Browse / Bumble

Bumble

See its reports on the map

What gets reported to Bumble

• Information Disclosure8
• Authentication7
• Misconfiguration5
• Cross-Site Request Forgery4
• Cross-site Scripting3
• Business Logic3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Reflected XSSCross-site Scripting (XSS) - Reflected · critical
   $1,000317 votes
2. Exfiltrating a victim's exact location (to within 5m)Information Disclosure · high
   278 votes
3. Bruteforce password recovery codeViolation of Secure Design Principles
   258 votes
4. Leak of authorization urls leads to account takeoverViolation of Secure Design Principles
   109 votes
5. Misconfigured oauth leads to Pre account takeover Business Logic Errors · low
   90 votes
6. Bumble API exposes read status of chat messagesInformation Disclosure · medium
   $60074 votes
7. [CRITICAL] Full account takeover using CSRFCross-Site Request Forgery (CSRF)
   63 votes
8. The login of Hotor Not is Vulnerable to bruteforce.Improper Restriction of Authentication Attempts · high
   59 votes
9. Race Condition on "Get free Badoo Premium" which allows to get more days of free premium for Free. Business Logic Errors · low
   57 votes
10. On Singing up with a Phone number , The 4 digit OTP does not expires for a long time leading to an easy attack and make a verified account easiltyViolation of Secure Design Principles · high
    49 votes
11. Possible (we need to wait for some time) takeover of subdomain badootech.badoo.com which is pointing to Medium serversBusiness Logic Errors · medium
    40 votes
12. Change contents of the careers iframe in https://corp.badoo.com/jobsUncontrolled Resource Consumption
    35 votes
13. Расшифровка всех типов шифрованных IDInformation Disclosure · medium
    32 votes
14. Compromising the user IDInformation Disclosure · high
    28 votes
15. Email SpoofingViolation of Secure Design Principles · low
    28 votes
16. Unvalidated redirect on team.badoo.comCross-site Scripting (XSS) - Generic · medium
    $14025 votes
17. Identify unique user ID of all the profiles Insecure Direct Object Reference (IDOR) · medium
    24 votes
18. Account TakeoverCross-Site Request Forgery (CSRF)
    19 votes
19. crossdomain.xml too permissive on eu1.badoo.com, us1.badoo.com, etc.Violation of Secure Design Principles
    16 votes
20. SSO through odnoklassniki uses http rather than httpsCleartext Transmission of Sensitive Information · low
    $15014 votes
21. Индексация почты/логинов пользователей
    $14012 votes
22. No rate-limit in SERVER_SECURITY_CHECKImproper Authentication - Generic · low
    11 votes
23. Leave inaccessible messaging system with a message (https://us1.badoo.com)medium
    10 votes
24. Arbitrary modification value "session" (Cookie) in badoo.comImproper Authentication - Generic · low
    9 votes
25. Open redirect helps to steal Facebook access_tokenOpen Redirect
    9 votes
26. Tokens from services like Facebook can be stolenImproper Authentication - Generic
    7 votes
27. Ability to collect users' ids that have visited a specific web page with malicious code Information Disclosure
    6 votes
28. CSRF Attack on (m.badoo.com)deleting account and erasing imported contactsCross-Site Request Forgery (CSRF) · medium
    $2805 votes
29. Broken Authentication on BadooImproper Authentication - Generic
    $4275 votes
30. Получение оригинала скрытого изображенияInformation Disclosure
    $2803 votes
31. XSS DI BIODATACross-site Scripting (XSS) - Stored · medium