HexBrain
Sign in

Browse / Gratipay

Gratipay

136disclosed reports
$146paid in bounties

See its reports on the map

What gets reported to Gratipay

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. don't leak Server version for assets.gratipay.comInformativeInformation Disclosure
    12 votes
  2. Session Fixation At Logout /Session MisconfigurationInformativeImproper Authentication - Generic
    8 votes
  3. clickjacking on https://gratipay.com/on/npm/[text]InformativeUI Redressing (Clickjacking)
    5 votes
  4. Gratipay uses the random module's cryptographically insecure PRNG.InformativeCryptographic Issues - Generic
    5 votes
  5. CSRF csrftoken in cookiesInformativeCross-Site Request Forgery (CSRF) · high
    5 votes
  6. Username can be used to trick the victim on the name of www.gratipay.comInformativeViolation of Secure Design Principles
    5 votes
  7. Cross Site Scripting In Profile Statement InformativeCross-site Scripting (XSS) - Generic
    5 votes
  8. Username Restriction is not applied for reserved foldersInformativeViolation of Secure Design Principles
    4 votes
  9. nginx version disclosure on downloads.gratipay.comInformativeInformation Disclosure
    4 votes
  10. don't allow directory browsing on grtp.coInformativeInformation Disclosure
    4 votes
  11. prevent null bytes in email fieldInformativeViolation of Secure Design Principles
    4 votes
  12. auto-logout after 20 minutesInformativeImproper Authentication - Generic · low
    4 votes
  13. Adding Used Primary Email Address to attacker account and Account takeoverInformativeBusiness Logic Errors
    3 votes
  14. Show hide privacy giving receiving on my website InformativePrivacy Violation
    3 votes
  15. XSS Via Method injectionInformativeCross-site Scripting (XSS) - Generic
    3 votes
  16. The contribution save option seem to be vulnerable to CSRFInformativeCross-Site Request Forgery (CSRF)
    3 votes
  17. Authentication errors in server side validaton of E-MAILInformativeImproper Authentication - Generic
    3 votes
  18. Missing Certificate Authority Authorization ruleInformativeImproper Access Control - Generic
    2 votes
  19. CSP "script-src" includes "unsafe-inline" in https://gratipay.comInformativeViolation of Secure Design Principles
    2 votes
  20. Unauthorized access to the slack channel via inside.gratipay.com/appendices/chatInformativeImproper Authentication - Generic
    2 votes
  21. URL Given leading to end users ending up in malicious sitesInformativeViolation of Secure Design Principles · medium
    2 votes
  22. User EnumerationInformativeImproper Authentication - Generic
    2 votes
  23. Content type incorrectly statedInformative
    2 votes
  24. [gratipay.com] Cross Site TracingInformativeInformation Disclosure
    2 votes
  25. don't store CSRF tokens in cookiesInformativeViolation of Secure Design Principles
    2 votes
  26. csrf_token cookie don't have the flag "HttpOnly"InformativeCross-Site Request Forgery (CSRF)
    2 votes
  27. Vulnerable to clickjackingInformativeUI Redressing (Clickjacking)
    2 votes
  28. X-Content-Type Header Missing For aspen.ioInformativeViolation of Secure Design Principles
    2 votes
  29. SPF Protection not used, I can hijack your email serverInformativeCryptographic Issues - Generic
    2 votes
  30. Sub domain take over in gratipay.comInformativeViolation of Secure Design Principles
    1 votes
  31. Gratipay Website CSP "script-scr" includes "unsafe-inline"InformativeHTTP Request Smuggling · low
    1 votes
  32. POODLE SSLv3.0InformativeCryptographic Issues - Generic
    1 votes
  33. XSS found In Your WebInformativeCross-site Scripting (XSS) - Generic
    1 votes
  34. Lack of CSRF token validation at server sideInformativeCross-Site Request Forgery (CSRF)
    1 votes
  35. Insecure Transportation Security Protocol Supported (TLS 1.0)InformativeViolation of Secure Design Principles
    1 votes
  36. Username .. (double dot) should be restricted or handled carefullyInformativeViolation of Secure Design Principles
    1 votes
  37. don't expose path of Python InformativeInformation Disclosure
    1 votes
  38. text injection in website titleInformativeViolation of Secure Design Principles
    1 votes
  39. Getting Error Message and in use python version 2.7 is exposed.InformativeInformation Disclosure
    1 votes
  40. An adversary can harvest email address for spamming.InformativeViolation of Secure Design Principles
    1 votes
  41. grtp.co is vulnerable to http-vuln-cve2011-3192InformativeUncontrolled Resource Consumption
    1 votes
  42. Broken link for stale DNS entry may be leveraged for Phishing, Misinformation, Serving MalwareInformativeMisconfiguration
  43. self cross site scriptingInformativeCross-Site Request Forgery (CSRF) · low
  44. x-xss protection header is not set in response headerInformativeViolation of Secure Design Principles
  45. Usernames ending in .json are not restrictedInformativeViolation of Secure Design Principles
  46. Submit a non valid syntax emailInformativeViolation of Secure Design Principles
  47. Possible Blind SQL injection | Language choice in presentationInformativeViolation of Secure Design Principles
  48. prevent %2f spoofed URLs in profile statementInformativeOpen Redirect
  49. UDP port 5060 (SIP) OpenInformativeUncontrolled Resource Consumption
  50. server calendar and server status available to publicInformativeInformation Disclosure
  51. proxy port 7000 and shell port 514 not filteredInformativeViolation of Secure Design Principles
  52. Markdown parsing issue enables insertion of malicious tagsInformativeCross-site Scripting (XSS) - Generic
  53. nginx SPDY heap buffer overflow for https://grtp.co/InformativeMemory Corruption - Generic
  54. Directory Listing on grtp.coInformativeCryptographic Issues - Generic