Browse / Gratipay

Gratipay

See its reports on the map

What gets reported to Gratipay

• Misconfiguration47
• Authentication18
• Information Disclosure18
• Cross-Site Request Forgery9
• Cryptography9
• Cross-site Scripting8

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Saying goodbye to HackerOne and Gratipay.
   96 votes
2. Reflected XSS - gratipay.comCross-site Scripting (XSS) - Reflected · medium
   36 votes
3. i am The bugSpamArray Index Underflow
   23 votes
4. configure a redirect URI for Facebook OAuthImproper Authentication - Generic · medium
   18 votes
5. Sub Domain Takeover
   16 votes
6. Application-level DoS on image's "size" parameter.Uncontrolled Resource Consumption · high
   15 votes
7. fix bug in username restrictionViolation of Secure Design Principles · medium
   15 votes
8. SQL TESTN/ASQL Injection
   14 votes
9. change bank account numbersInformation Disclosure · medium
   13 votes
10. User Supplied links on profile page is not validated and redirected via gratipay.DuplicateOpen Redirect
    12 votes
11. don't leak Server version for assets.gratipay.comInformativeInformation Disclosure
    12 votes
12. Reflected SQL ExecutionSpam
    11 votes
13. Content length restriction bypass can lead to DOS by reading large files on gip.rocksUncontrolled Resource Consumption · high
    11 votes
14. Limit email address lengthImproper Authentication - Generic · low
    11 votes
15. Gratipay rails secret token (secret_key_base) publicly exposed in GitHubCleartext Storage of Sensitive Information · medium
    10 votes
16. HTTP trace method is enabled on aspen.ioViolation of Secure Design Principles · low
    10 votes
17. Host Header Injection/Redirection AttackN/ACommand Injection - Generic
    9 votes
18. upgrade Aspen on inside.gratipay.com to pick up CR injection fixCross-site Scripting (XSS) - Generic · high
    $409 votes
19. Sub Domain Take overImproper Authentication - Generic · medium
    9 votes
20. CSV injection in gratipay.com via payment history export feature.Command Injection - Generic · medium
    8 votes
21. Inadequate/dangerous jQuery behaviorViolation of Secure Design Principles · low
    8 votes
22. Session Fixation At Logout /Session MisconfigurationInformativeImproper Authentication - Generic
    8 votes
23. Email Forgery through Mandrillapp SPFImproper Authentication - Generic · medium
    $108 votes
24. protect against tabnabbing in statementImproper Authentication - Generic · medium
    8 votes
25. Stored XSS On StatementCross-site Scripting (XSS) - Generic · high
    8 votes
26. Transferring incorrect data to the http://gip.rocks/v1 endpoint with correct Content-Type leads to local paths disclosure through the error messageDuplicateInformation Exposure Through an Error Message · low
    7 votes
27. Avoid "resend verification email" confusionCross-Site Request Forgery (CSRF) · low
    $17 votes
28. Incomplete or No Cache-control and Pragma HTTP Header Setlow
    6 votes
29. suppress version in Server header on gratipay.com or grtp.coInformation Disclosure · low
    $16 votes
30. No Valid SPF Records.Improper Authentication - Generic · medium
    $106 votes
31. [gratipay.com] CRLF InjectionCRLF Injection · high
    $406 votes
32. weak ssl cipher suitesCryptographic Issues - Generic · low
    6 votes
33. clickjacking on https://gratipay.com/on/npm/[text]InformativeUI Redressing (Clickjacking)
    5 votes
34. Missing Certificate Authority Authorization ruleDuplicateCryptographic Issues - Generic
    5 votes
35. Content-Length restriction bypass to heap overflow in gip.rocks.Heap Overflow · high
    5 votes
36. HTTP trace method is enabled on gip.rocksViolation of Secure Design Principles · medium
    5 votes
37. Gratipay uses the random module's cryptographically insecure PRNG.InformativeCryptographic Issues - Generic
    5 votes
38. CSRF csrftoken in cookiesInformativeCross-Site Request Forgery (CSRF) · high
    5 votes
39. Username can be used to trick the victim on the name of www.gratipay.comInformativeViolation of Secure Design Principles
    5 votes
40. Cross Site Scripting In Profile Statement InformativeCross-site Scripting (XSS) - Generic
    5 votes
41. Content Spoofing/Text Injection Violation of Secure Design Principles · low
    $15 votes
42. don't serve hidden files from NginxInformation Disclosure · low
    $15 votes
43. Prevent content spoofing on /~username/emails/verify.htmlCross-Site Request Forgery (CSRF) · medium
    5 votes
44. Harden resend throttlingViolation of Secure Design Principles · medium
    5 votes
45. CSP Policy Bypass and javascript executionDuplicateImproper Access Control - Generic
    4 votes
46. Cookie HttpOnly Flag Not Set DuplicateMisconfiguration
    4 votes
47. Secure Pages Include Mixed ContentDuplicatelow
    4 votes
48. Username Restriction is not applied for reserved foldersInformativeViolation of Secure Design Principles
    4 votes
49. Reset Link IssueN/AImproper Authentication - Generic
    4 votes
50. nginx version disclosure on downloads.gratipay.comInformativeInformation Disclosure
    4 votes
51. don't allow directory browsing on grtp.coInformativeInformation Disclosure
    4 votes
52. prevent null bytes in email fieldInformativeViolation of Secure Design Principles
    4 votes
53. Hijacking user session by forcing the use of invalid HTTPs Certificate on images.gratipay.comInformation Disclosure · low
    4 votes
54. auto-logout after 20 minutesInformativeImproper Authentication - Generic · low
    4 votes
55. strengthen Diffie-Hellman (DH) key exchange parameters in grtp.coImproper Authentication - Generic · low
    4 votes
56. Login csrf.N/ACross-Site Request Forgery (CSRF)
    4 votes
57. SPF/DKIM/DMARC for aspen.ioImproper Authentication - Generic · medium
    4 votes
58. limit HTTP methods on other domainsViolation of Secure Design Principles · low
    4 votes
59. HTTP trace method is enabledViolation of Secure Design Principles · low
    4 votes
60. Adding Used Primary Email Address to attacker account and Account takeoverInformativeBusiness Logic Errors
    3 votes
61. Show hide privacy giving receiving on my website InformativePrivacy Violation
    3 votes
62. Certificate signed using SHA-1DuplicateCryptographic Issues - Generic · medium
    3 votes
63. XSS Via Method injectionInformativeCross-site Scripting (XSS) - Generic
    3 votes
64. The contribution save option seem to be vulnerable to CSRFInformativeCross-Site Request Forgery (CSRF)
    3 votes
65. This is a test reportN/A
    3 votes
66. bring grtp.co up to A grade on SSLLabsViolation of Secure Design Principles · low
    3 votes
67. Send email asynchronouslyUncontrolled Resource Consumption · medium
    $103 votes
68. stop serving grtp.co over HTTPInformation Disclosure · low
    $13 votes
69. The POODLE attack (SSLv3 supported) for https://grtp.co/Cryptographic Issues - Generic · low
    3 votes
70. implement a cross-domain policy for Adobe productsN/AViolation of Secure Design Principles
    3 votes
71. Mail spamingViolation of Secure Design Principles · low
    $203 votes
72. Authentication errors in server side validaton of E-MAILInformativeImproper Authentication - Generic
    3 votes
73. Bypassing X-frame options N/AUI Redressing (Clickjacking)
    2 votes
74. xss N/ACross-Site Request Forgery (CSRF)
    2 votes
75. Missing Certificate Authority Authorization ruleInformativeImproper Access Control - Generic
    2 votes
76. CSP "script-src" includes "unsafe-inline" in https://gratipay.comInformativeViolation of Secure Design Principles
    2 votes
77. Unauthorized access to the slack channel via inside.gratipay.com/appendices/chatInformativeImproper Authentication - Generic
    2 votes
78. URL Given leading to end users ending up in malicious sitesInformativeViolation of Secure Design Principles · medium
    2 votes
79. User EnumerationInformativeImproper Authentication - Generic
    2 votes
80. Content type incorrectly statedInformative
    2 votes
81. Host Header poisoning on gratipay.comDuplicateViolation of Secure Design Principles
    2 votes
82. [gratipay.com] Cross Site TracingInformativeInformation Disclosure
    2 votes
83. don't leak Server version for assets.gratipay.comDuplicateInformation Disclosure
    2 votes
84. set Expires headerN/AImproper Authentication - Generic
    2 votes
85. set Pragma headerN/AImproper Authentication - Generic
    2 votes
86. don't store CSRF tokens in cookiesInformativeViolation of Secure Design Principles
    2 votes
87. After removing app from facebook app session not expiring.DuplicateImproper Authentication - Generic
    2 votes
88. prevent content spoofing on /~username/emails/verify.htmlDuplicateViolation of Secure Design Principles
    2 votes
89. csrf_token cookie don't have the flag "HttpOnly"InformativeCross-Site Request Forgery (CSRF)
    2 votes
90. Vulnerable to clickjackingInformativeUI Redressing (Clickjacking)
    2 votes
91. X-Content-Type Header Missing For aspen.ioInformativeViolation of Secure Design Principles
    2 votes
92. limit number of images in statementViolation of Secure Design Principles · medium
    $12 votes
93. SPF/DKIM/DMARC for grtp.coViolation of Secure Design Principles · medium
    2 votes
94. SPF Protection not used, I can hijack your email serverInformativeCryptographic Issues - Generic
    2 votes
95. DKIM records not present, Email Hijacking is possibleImproper Authentication - Generic · medium
    2 votes
96. Possible SQL injection on "Jump to twitter"SQL Injection · low
    2 votes
97. Self XSS Protection not used , I can trick users to insert JavaScriptCross-site Scripting (XSS) - Generic · medium
    2 votes
98. Information Disclosure on inside.gratipay.comInformation Disclosure
    1 votes
99. 400 Bad Request [Use a third-party provider to sign in or create an account on Gratipay]N/AViolation of Secure Design Principles
    1 votes
100. Sub domain take over in gratipay.comInformativeViolation of Secure Design Principles
     1 votes