Browse / Glassdoor

Glassdoor

See its reports on the map

What gets reported to Glassdoor

• Cross-site Scripting18
• Information Disclosure5
• Insecure Direct Object Reference3
• Authentication2
• Cross-Site Request Forgery2
• Misconfiguration1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Reflected XSS on https://www.glassdoor.com/employers/sem-dual-lp/Cross-site Scripting (XSS) - Reflected
   684 votes
2. 2FA bypass by sending blank codeImproper Authentication - Generic
   303 votes
3. Cache Poisoning allows redirection on JS filesCross-site Scripting (XSS) - Stored
   219 votes
4. Site wide CSRF affecting both job seeker and Employer account on glassdoor.comCross-Site Request Forgery (CSRF)
   162 votes
5. Web Cache Poisoning leads to Stored XSS Cross-site Scripting (XSS) - Stored
   133 votes
6. [CRITICAL] Full account takeover without user interaction on sign with Apple flowImproper Authentication - Generic
   118 votes
7. XSS at https://www.glassdoor.com/Salary/* via filter.jobTitleExactCross-site Scripting (XSS) - Generic
   108 votes
8. web.xml configuration file disclosureInformation Disclosure
   94 votes
9. IDOR vulnerability on profile picture changing mechanism which discloses other user's profile picture.Insecure Direct Object Reference (IDOR)
   71 votes
10. Web Cache Poisoning leads to XSS and DoSCross-site Scripting (XSS) - Stored
    71 votes
11. Get all personal email IDs of Glassdoor users[No user interaction required]Information Disclosure
    65 votes
12. Web Cache DeceptionInformation Disclosure
    62 votes
13. [https://www.glassdoor.com] - Web Cache Deception Leads to gdtoken Disclosure Information Disclosure
    60 votes
14. Reflected XSS on https://www.glassdoor.com/job-listing/spotlightCross-site Scripting (XSS) - Reflected
    56 votes
15. Unauthorized Access to Deleted Interviews on Glassdoor PlatformInsecure Direct Object Reference (IDOR)
    46 votes
16. Reflected XSS on https://help.glassdoor.com/GD_HC_EmbeddedChatVFCross-site Scripting (XSS) - Reflected
    46 votes
17. Access to Glassdoor's Infra (AWS) and BitBucket account through leaked repoInformation Disclosure
    43 votes
18. [XSS] Reflected XSS via POST request in (editJobAlert.htm) fileCross-site Scripting (XSS) - Reflected
    38 votes
19. Reflected XSS at https://www.glassdoor.co.in/FAQ/Microsoft-Question-FAQ200086-E1651.htm?countryRedirect=true via PATHCross-site Scripting (XSS) - Reflected
    35 votes
20. XSS in http://www.glassdoor.com/Search/results.htm via Parameter PollutionCross-site Scripting (XSS) - Reflected
    32 votes
21. Reflected XSS at https://www.glassdoor.com/ via the 'numSuggestions' parameterCross-site Scripting (XSS) - Reflected
    31 votes
22. XSS in www.glassdoor.comCross-site Scripting (XSS) - Reflected
    27 votes
23. IDOR Vulnerability in Job PreferencesInsecure Direct Object Reference (IDOR)
    23 votes
24. Reflected XSS on https://help.glassdoor.com/gd_requestsubmitpageCross-site Scripting (XSS) - Reflected
    21 votes
25. Reflected XSS at https://www.glassdoor.com/Interview/Accenturme-Interview-Questions-E9931.htm via filter.jobTitleFTS parameterCross-site Scripting (XSS) - Reflected
    18 votes
26. Reflected XSS at https://www.glassdoor.co.in/Interview/BlackRock-Interview-Questions-E9331.htm via filter.jobTitleExact parameterCross-site Scripting (XSS) - Reflected
    17 votes
27. Reflected XSS at https://www.glassdoor.co.in/Job/pratt-whitney-jobs-SRCH_KE0,13.htm?initiatedFromCountryPicker=true&countryRedirect=trueCross-site Scripting (XSS) - Reflected
    16 votes
28. HTML Injection in Glassdoor job sharing emailsPhishing
    14 votes
29. CSS injection via link tag whitelisted-domain bypass - https://www.glassdoor.comImproper Access Control - Generic
    13 votes
30. Open redirect on https://www.glassdoor.com/profile/siwa.htm via state parameterOpen Redirect
    12 votes
31. Dom XSS Rootkit on [https://www.glassdoor.com/]Cross-site Scripting (XSS) - DOM
    10 votes
32. Reflected XSS on https://www.glassdoor.com/parts/header.htmCross-site Scripting (XSS) - Reflected
    7 votes
33. CSRF in Demographic Settings with valid gdtoken of other account Cross-Site Request Forgery (CSRF)
    5 votes