Browse / Cloudflare Vulnerability Disclosure

Cloudflare Vulnerability Disclosure

See its reports on the map

What gets reported to Cloudflare Vulnerability Disclosure

• Cross-site Scripting9
• Misconfiguration5
• Cross-Site Request Forgery4
• Code Execution2
• Information Disclosure2
• Other weaknesses2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. [http2.cloudflare.com] Open RedirectOpen Redirect
   31 votes
2. Reflected XSS on partners.cloudflare.comCross-site Scripting (XSS) - Generic
   31 votes
3. Cloudflare based XSS for IE11Cross-site Scripting (XSS) - Generic
   26 votes
4. SSRF Server-Side Request Forgery (SSRF)
   22 votes
5. Potential XSS vulnerability to HTML minificationCross-site Scripting (XSS) - Generic
   21 votes
6. DOM XSS on 1.1.1.1(one.one.one.one)Cross-site Scripting (XSS) - DOM
   18 votes
7. Private API key leakage due to lack of access controlImproper Access Control - Generic
   11 votes
8. Remote file inclusion using "/cdn-cgi/pe/bag2?r[]=" Remote File Inclusion
   9 votes
9. // (double slash) inside es6 template literals interpreted as an inline comment by the auto-minifierCode Injection
   7 votes
10. CSRF in Cloudflare loginCross-Site Request Forgery (CSRF)
    5 votes
11. Cloudflare does not sufficiently truncate credit card numbers in invoicesMissing Encryption of Sensitive Data
    2 votes
12. User can request for password reset link without giving his website, eventhough he have itViolation of Secure Design Principles
    2 votes
13. Password reset threshold not setViolation of Secure Design Principles
    2 votes
14. Apache Multiviews are enabledDenial of Service
    2 votes
15. csrf on password change functionality Cross-Site Request Forgery (CSRF)
    2 votes
16. http://cdnjs.cloudflare.com/ Cross-site scripting 2Cross-site Scripting (XSS) - Generic
    2 votes
17. Content spoofing /CSRF at https://www.cloudflare.com/ajax/modal-dialog.htmlViolation of Secure Design Principles
    2 votes
18. Apache mod_negotiation filename bruteforcingCryptographic Issues - Generic
    1 votes
19. CSRF and No password requirement in this URL Billing InfoCross-site Scripting (XSS) - Generic
    1 votes
20. Bug Report
    1 votes
21. User's data leakInformation Disclosure
    1 votes
22. Threat control information leakCross-Site Request Forgery (CSRF)
    1 votes
23. Security issue with your "bag" script
    1 votes
24. System Status Update CSRFCross-Site Request Forgery (CSRF)
    1 votes
25. XSS - http://js.cloudflare.comCross-site Scripting (XSS) - Generic
    1 votes
26. jplayer.swf Cross-site scriptingCross-site Scripting (XSS) - Generic
    1 votes
27. Clickjacking : https://partners.cloudflare.com/UI Redressing (Clickjacking)
28. Cookie missing the Secure flag Misconfiguration
29. Flash-based XSS in cdnjs.cloudflare.com subdomainCross-site Scripting (XSS) - Generic