HexBrain
Sign in

Browse / Chaturbate

Chaturbate

52disclosed reports
$13,000paid in bounties

See its reports on the map

What gets reported to Chaturbate

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Passive stored XSS at broadcast roomCross-site Scripting (XSS) - Stored · high
    74 votes
  2. Reflected XSS on secure.chaturbate.comCross-site Scripting (XSS) - Reflected · high
    $80069 votes
  3. Account Takeover via billingImproper Authorization · critical
    $8,00056 votes
  4. Open redirection at https://chaturbate.com/auth/login/Open Redirect · low
    55 votes
  5. Blind SSRF at https://chaturbate.com/notifications/update_push/Server-Side Request Forgery (SSRF) · high
    54 votes
  6. Forget password link not expiring after email change.Improper Authorization · medium
    46 votes
  7. The auto login link does not expire on changing email idImproper Access Control - Generic · low
    45 votes
  8. CSS Injection on /embed/ via bgcolor parameter leaks user's CSRF token and allows for XSS Cross-site Scripting (XSS) - DOM · high
    43 votes
  9. DoS attacks utilizing camo.stream.highwebmedia.comUncontrolled Resource Consumption · medium
    $40041 votes
  10. Stored XSS in chat topic due to insecure emoticon parsing on any message typeCross-site Scripting (XSS) - Stored · medium
    $45033 votes
  11. View Failed Approval and Pending videos other userslow
    $20028 votes
  12. Web cache deception attack - expose token informationInformation Disclosure · medium
    28 votes
  13. Rate limit missing at room loginImproper Restriction of Authentication Attempts · medium
    $50028 votes
  14. Open redirect on chaturbate.com (tipping/purchase_success)Open Redirect · low
    $25026 votes
  15. Camo Image Proxy Bypass with CSS Escape SequencesImproper Neutralization of Escape, Meta, or Control Sequences · low
    25 votes
  16. Update Chat Allowed By Option ( without age verification )Business Logic Errors · low
    23 votes
  17. Missing Rate Limitation at /apps/upload_app/ Business Logic Errors · low
    21 votes
  18. Missing Rate Limitation at /photo_videos/photoset/createBusiness Logic Errors · low
    20 votes
  19. No rate limiting in changing room subject.Improper Restriction of Authentication Attempts · low
    19 votes
  20. Stored XSS on chaturbate.com (wish list)Cross-site Scripting (XSS) - Stored · low
    $10018 votes
  21. [chaturbate.com] - CSRF Vulnerability on image uploadCross-Site Request Forgery (CSRF) · medium
    $30017 votes
  22. Chaturbate "/chat_ignore_list/" endpoint does not check for Account status: Disabled before adding Ignore via POSTBusiness Logic Errors · low
    16 votes
  23. Form Replay in customer information formInsufficiently Protected Credentials · medium
    16 votes
  24. Unrestricted POST request size on roomlogin endpointUncontrolled Resource Consumption · low
    $20015 votes
  25. No rate limiting in starting up a bot.Improper Restriction of Authentication Attempts · low
    15 votes
  26. No rate limit in stats api token endpointImproper Restriction of Authentication Attempts · low
    15 votes
  27. Login form on non-HTTPS page on http://stream.highwebmedia.com/auth/login/Cleartext Transmission of Sensitive Information · low
    15 votes
  28. Cross-origin resource sharing: arbitrary origin trusted on chatws25.stream.highwebmedia.comInformativeImproper Access Control - Generic
    14 votes
  29. CSRF on change video thumbnail at https://chaturbate.comCross-Site Request Forgery (CSRF) · low
    14 votes
  30. No rate limit in affiliate statsapi endpointImproper Restriction of Authentication Attempts · low
    14 votes
  31. CSV Injection with the CSV export featureOS Command Injection · low
    14 votes
  32. [chatws25.stream.highwebmedia.com] - Reflected XSS in c parameterCross-site Scripting (XSS) - Reflected · medium
    $35013 votes
  33. Bypass subdomain limits using race conditionTime-of-check Time-of-use (TOCTOU) Race Condition · low
    $10013 votes
  34. Users may still able to view chat room panel of password protected roomsImproper Access Control - Generic · medium
    13 votes
  35. Leaking Username and Password in the URLs via Virustotal, can leads to account takeoverInformativeInformation Exposure Through Sent Data
    11 votes
  36. Password protected rooms total number of viewers disclosure to unauthorized membersInformation Disclosure · low
    11 votes
  37. Private and group tokens per minute endpoint active for disabled usersImproper Access Control - Generic · low
    $15011 votes
  38. Add non-existent room moderatorImproper Input Validation · low
    11 votes
  39. Homograph attack on redirect URL (https://chaturbate.com/external_link/?url)Violation of Secure Design Principles · low
    11 votes
  40. Open redirect in securegatewayaccess.com / secure.chaturbate.com via prejoin_data parameterOpen Redirect · medium
    $25010 votes
  41. CSRF in REPORT EMOTICON featureCross-Site Request Forgery (CSRF) · low
    $25010 votes
  42. Blind SSRF on image proxy camo.stream.highwebmedia.comServer-Side Request Forgery (SSRF) · medium
    10 votes
  43. Stored XSS against all Chaturbate users using an application nameCross-site Scripting (XSS) - Stored · medium
    10 votes
  44. Homograph attack on redirect URL Violation of Secure Design Principles · low
    9 votes
  45. Unrestricted POST request size on /customer_support/information_form/ endpointViolation of Secure Design Principles · low
    8 votes
  46. Stats Token doesn't expire after deactivating accountImproper Access Control - Generic · low
    $2508 votes
  47. CSRF in cancel group and private show requestsCross-Site Request Forgery (CSRF) · medium
    $3007 votes
  48. Reflected XSS on ssl-ccstatic.highwebmedia.com via player.swfCross-site Scripting (XSS) - Reflected · medium
    7 votes
  49. CSRF in "send them an email and browser notification" featureCross-Site Request Forgery (CSRF) · low
    $1506 votes
  50. A 10GB file is reachableInformativeInformation Disclosure
    4 votes
  51. Missing CSRF Protection in /stats EndPoint.InformativeCross-Site Request Forgery (CSRF)
    4 votes
  52. Internal loop going to infinite for cb.setTimeout(func, msecs) for broadcast app.InformativeBusiness Logic Errors
    1 votes