerationInformativeViolation of Secure Design Principles · Uber
    5 votes
54. Content Spoofing through URLInformativeViolation of Secure Design Principles · Phabricator
    5 votes
55. 2FA settings allowed to be changed with no delay/freeze on fundsInformativeViolation of Secure Design Principles · Coinbase
    5 votes
56. Issue with password change in Disabled AccountInformativeViolation of Secure Design Principles · low · HackerOne
    4 votes
57. Session Cookie without HttpOnly and secure flag setInformativeViolation of Secure Design Principles · Stellar.org
    4 votes
58. Misconfiguration: Missing Custom Error Page (CWE-12 & CWE-756)InformativeMisconfiguration · PortSwigger Web Security
    4 votes
59. Email SpoofingInformativeViolation of Secure Design Principles · Nextcloud
    4 votes
60. Vulnerable Javascript libraryInformativeViolation of Secure Design Principles · CodeIgniter
    4 votes
61. Cloudflare issue: Error 521 Ray ID: 2e7ea7f706ea4056 • 2016-09-25 12:59:55 UTC Web server is downInformativeViolation of Secure Design Principles · Legal Robot
    4 votes
62. Username Restriction is not applied for reserved foldersInformativeViolation of Secure Design Principles · Gratipay
    4 votes
63. prevent null bytes in email fieldInformativeViolation of Secure Design Principles · Gratipay
    4 votes
64. Clickjacking login page of http://book.zomato.com/InformativeUI Redressing (Clickjacking) · Eternal
    4 votes
65. text injection in get.uber.com/check-otpInformativeViolation of Secure Design Principles · Uber
    4 votes
66. Changeable model ids on vanilla update can lead to severely bad side-effectsInformativeViolation of Secure Design Principles · Ruby on Rails
    4 votes
67. Missing DMARC recordInformativeViolation of Secure Design Principles · Whisper
    4 votes
68. Email verification links still valid after changing it 2xInformativeViolation of Secure Design Principles · IRCCloud
    4 votes
69. Click-Jacking due to missing X-frame headerInformativeViolation of Secure Design Principles · Factlink
    4 votes
70. Arbitrary file uploads to Amazon WS.InformativeViolation of Secure Design Principles · HackerOne
    4 votes
71. User Enumeration, Information Disclosure and Lack of Rate Limitation on APIInformativeViolation of Secure Design Principles · Coinbase
    4 votes
72. Bug Report : [ No Valid SPF Records ]InformativeMisconfiguration · high · Ruby
    3 votes
73. Hostname spoofingInformativeViolation of Secure Design Principles · Node.js
    3 votes
74. Editable Wiki repo by anyone InformativeViolation of Secure Design Principles · low · RATELIMITED
    3 votes
75. Reverse Tabnabbing Vulnerability in Outgoing LinksInformativeViolation of Secure Design Principles · medium · HackerOne
    3 votes
76. Validation of Password reset tokensInformativeViolation of Secure Design Principles · low · WakaTime
    3 votes
77. Weak Bithdate Validation Implemented on Sign UpInformativeViolation of Secure Design Principles · low · Khan Academy
    3 votes
78. Sensitive Cookie Without 'HttpOnly' FlagInformativeMisconfiguration · WakaTime
    3 votes
79. Content (Text) Injection at https://nextcloud.comInformativeViolation of Secure Design Principles · low · Nextcloud
    3 votes
80. Restricted file access when it exists in old versions of task or wiki documentInformativeViolation of Secure Design Principles · Phabricator
    3 votes
81. Login Hints on Admin PanelInformativeViolation of Secure Design Principles · medium · Nextcloud
    3 votes
82. Not clearing hex-decoded variable after usage in AuthenticationInformativeViolation of Secure Design Principles · Paragon Initiative Enterprises
    3 votes
83. Text Only Content Spoofing on ubermovement.com Community PageInformativeViolation of Secure Design Principles · Uber
    3 votes
84. Text injection on error page.InformativeViolation of Secure Design Principles · SecNews
    3 votes
85. Unsubscribe any user from receiving emailInformativeViolation of Secure Design Principles · Uber
    3 votes
86. Abusing HOF rankings in limited circumstancesInformativeViolation of Secure Design Principles · HackerOne
    3 votes
87. Password appears in user name fieldInformativeViolation of Secure Design Principles · ownCloud
    3 votes
88. Misconfigured SPF Record FlagInformativeViolation of Secure Design Principles · Udemy
    3 votes
89. Unsafe usage of Host HTTP header in Concrete5 version 5.7.3.1InformativeViolation of Secure Design Principles · Concrete CMS
    3 votes
90. Multiple issues on Checkout ProcessInformativeViolation of Secure Design Principles · Shopify
    3 votes
91. Full account takeover via Add a New Email to account without email verified and without password confirmation.InformativeViolation of Secure Design Principles · Vimeo
    3 votes
92. Headers MissingInformativeViolation of Secure Design Principles · X / xAI
    3 votes
93. Password Policy issueInformativeViolation of Secure Design Principles · Phabricator
    3 votes
94. HSTS Policy not enabled on cdn.jsdelivr.netInformativeViolation of Secure Design Principles · jsDelivr
    3 votes
95. Password type input with auto-complete enabledInformativeViolation of Secure Design Principles · IRCCloud
    3 votes
96. API keys being cached InformativeViolation of Secure Design Principles · Kadira
    3 votes
97. User impersonation is possible with incoming webhooksInformativeViolation of Secure Design Principles · Slack
    3 votes
98. Content SpoofingInformativeViolation of Secure Design Principles · Slack
    3 votes
99. Session Cookie without HttpOnly and secure flag setInformativeViolation of Secure Design Principles · Liberapay
    2 votes
100. URL is vulnerable to clickjackingInformativeUI Redressing (Clickjacking) · Eternal
     2 votes