HexBrain
Sign in

Browse / Misconfiguration

Misconfiguration

1,263disclosed reports
15weaknesses
$117,847paid in bounties

See it on the mapBypass libraryPayloads

Weaknesses in this class

Often found together with

Most upvoted Misconfiguration reports

AllValidInformativeN/ADuplicate

  1. URL link spoofingPhishing · low · Slack
    $250362 votes
  2. Cross-site Scripting (XSS) - Stored in RDoc wiki pagesUI Redressing (Clickjacking) · high · GitLab
    $3,500282 votes
  3. DoS Vulnerability via Cache Poisoning on cdn.shopify.com and shopify-assets.shopifycdn.comCache Poisoning · medium · Shopify
    $3,800266 votes
  4. Bruteforce password recovery codeViolation of Secure Design Principles · Bumble
    258 votes
  5. [www.zomato.com] CORS Misconfiguration, could lead to disclosure of sensitive informationMisconfiguration · medium · Eternal
    $550246 votes
  6. Spring Actuator endpoints publicly available and broken authenticationMisconfiguration · critical · LY Corporation
    $12,500234 votes
  7. Internal Access to Hackerone confluence DocsMisconfiguration · high · HackerOne
    $12,500227 votes
  8. Github Account hijack through broken link in developer.twitter.comPhishing · high · X / xAI
    222 votes
  9. Ability To Delete User(s) Account Without User InteractionMisconfiguration · high · GitLab
    221 votes
  10. Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's originMisconfiguration · critical · Superhuman (formerly Grammarly)
    202 votes
  11. Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photosViolation of Secure Design Principles · medium · HackerOne
    194 votes
  12. Account creation with invalid email addresses / email is accepting % and %0d%0a line termination charsViolation of Secure Design Principles · low · HackerOne
    $3,750176 votes
  13. Hacker.One Subdomain TakeoverViolation of Secure Design Principles · low · HackerOne
    154 votes
  14. Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONPViolation of Secure Design Principles · HackerOne
    153 votes
  15. Access Token Smuggling from my.playstation.com via Referer HeaderViolation of Secure Design Principles · high · PlayStation
    $1,000147 votes
  16. Twitter Periscope Clickjacking VulnerabilityUI Redressing (Clickjacking) · medium · X / xAI
    $1,120144 votes
  17. Spring Actuator endpoints publicly available, leading to account takeoverMisconfiguration · critical · LY Corporation
    $5,000143 votes
  18. Highly wormable clickjacking in player cardUI Redressing (Clickjacking) · X / xAI
    134 votes
  19. Unrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/imageViolation of Secure Design Principles · medium · Semrush
    133 votes
  20. Session Cookie Leakage via Static Header Field in WebViewerFragmentMisconfiguration · high · LinkedIn
    131 votes
  21. Email Verification bypass on signupViolation of Secure Design Principles · high · Automattic
    127 votes
  22. Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domainViolation of Secure Design Principles · Slack
    120 votes
  23. Wordpress unzip_file path traversalViolation of Secure Design Principles · medium · WordPress
    119 votes
  24. IDOR leading to downloading of any attachmentViolation of Secure Design Principles · low · BCM Messenger
    114 votes
  25. Subdomain takeover on http://fastly.sc-cdn.net/Violation of Secure Design Principles · Snapchat
    $3,000114 votes
  26. Leak of authorization urls leads to account takeoverViolation of Secure Design Principles · Bumble
    109 votes
  27. Recently added 'Country' field doesn't send email notification when changedViolation of Secure Design Principles · low · HackerOne
    108 votes
  28. Wordpress Takeover using setup configuration at http://████.edu [HtUS]Misconfiguration · critical · U.S. Dept Of Defense
    $1,000102 votes
  29. Mass account takeover!Misconfiguration · high · Stripe
    101 votes
  30. Exposed Cortex API at https://cortex-ingest.shopifycloud.com/Misconfiguration · medium · Shopify
    $6,300101 votes
  31. Lack of URL normalization renders Blocked-Previews feature ineffectualSecurity Through Obscurity · medium · Slack
    $1,000100 votes
  32. Safe Redirect Bypass Security Through Obscurity · low · X / xAI
    $56098 votes
  33. Cross-origin resource sharing misconfig | steal user information Misconfiguration · medium · Semrush
    97 votes
  34. Race Condition : Exploiting the loyalty claim https://xxx.vendhq.com/loyalty/claim/email/xxxxx url and gain x amount of loyalty bonus/cashViolation of Secure Design Principles · medium · Vend VDP
    96 votes
  35. Subdomain takeover of resources.hackerone.comMisconfiguration · low · HackerOne
    $50095 votes
  36. Password not checked when disabling 2FA on HackerOneViolation of Secure Design Principles · low · HackerOne
    95 votes
  37. Complete Admin account takeover due to PhpDebugBar turned on in Uber's production serverMisconfiguration · medium · Uber
    90 votes
  38. Clickjacking on donation pageUI Redressing (Clickjacking) · low · WordPress
    90 votes
  39. URL Path Manipulation Enables Cache Poisoning of Amazon Affiliate Products in Shopify LinkpopCache Poisoning · low · Shopify
    $50088 votes
  40. Twitter broken link hijacking in thewild.comOrigin Validation Error · low · Autodesk
    87 votes
  41. Incorrect security UI of files' download source on brave MacOSUser Interface (UI) Misrepresentation of Critical Information · high · Brave Software
    87 votes
  42. Text Injection/ Content Spoofing on https://cloud.e.khanacademy.org by breaking out of input tag.Violation of Secure Design Principles · low · Khan Academy
    83 votes
  43. Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on MobileViolation of Secure Design Principles · low · HackerOne
    82 votes
  44. Clickjacking in main domain https://topechelon.com/UI Redressing (Clickjacking) · high · Top Echelon Software
    80 votes
  45. Subdomain takeover in Gitlab pagesMisconfiguration · low · GitLab
    79 votes
  46. Subdomain takeover on one of the subdomain under mozaws.netMisconfiguration · medium · Mozilla
    79 votes
  47. Broken Link on Urban Company's Vulnerability Submission FormViolation of Secure Design Principles · low · Urban Company
    79 votes
  48. Cache Poisoning DoS on updates.rockstargames.comViolation of Secure Design Principles · medium · Rockstar Games
    77 votes
  49. Subdomain Takeover on demo.greenhouse.io pointing to unbouncepagesPhishing · high · Greenhouse.io
    76 votes
  50. Ability to verify any email address you don't own - accounts.shopify.comViolation of Secure Design Principles · Shopify
    76 votes
  51. Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)Violation of Secure Design Principles · HackerOne
    76 votes
  52. Non-Production API Endpoints for the Forecast Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationInsufficient Logging · medium · AWS VDP
    75 votes
  53. Subdomain takeover on a subdomain under firefox.comMisconfiguration · medium · Mozilla
    $50075 votes
  54. Authorization Token on PlayStation Network Leaks via postMessage functionViolation of Secure Design Principles · high · PlayStation
    $1,00074 votes
  55. Error Page Content Spoofing or Text Injection Violation of Secure Design Principles · low · Smule
    74 votes
  56. Remove obsolete domain from handbook subdomainMisconfiguration · low · GitLab
    72 votes
  57. Homograph fix Bypass Violation of Secure Design Principles · medium · HackerOne
    71 votes
  58. clickjacing can lead to account takeoverUI Redressing (Clickjacking) · low · pixiv
    $20070 votes
  59. Chained open redirects and use of Ideographic Full Stop defeat Twitter's approach to blocking linksSecurity Through Obscurity · medium · X / xAI
    $56070 votes
  60. Non-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission EnumerationInsufficient Logging · medium · AWS VDP
    69 votes
  61. Exposure of Private Personal Information to an Unauthorized Actor - PII and soldier data (mos, schools, and speciality training)Violation of Secure Design Principles · critical · U.S. Dept Of Defense
    69 votes
  62. Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████Misconfiguration · critical · Essity
    68 votes
  63. [ addons-preview-cdn.mozilla.net ] A subdomain takeover is available via unregistered domain in FastlyMisconfiguration · medium · Mozilla
    $50066 votes
  64. Viral Direct Message Clickjacking via link truncation leading to capture of both Google credentials & installation of malicious 3rd party Twitter AppUI Redressing (Clickjacking) · high · X / xAI
    64 votes
  65. Parameter pollution in social sharing buttonsViolation of Secure Design Principles · HackerOne
    $50062 votes
  66. Subdomain Takeover of brand.zen.lyMisconfiguration · medium · Zenly
    $75061 votes
  67. Remote Code Execution (upload)Violation of Secure Design Principles · Legal Robot
    60 votes
  68. No SPF/DMARC records on mb-cosmos.comViolation of Secure Design Principles · medium · Malwarebytes
    59 votes
  69. DNS Setup allows sending mail on behalf of other customersViolation of Secure Design Principles · medium · Basecamp
    58 votes
  70. XSS Stored via Upload avatar PNG [HTML] File in accounts.shopify.comViolation of Secure Design Principles · low · Shopify
    58 votes
  71. plugins.trac.wordpress.org likely vulnerable to Cross Site Tracing (xst), TRACE HTTP method should be disabledViolation of Secure Design Principles · WordPress
    58 votes
  72. Double Clickjacking Attack on WakaTime OAuth Authorization Flow at https://wakatime.com/oauth/authorizeViolation of Secure Design Principles · medium · WakaTime
    57 votes
  73. Broken Link on TikTokUS.InfoViolation of Secure Design Principles · low · TikTok
    57 votes
  74. Invalid Host detection at https://hackerone.com/redirectViolation of Secure Design Principles · low · HackerOne
    57 votes
  75. (Part 2) Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationInsufficient Logging · medium · AWS VDP
    56 votes
  76. Register & create a ticket as somebody else on HackerOne Support Misconfiguration · HackerOne
    56 votes
  77. Graphql introspection is enabled and leaks details about the schemaMisconfiguration · low · On
    56 votes
  78. DOS via cache poisoning on [developer.mozilla.org]Cache Poisoning · low · Mozilla
    55 votes
  79. Bypass Email Verification using Salesforce -- Reproducible in gitlab.comViolation of Secure Design Principles · high · GitLab
    55 votes
  80. Debug Deep Link Abuse Allows Repeated Forced Logout and Application DisruptionViolation of Secure Design Principles · low · Yelp
    54 votes
  81. 2M Reports on HackerOne Celebration! - Ability to bulk-submit many reports.Misconfiguration · low · HackerOne
    54 votes
  82. Bypassing Recaptcha Protection in `https://connect.acronis.com`Violation of Secure Design Principles · low · Acronis
    54 votes
  83. [www.drive2.ru] There is no rate limit for comments endpoints.Violation of Secure Design Principles · low · DRIVE.NET, Inc.
    54 votes
  84. Subdomain takeover ██████Violation of Secure Design Principles · critical · U.S. Dept Of Defense
    53 votes
  85. Brave Shields Domain Reordering Leads to Origin ConfusionViolation of Secure Design Principles · low · Brave Software
    52 votes
  86. Subdomain takeover on one of the subdomains under mozaws.netMisconfiguration · medium · Mozilla
    52 votes
  87. Lack of quarantine meta-attribute for downloaded files leads to GateKeeper bypassViolation of Secure Design Principles · low · Brave Software
    52 votes
  88. phpinfo() exposed on ██████████Misconfiguration · medium · Mars
    51 votes
  89. Change project visibility to a restricted optionViolation of Secure Design Principles · medium · GitLab
    $1,37051 votes
  90. Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationInsufficient Logging · medium · AWS VDP
    50 votes
  91. RC Between GitHub's Repo Update REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access RetentionMisconfiguration · medium · GitHub
    50 votes
  92. RC Between GitHub's Repo Transfer REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access RetentionMisconfiguration · medium · GitHub
    50 votes
  93. Subdomain takeover on one of the subdomain under mozaws.netMisconfiguration · medium · Mozilla
    49 votes
  94. ABLE TO TRICK THE VICTIM INTO USING A CRAFTED EMAIL ADDRESS FOR A PARTICULAR SESSION AND THEN LATER TAKE BACK THE ACCOUNT Violation of Secure Design Principles · low · Mattermost
    49 votes
  95. On Singing up with a Phone number , The 4 digit OTP does not expires for a long time leading to an easy attack and make a verified account easiltyViolation of Secure Design Principles · high · Bumble
    49 votes
  96. Stealing User emails by clickjacking cards.twitter.com/xxx/xxxUI Redressing (Clickjacking) · medium · X / xAI
    49 votes
  97. Shopify.com Web Cache Deception vulnerability leads to personal information and CSRF tokens leakageViolation of Secure Design Principles · low · Shopify
    $80048 votes
  98. Domain Takeover [3737signals.com]Phishing · low · Basecamp
    48 votes
  99. Security headers missed on https://acme-validation.jamieweb.net/Violation of Secure Design Principles · medium · JamieWeb
    48 votes
  100. Missing SPF for hackerone.comViolation of Secure Design Principles · HackerOne
    48 votes