Browse / Cuvva

Cuvva

See its reports on the map

What gets reported to Cuvva

• Misconfiguration6
• Authentication6
• Insecure Direct Object Reference2
• Cryptography2
• Other weaknesses2
• Injection and Smuggling1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Insecure Direct Object Reference (IDOR) Allowing me to claim other user's photos (driving license and selfies) as mineInsecure Direct Object Reference (IDOR)
   20 votes
2. CRLF Injection [vpn.corp.cuvva.com]CRLF Injection
   20 votes
3. No Notification Sent When Email Is Changed.Uncontrolled Resource Consumption
   12 votes
4. Unclaimed facebook page at www.cuvva.com/aboutViolation of Secure Design Principles
   11 votes
5. Missing rate limit on https://underwriter.partner.cuvva.com/loginImproper Restriction of Authentication Attempts
   9 votes
6. Sensitive Support Mail DisclosureInformation Disclosure
   8 votes
7. Your two domain login email address are disclosed in Improper Authentication - Generic
   6 votes
8. https://admin.corp.cuvva.co/ is vulnerable to Clickjacking attacks due to missing X-Frame-Options UI Redressing (Clickjacking)
   5 votes
9. Reflected XSS on Branch domainCross-site Scripting (XSS) - Reflected
   5 votes
10. Time-limit Bypassing, Rate-limit Bypassing and Spamming at https://ops.cuvva.coViolation of Secure Design Principles
    4 votes
11. IDOR spam anyone's cellphone number through Cuvva app linkInsecure Direct Object Reference (IDOR)
    4 votes
12. RC4 cipher suit in use in vpn.corp.cuvva.coInadequate Encryption Strength
    4 votes
13. Session cookie without secure flag on https://underwriter.partner.cuvva.comReliance on Cookies without Validation and Integrity Checking in a Security Decision
    3 votes
14. No rate limiting at POST /2/2017-05-22/send_identifier_tokenViolation of Secure Design Principles
    3 votes
15. Clickjacking in ops.cuvva.comUI Redressing (Clickjacking)
    2 votes
16. Missing rate-limits at endpointsImproper Restriction of Authentication Attempts
    2 votes
17. Missing Rate limiting on https://underwriter.partner.cuvva.com/loginImproper Authentication - Generic
    2 votes
18. Verification code for Underwriter dashboard can be brute-forcedImproper Restriction of Authentication Attempts
    2 votes
19. cuvva.com website CSP "script-src" includes "unsafe-inline"
    2 votes
20. CSRF on cuvva.insure allows to attacker to send multiple SMS to download the app without visiting the cuvvaCross-Site Request Forgery (CSRF)
    1 votes
21. Subdomain take over oh-no.cuvva.co and ohno.cuvva.co
    1 votes
22. Clickjacking vulnerability in support-dashboard.corp.cuvva.coUI Redressing (Clickjacking)
    1 votes
23. cuvva.com vulnerable to sweet32Cryptographic Issues - Generic
    1 votes