HexBrain
Sign in

Browse / Bumble

Bumble

36disclosed reports
$3,017paid in bounties

See its reports on the map

What gets reported to Bumble

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Reflected XSSCross-site Scripting (XSS) - Reflected · critical
    $1,000317 votes
  2. Exfiltrating a victim's exact location (to within 5m)Information Disclosure · high
    278 votes
  3. Bruteforce password recovery codeViolation of Secure Design Principles
    258 votes
  4. Leak of authorization urls leads to account takeoverViolation of Secure Design Principles
    109 votes
  5. Misconfigured oauth leads to Pre account takeover Business Logic Errors · low
    90 votes
  6. Bumble API exposes read status of chat messagesInformation Disclosure · medium
    $60074 votes
  7. [CRITICAL] Full account takeover using CSRFCross-Site Request Forgery (CSRF)
    63 votes
  8. The login of Hotor Not is Vulnerable to bruteforce.Improper Restriction of Authentication Attempts · high
    59 votes
  9. Race Condition on "Get free Badoo Premium" which allows to get more days of free premium for Free. Business Logic Errors · low
    57 votes
  10. On Singing up with a Phone number , The 4 digit OTP does not expires for a long time leading to an easy attack and make a verified account easiltyViolation of Secure Design Principles · high
    49 votes
  11. Possible (we need to wait for some time) takeover of subdomain badootech.badoo.com which is pointing to Medium serversBusiness Logic Errors · medium
    40 votes
  12. Change contents of the careers iframe in https://corp.badoo.com/jobsUncontrolled Resource Consumption
    35 votes
  13. Расшифровка всех типов шифрованных IDInformation Disclosure · medium
    32 votes
  14. Compromising the user IDInformation Disclosure · high
    28 votes
  15. Email SpoofingViolation of Secure Design Principles · low
    28 votes
  16. Unvalidated redirect on team.badoo.comCross-site Scripting (XSS) - Generic · medium
    $14025 votes
  17. Identify unique user ID of all the profiles Insecure Direct Object Reference (IDOR) · medium
    24 votes
  18. Account TakeoverCross-Site Request Forgery (CSRF)
    19 votes
  19. crossdomain.xml too permissive on eu1.badoo.com, us1.badoo.com, etc.Violation of Secure Design Principles
    16 votes
  20. SSO through odnoklassniki uses http rather than httpsCleartext Transmission of Sensitive Information · low
    $15014 votes
  21. Индексация почты/логинов пользователей
    $14012 votes
  22. No rate-limit in SERVER_SECURITY_CHECKImproper Authentication - Generic · low
    11 votes
  23. Leave inaccessible messaging system with a message (https://us1.badoo.com)medium
    10 votes
  24. Arbitrary modification value "session" (Cookie) in badoo.comImproper Authentication - Generic · low
    9 votes
  25. Open redirect helps to steal Facebook access_tokenOpen Redirect
    9 votes
  26. Insecure Direct Object Reference on badoo.comInformativePrivilege Escalation
    7 votes
  27. Tokens from services like Facebook can be stolenImproper Authentication - Generic
    7 votes
  28. CSRF bug N/ACross-Site Request Forgery (CSRF)
    6 votes
  29. Ability to collect users' ids that have visited a specific web page with malicious code Information Disclosure
    6 votes
  30. CSRF Attack on (m.badoo.com)deleting account and erasing imported contactsCross-Site Request Forgery (CSRF) · medium
    $2805 votes
  31. AWS S3 Bucket hotornot-images permissions allow for listing and removing filesN/AImproper Authentication - Generic
    5 votes
  32. Broken Authentication on BadooImproper Authentication - Generic
    $4275 votes
  33. Password modification without knowing actual password & httpOnly bypassInformativeImproper Authentication - Generic
    5 votes
  34. Получение оригинала скрытого изображенияInformation Disclosure
    $2803 votes
  35. Badoo and Hotornot User DisclosureN/AInformation Disclosure
    2 votes
  36. XSS DI BIODATACross-site Scripting (XSS) - Stored · medium