Browse / Gratipay

Gratipay

See its reports on the map

What gets reported to Gratipay

• Misconfiguration47
• Authentication18
• Information Disclosure18
• Cross-Site Request Forgery9
• Cryptography9
• Cross-site Scripting8

Most upvoted reports

AllValidInformativeN/ADuplicate

1. User Supplied links on profile page is not validated and redirected via gratipay.DuplicateOpen Redirect
   12 votes
2. Transferring incorrect data to the http://gip.rocks/v1 endpoint with correct Content-Type leads to local paths disclosure through the error messageDuplicateInformation Exposure Through an Error Message · low
   7 votes
3. Missing Certificate Authority Authorization ruleDuplicateCryptographic Issues - Generic
   5 votes
4. CSP Policy Bypass and javascript executionDuplicateImproper Access Control - Generic
   4 votes
5. Cookie HttpOnly Flag Not Set DuplicateMisconfiguration
   4 votes
6. Secure Pages Include Mixed ContentDuplicatelow
   4 votes
7. Certificate signed using SHA-1DuplicateCryptographic Issues - Generic · medium
   3 votes
8. Host Header poisoning on gratipay.comDuplicateViolation of Secure Design Principles
   2 votes
9. don't leak Server version for assets.gratipay.comDuplicateInformation Disclosure
   2 votes
10. After removing app from facebook app session not expiring.DuplicateImproper Authentication - Generic
    2 votes
11. prevent content spoofing on /~username/emails/verify.htmlDuplicateViolation of Secure Design Principles
    2 votes
12. Possible user session hijack by invalid HTTPS certificate on inside.gratipay.com domainDuplicateViolation of Secure Design Principles · low
    1 votes
13. CSP Policy Bypass and javascript execution Still Not FixedDuplicateImproper Access Control - Generic
    1 votes
14. Email SpoofingDuplicateViolation of Secure Design Principles
    1 votes
15. Cookie:HttpOnly Flag not setDuplicateViolation of Secure Design Principles
    1 votes
16. SSl Weak CiphersDuplicateCryptographic Issues - Generic · low