HexBrain
Sign in

Browse / Dropbox

Dropbox

46disclosed reports
$50,624paid in bounties

See its reports on the map

What gets reported to Dropbox

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Server Side Request Forgery (SSRF) at app.hellosign.com leads to AWS private keys disclosureServer-Side Request Forgery (SSRF)
    $4,913360 votes
  2. Full Response SSRF via Google DriveServer-Side Request Forgery (SSRF)
    $17,576302 votes
  3. Send Fax from Anyone's HelloFax Account Due to Misconfigured Email ValidationViolation of Secure Design Principles
    $4,91385 votes
  4. Exposed Git Repo at http://fileserver.dropboxbusiness.comInformation Disclosure
    $1,02463 votes
  5. Abuse cookie-modification, toast HTML and expired domain in CSP-form-action replacing login-page at www.dropbox.com/login to submit creds externallyCleartext Transmission of Sensitive Information
    $6,90947 votes
  6. Broken OAuth leads to change photo profile users .Improper Authentication - Generic
    $51237 votes
  7. `account_info.read` scope OAuth app access token can change token owner's account name.Improper Access Control - Generic
    $1,72834 votes
  8. User has Sender permission can Get Team information Information Disclosure
    $21634 votes
  9. Android - Access of some not exported content providers Privilege Escalation
    $1,00034 votes
  10. Exfiltrate GDrive access token using CSRFInformation Disclosure
    $1,72832 votes
  11. Dropbox employee benefits documents are available in a test Dropbox folder
    $55929 votes
  12. Coupon codes indexed by GoogleInformation Disclosure
    $21622 votes
  13. XSS in OAuth Redirect UrlCross-site Scripting (XSS) - Generic
    21 votes
  14. URL modification changes server side behavior to allow accessClient-Side Enforcement of Server-Side Security
    $21619 votes
  15. Stored XSS in dropboxforum.comCross-site Scripting (XSS) - Stored
    $51219 votes
  16. SSRF allows access to internal services like GangliaInformation Disclosure
    $72914 votes
  17. Leaking API_KEY of testrail of HelloSign gives read/write accessInformation Disclosure
    $3,37513 votes
  18. [www.dropboxforum.com] - reflected XSS in searchCross-site Scripting (XSS) - Reflected
    $51213 votes
  19. Subtile Code Injection Vulnerability in Dropbox for WindowsCommand Injection - Generic
    $1,45813 votes
  20. Fedora installation instructions fetch repo and validation key from insecure source, allowing mitm attackMissing Required Cryptographic Step
    $21610 votes
  21. Significant Two step verification Authentication BypassImproper Authentication - Generic
    10 votes
  22. Forum posts and private messages are poorly sanitized, allowing execution of arbitrary JavaScriptCross-site Scripting (XSS) - Stored
    $72910 votes
  23. Dropbox Paper - Markdown XSSCross-site Scripting (XSS) - Stored
    $34310 votes
  24. avrecode: global-buffer-overflow in get_neighbor()Classic Buffer Overflow
    10 votes
  25. SSRF vulnerablity in app webhooksInformation Disclosure
    $5129 votes
  26. Lack of account link warning enables dropbox hijackingViolation of Secure Design Principles
    8 votes
  27. Local Privilege Escalation on Dropbox Desktop for WindowsPrivilege Escalation
    7 votes
  28. Algorithmic complexity vulnerability in ZXCVBN leads to remote denial of service attackDenial of Service
    7 votes
  29. [monitor.sjc.dropbox.com] CRLF InjectionCRLF Injection
    7 votes
  30. Dropbox apps Server side request forgeryImproper Authentication - Generic
    5 votes
  31. Race condition when redeeming coupon codesBusiness Logic Errors
    $2165 votes
  32. Disclose anonymous accessible link on embedded files in paper dropbox sessionsInsecure Direct Object Reference (IDOR)
    4 votes
  33. SSL Key Certificate expiresImproper Access Control - Generic
    3 votes
  34. XSS, Unvalidated redirects & phishing website hosting on dropbox serversCross-site Scripting (XSS) - Generic
    2 votes
  35. Can make any number of dropbox accounts with one emailViolation of Secure Design Principles
    2 votes
  36. Possible SQL injection can cause denial of service attackSQL Injection
    2 votes
  37. WP User Enumeration is possible at https://blog.dropbox.comViolation of Secure Design Principles
    2 votes
  38. Bypass Local Authentication (TouchID)Improper Authentication - Generic
    1 votes
  39. User Impersonation - Create Support Ticket With Any Registered Account Email
    1 votes
  40. CSV Injection with the CVS export featureCode Injection
    1 votes
  41. No Rate Limiting while sending the feedback under Dropbox Help CentreDenial of Service
    1 votes
  42. XSS in dropbox main domain Cross-site Scripting (XSS) - Generic
    $5121 votes
  43. Missing URL sanitization in comments can be leveraged for phishingPhishing
  44. XSS in version history of an HTML file in a shared folderCross-site Scripting (XSS) - Generic
  45. Create N Accounts In Dropbox Irrespective Of DomainMemory Corruption - Generic
  46. Unvalidated Redirects and Stored XSSCross-site Scripting (XSS) - Generic