Browse / Enjin

Enjin

See its reports on the map

What gets reported to Enjin

• Business Logic4
• Access Control3
• Authentication2
• Cross-Site Request Forgery2
• Injection and Smuggling1
• Code Execution1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Unauthenticated GraphQL access by prepending __schema to private operationsAuthentication Bypass · medium
   $50076 votes
2. Revocation API Token by Bypassing The XSRF TokenCross-Site Request Forgery (CSRF) · critical
   60 votes
3. Unauthenticated File Upload to CDNImproper Access Control - Generic · medium
   56 votes
4. Weak Email Verification: Newly Registered Users Can Bypass Email Verification Step and Log InImproper Authentication - Generic · medium
   48 votes
5. Host header injection leads to account takeoverDuplicateImproper Neutralization of HTTP Headers for Scripting Syntax · high
   47 votes
6. Race Condition on Create API FunctionLeveraging Race Conditions
   45 votes
7. Authentication token and CSRF token bypassImproper Access Control - Generic · high
   $30044 votes
8. Lack of Tenant Scoping Enables Limited Cross-Tenant Data Querying and MutationImproper Access Control - Generic · critical
   41 votes
9. Race condition via project team member invitation system.Business Logic Errors · low
   35 votes
10. Cloudflare /cdn-cgi/ path allows resizing images from unauthorised sources on enjinusercontent.comCode Injection · low
    29 votes
11. Unrestricted Upload of File with Dangerous TypeBusiness Logic Errors · medium
    20 votes
12. CSRF Bypassed on Logout EndpointCross-Site Request Forgery (CSRF) · low
    19 votes
13. Reset password policy isn't consistent with registration / change password policy.Business Logic Errors · low
    10 votes