Browse / Misconfiguration

Misconfiguration

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Violation of Secure Design Principles839
• Misconfiguration173
• UI Redressing (Clickjacking)151
• Phishing41
• Insufficient Logging24
• Security Through Obscurity7
• Improper Check or Handling of Exceptional Conditions6
• User Interface (UI) Misrepresentation of Critical Information6
• Cache Poisoning4
• Insecure Temporary File4
• Acceptance of Extraneous Untrusted Data With Trusted Data3
• Using Components with Known Vulnerabilities2
• Origin Validation Error1
• Content Spoofing1
• Improper Handling of Exceptional Conditions1

Often found together with

• Access Control200
• Authentication153
• Information Disclosure123
• Cross-site Scripting122
• Cross-Site Request Forgery70
• Business Logic48
• Code Execution40
• Denial of Service31
• Insecure Direct Object Reference30

Most upvoted Misconfiguration reports

AllValidInformativeN/ADuplicate

1. Missing Security HeadersN/AMisconfiguration · medium · curl
   32 votes
2. libcurl: Host-Only Cookies Leak to Alternate IPv4 FormsN/AMisconfiguration · curl
   30 votes
3. Cross‑Layer State Confusion in libcurl: Credential & Key‑Material Persistence Across Redirect / Connection Reuse BoundariesN/AViolation of Secure Design Principles · critical · curl
   16 votes
4. Shared HSTS cache accessed without lockN/AMisconfiguration · curl
   13 votes
5. No Rate Limiting on /reset-password-request/ endpointN/AViolation of Secure Design Principles · medium · UPchieve
   12 votes
6. Public-suffix cookie injection when libpsl is disabledN/AMisconfiguration · curl
   11 votes
7. Origin IP found, Cloudflare bypassedN/AViolation of Secure Design Principles · medium · CS Money
   11 votes
8. Reputation Manipulation (Theoretical)N/AViolation of Secure Design Principles · HackerOne
   9 votes
9. Account takeover vulnerability by editor role privileged users/attackers via clickjackingN/AUI Redressing (Clickjacking) · high · WordPress
   8 votes
10. Session Cookie Without Secure Flag N/AViolation of Secure Design Principles · Ed
    7 votes
11. HTTP - Basic Authentication on https://www.stellar.org/wp-login.phpN/AViolation of Secure Design Principles · medium · Stellar.org
    7 votes
12. -H with space prefix leads to previous header injection when used with --proxyN/AImproper Check or Handling of Exceptional Conditions · medium · curl
    6 votes
13. Password ReuseN/AMisconfiguration · medium · UPchieve
    6 votes
14. HTTP OPTION Method is Enabled on portswigger.net N/AViolation of Secure Design Principles · low · PortSwigger Web Security
    6 votes
15. curl reuses an HTTPS connection when a response is already buffered in the TLS stackN/AAcceptance of Extraneous Untrusted Data With Trusted Data · medium · curl
    5 votes
16. TLS Cipher Misconfiguration in HTTP/3/QUIC SupportN/AMisconfiguration · curl
    5 votes
17. All Burp Suite Scan reportN/ASecurity Through Obscurity · low · Semmle
    5 votes
18. xmlrpc.php FILE IS enable on Main websiteN/AViolation of Secure Design Principles · Ian Dunn
    5 votes
19. IDOR(indirect object references) on add friend,complement and send message N/AViolation of Secure Design Principles · Yelp
    5 votes
20. Create Multiple Account Using Similar X-CSRF tokenN/AViolation of Secure Design Principles · Coinbase
    5 votes
21. Content injection on 404 error page at faspex.uber.comN/AViolation of Secure Design Principles · Uber
    5 votes
22. Session ManagementN/AViolation of Secure Design Principles · Paragon Initiative Enterprises
    5 votes
23. Spamming any user from Reset Password FunctionN/AViolation of Secure Design Principles · HackerOne
    5 votes
24. POP3: data after the end-of-body terminator is written into the retrieved messageN/AAcceptance of Extraneous Untrusted Data With Trusted Data · medium · curl
    4 votes
25. CORS Misconfiguration on trust.yelp.comN/AMisconfiguration · medium · Yelp
    4 votes
26. Outdated Copyright Message @ Welcome emailN/AMisconfiguration · UPchieve
    4 votes
27. Missing Validation in editing "Your Phone Number" N/AMisconfiguration · medium · UPchieve
    4 votes
28. Error Page Text Injection (no compromise)N/AMisconfiguration · WHO COVID-19 Mobile App
    4 votes
29. Email flooding using user invitation feature in biz.yelp.com due to lack of rate limiting N/AViolation of Secure Design Principles · medium · Yelp
    4 votes
30. misconfigured CORS let to HPP and SOP bypassN/AMisconfiguration · high · BTFS
    4 votes
31. User Controllable CookieN/AMisconfiguration · low · Semrush
    4 votes
32. Clickjacking In https://demo.nextcloud.comN/AUI Redressing (Clickjacking) · critical · Nextcloud
    4 votes
33. Error page Text Injection.N/AViolation of Secure Design Principles · Phabricator
    4 votes
34. Uber is Flooding my Mobile with SMS Daily like a cron JOBN/AViolation of Secure Design Principles · Uber
    4 votes
35. Clickjacking login page of https://hackers.upchieve.org/loginN/AUI Redressing (Clickjacking) · medium · UPchieve
    3 votes
36. Email notification about login email changed is not received when using verified linked email addressN/AViolation of Secure Design Principles · GitLab
    3 votes
37. [invalid][false-positive] csrftoken on profile pageN/AViolation of Secure Design Principles · WakaTime
    3 votes
38. Unprotected Api EndPointsN/AViolation of Secure Design Principles · medium · Semmle
    3 votes
39. Admin panel of https://www.stellar.org/wp-admin/N/AViolation of Secure Design Principles · medium · Stellar.org
    3 votes
40. Email SpoofingN/AViolation of Secure Design Principles · low · PortSwigger Web Security
    3 votes
41. Brute force on wp-loginN/AViolation of Secure Design Principles · Ian Dunn
    3 votes
42. implement a cross-domain policy for Adobe productsN/AViolation of Secure Design Principles · Gratipay
    3 votes
43. Symlink-following truncation of arbitrary files in `Curl_fopen()` when saving cookie jars, HSTS, or alt-svc cachesN/AInsecure Temporary File · low · curl
    2 votes
44. Subdomain Takeover on delivey.yelp.com N/APhishing · low · Yelp
    2 votes
45. Clickjacking ar https://hackers.upchieve.org/loginN/AUI Redressing (Clickjacking) · low · UPchieve
    2 votes
46. hackers.upchieve.org and argocd.upchieve.org is not preloaded.N/AViolation of Secure Design Principles · low · UPchieve
    2 votes
47. clickjacking at brew.shN/AUI Redressing (Clickjacking) · low · Homebrew
    2 votes
48. Error Page Content Spoofing or Text InjectionN/AViolation of Secure Design Principles · low · Sifchain
    2 votes
49. Lack of Password Confirmation for Account DeletionN/AViolation of Secure Design Principles · Eternal
    2 votes
50. ClickJackingN/AUI Redressing (Clickjacking) · high · Acronis
    2 votes
51. Bypassing X-frame options N/AUI Redressing (Clickjacking) · Gratipay
    2 votes
52. aspen | clickjackingN/AUI Redressing (Clickjacking) · low · Aspen
    2 votes
53. Vunerability : spfN/AMisconfiguration · Paragon Initiative Enterprises
    2 votes
54. Clickjacking /framing on sensitive Subdomain N/AUI Redressing (Clickjacking) · Sifchain
    1 votes
55. Vulnerable javascript dependency at Main domainN/AUsing Components with Known Vulnerabilities · low · Sifchain
    1 votes
56. Content Spoofing/Text Injection at https://gateway-production.dubsmash.comN/AUser Interface (UI) Misrepresentation of Critical Information · Reddit
    1 votes
57. Content SpoofingN/APhishing · low · Reddit
    1 votes
58. HTTPS not enforced at dex.sifchain.financeN/AViolation of Secure Design Principles · low · Sifchain
    1 votes
59. UNRESTRICTED FILE UPLOAD AT chat.makerdao.comN/AInsecure Temporary File · high · BlockDev Sp. Z o.o
    1 votes
60. Text injection at https://media.hboeck.deN/AViolation of Secure Design Principles · low · Hanno's projects
    1 votes
61. SSLv3 Poodle Attack on Ip Of semrushN/AViolation of Secure Design Principles · low · Semrush
    1 votes
62. 400 Bad Request [Use a third-party provider to sign in or create an account on Gratipay]N/AViolation of Secure Design Principles · Gratipay
    1 votes
63. Possible User Session Hijack using Invalid HTTPS certificate on inside.gratipay.com domainN/AViolation of Secure Design Principles · medium · Gratipay
    1 votes
64. clickjacking at http://mailboxes.legalrobot-uat.com/N/AUI Redressing (Clickjacking) · Legal Robot
    1 votes
65. Cookie not secureN/AMisconfiguration · Coinbase
    1 votes
66. No DMARC Record in legalrobot-uat.comN/AMisconfiguration · Legal Robot
    1 votes
67. PHP 5.4.45 is Outdated and Full of Preformance Interupting Arbitrary Code Execution BugsN/AViolation of Secure Design Principles · Gratipay
    1 votes
68. Wrong Implementation of Url in https://docs.sifchain.finance/N/AMisconfiguration · low · Sifchain