HexBrain
Sign in

Browse / Algolia

Algolia

34disclosed reports
$3,400paid in bounties

See its reports on the map

What gets reported to Algolia

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Information disclosure via a misconfigured third-party productInformation Disclosure · high
    156 votes
  2. Information disclosure -> 2fa bypass -> POST exploitation Information Disclosure · medium
    76 votes
  3. RCE on facebooksearch.algolia.comCode Injection
    $50074 votes
  4. email verification bypassImproper Authentication - Generic · medium
    67 votes
  5. Web Cache Deception vulnerability on algolia.com leads to personal information leakageViolation of Secure Design Principles · medium
    $40047 votes
  6. Stored xss Cross-site Scripting (XSS) - Generic
    $10041 votes
  7. Directory traversal at https://msg.algolia.comPath Traversal · medium
    34 votes
  8. subdomain take over at recommendation.algolia.comViolation of Secure Design Principles · medium
    27 votes
  9. Web Cache Deception Attack (XSS)Cross-site Scripting (XSS) - Reflected · medium
    26 votes
  10. [GitHub Extension] Unsanitised HTML leading to XSS on GitHub.comCross-site Scripting (XSS) - DOM · high
    26 votes
  11. Hyperlink Injection in Friend Invitation EmailsOpen Redirect
    $10020 votes
  12. 2-factor authentication bypassImproper Authentication - Generic
    20 votes
  13. Unauthorized team members can leak information and see all API calls through /1/admin/* endpoints, even after they have been removed.Improper Authentication - Generic
    $40019 votes
  14. [github.algolia.com] DOM Based XSS github-btn.htmlCross-site Scripting (XSS) - Generic · medium
    $10015 votes
  15. No rate limit for Referral ProgramViolation of Secure Design Principles
    15 votes
  16. Reflected XSSCross-site Scripting (XSS) - Generic
    14 votes
  17. PHP-FPM status page disclosureInformation Disclosure · low
    12 votes
  18. Stored xssCross-site Scripting (XSS) - Generic
    12 votes
  19. An “algobot”-s GitHub access token was leakedInformation Disclosure · medium
    $10010 votes
  20. Possilbe Sub Domain takever at prestashop.algolia.com
    9 votes
  21. Stored XSS triggered by json key during UI generationCross-site Scripting (XSS) - Generic
    7 votes
  22. No Rate Limit In Inviting Similar Contact Multiple TimesCryptographic Issues - Generic
    $1006 votes
  23. No rate-limit in Two factor Authentication leads to bypass using bruteforce attackImproper Authentication - Generic
    $1006 votes
  24. API Key added for one Indices works for all other indices too.Improper Authentication - Generic
    $1,0006 votes
  25. Stored XSS in name selectionCross-site Scripting (XSS) - Generic
    $1006 votes
  26. Text injection on status.algolia.comViolation of Secure Design Principles · low
    4 votes
  27. Stored XSS from Display Settings triggered on Save and viewing realtime search demoCross-site Scripting (XSS) - Generic
    4 votes
  28. [github.algolia.com] XSSCross-site Scripting (XSS) - Generic
    4 votes
  29. SAUCE Access_key and User_name leaked in Travis CI build logsInformation Disclosure · medium
    3 votes
  30. User with limited access to Index configuration can rename the IndexImproper Authentication - Generic
    $2003 votes
  31. PHP version disclosed on blog.algolia.comInformation Disclosure
    2 votes
  32. text injection can be used in phishing 404 page should not include attacker textViolation of Secure Design Principles
    $1002 votes
  33. an xss issueCross-site Scripting (XSS) - Generic
    $1002 votes
  34. Stored XSS on https://www.algolia.com/realtime-search-demo/*Cross-site Scripting (XSS) - Generic
    2 votes