Browse / Harvest

Harvest

See its reports on the map

What gets reported to Harvest

• Authentication8
• Access Control6
• Information Disclosure5
• Cross-site Scripting5
• Cross-Site Request Forgery3
• Misconfiguration2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. S3 bucket takeover due to proxy.harvestfiles.comImproper Authentication - Generic
   $1,00038 votes
2. Client can redirect payment, causing payment discrepancy between Harvest and PayPalBusiness Logic Errors
   $40034 votes
3. Possible to steal any protected files on AndroidInformation Disclosure
   32 votes
4. Invoices can be added to any retainers - even closs-platformPrivilege Escalation
   $50022 votes
5. Cross-Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF)
   22 votes
6. Users enumeration is possible through cycling through recurring[client_id] argument value.Information Disclosure
   $35018 votes
7. Leak of all project names and all user names , even across applicationsInformation Disclosure
   $1,00016 votes
8. Editing a project (LIMITED)Privilege Escalation
   $10015 votes
9. Cookie Injection at 'harvestapp.com'Command Injection - Generic
   $30015 votes
10. Stored XSS on invoice, executing on any subdomainCross-site Scripting (XSS) - Generic
    $35015 votes
11. CSRF token fixation in Sign in with GoogleCross-Site Request Forgery (CSRF)
    15 votes
12. Extracting private info of estimates.Information Disclosure
    $15014 votes
13. XSS on expenses attachmentsCross-site Scripting (XSS) - Generic
    $25013 votes
14. Unauthorized read access to Invoices by PM (Access control Issues)Improper Authentication - Generic
    $15013 votes
15. PM can delete payment of any invoice in company (Access control Issue)Improper Authentication - Generic
    $10013 votes
16. Content Injection at First & Last Name Parameters that could Lead Fraud IssueViolation of Secure Design Principles
    13 votes
17. Login bypass on travel.██████████ aka "Harvest Spring Summit 2017"Improper Access Control - Generic
    12 votes
18. Stored XSS in Restoring Archived TasksCross-site Scripting (XSS) - Generic
    $25012 votes
19. PM can delete the company logo image (Vertical Privilege Escalation )Privilege Escalation
    $10012 votes
20. Linking Invoice to uninvited project.Improper Authentication - Generic
    $15011 votes
21. Record payment for any invoice by PM (Access control Issue)Improper Authentication - Generic
    $10010 votes
22. PM with can Set up email for invoices and estimates (Access control Issue)Improper Authentication - Generic
    $25010 votes
23. [platform.harvestapp.com] Reflected XSS in Error Message via URL parametersCross-site Scripting (XSS) - Reflected
    9 votes
24. Persistent XSS on ForecastAppCross-site Scripting (XSS) - Generic
    $2509 votes
25. Unauthorised read Access to Expense Receipt of any user in the company(Vertical Privilege escalation)Privilege Escalation
    $3009 votes
26. Unrestricted View to People’s Web Invoices Data without knowing the Unique HashInformation Disclosure
    9 votes
27. Project Manager can approve pending reports(Access control Issue)Privilege Escalation
    $1508 votes
28. Unauthorized access to all the actions of invoices by PM (Access control Issues) Improper Authentication - Generic
    $1508 votes
29. Opportunity to set arbitrary cookiesMisconfiguration
    $1508 votes
30. Project Disclosure of all Harvest InstancesImproper Authentication - Generic
    $5008 votes
31. CSRF bypass on Submit Time sheet for ApprovalCross-Site Request Forgery (CSRF)
    $1505 votes