Browse / Courier

Courier

See its reports on the map

What gets reported to Courier

• Authentication6
• Denial of Service3
• Misconfiguration2
• Access Control1
• Cross-Site Request Forgery1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Broken Authentication Session Token BugInsufficient Session Expiration · medium
   35 votes
2. Missing rate limit in signup Form Improper Authentication - Generic · medium
   19 votes
3. Rate limit function bypass can leads to occur huge critical problem into website. Improper Access Control - Generic · medium
   16 votes
4. [OPEN S3 BUCKET] All uploaded files are public. Misconfiguration · medium
   16 votes
5. 2 Bypass of #1067533 rate limit via X-Forwarded-For<space>: Source IP on ( www.trycourier.app )Uncontrolled Resource Consumption · medium
   15 votes
6. disable test send feature if user's email address isn't verifiedUncontrolled Resource Consumption · high
   13 votes
7. Session Fixiation allow attacker to create new evil workspace without being logged in [ Insecure Session management ]Session Fixation · medium
   12 votes
8. Possible to invite any team member without being logged in. [ Session Management Issue ]Insufficient Session Expiration · medium
   12 votes
9. [3] Bypassing IP Based Rate Limit Blocking leads to rate limit bypass in Courier Login PanelUncontrolled Resource Consumption
   10 votes
10. Missing SPF record on trycourier.appInformativeMisconfiguration · low
    8 votes
11. Bypass Too Many Requests Sign Up InformativeAuthentication Bypass Using an Alternate Path or Channel · medium
    6 votes
12. Logout page does not prevent CSRFInformativeCross-Site Request Forgery (CSRF) · low
    6 votes
13. SSO Provider Credential Cache (logged out of Google/GitHub, could still log into Courier)InformativeImproper Authentication - Generic · low
    1 votes