Browse / IRCCloud

IRCCloud

See its reports on the map

What gets reported to IRCCloud

• Cross-Site Request Forgery12
• Misconfiguration11
• Cross-site Scripting7
• Authentication5
• Insecure Direct Object Reference1
• Information Disclosure1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. IDOR with Geolocation data not stripped from imagesInsecure Direct Object Reference (IDOR) · high
   $20066 votes
2. XSS from Mastodon embedsCross-site Scripting (XSS) - Generic · high
   $50063 votes
3. Cross Site Scripting(XSS) on IRCCloud Badges Page (using Parameter Pollution)Cross-site Scripting (XSS) - Generic
   48 votes
4. [IRCCloud Android] XSS in ImageViewerActivityCross-site Scripting (XSS) - Generic · medium
   44 votes
5. [IRCCloud Android] Theft of arbitrary files leading to token leakagePrivacy Violation · high
   31 votes
6. Full account takeover using CSRF and password resetCross-Site Request Forgery (CSRF)
   17 votes
7. [IRCCloud Android] Opening arbitrary URLs/XSS in SAMLAuthActivityCross-site Scripting (XSS) - Generic · medium
   16 votes
8. Exposed, outdated nginx server (v1.4.6) potentially vulnerable to heap-based buffer overflow & RCEMemory Corruption - Generic
   15 votes
9. Host Header Injection - irccloud.comViolation of Secure Design Principles
   $10010 votes
10. Login CSRF can be bypassed (Similar approach to previous one).Cross-Site Request Forgery (CSRF)
    8 votes
11. Login page password-guessing attack(Brute-force attack-High).InformativeImproper Authentication - Generic
    8 votes
12. Bug in iOS application which could lead to unauthorised access.Improper Authentication - Generic
    6 votes
13. Missing X-Content-Type-OptionsViolation of Secure Design Principles
    6 votes
14. Missing robots exclusion header for user uploadsImproper Access Control - Generic · low
    $505 votes
15. Bruteforce protection not enabled on the login page https://www.irccloud.com/InformativeCryptographic Issues - Generic
    5 votes
16. DNS MisconfigurationMisconfiguration
    5 votes
17. iOS application does not destroy session upon logout.Improper Authentication - Generic
    5 votes
18. "SESSION" Cookie without HttpOnly flag setInformativeImproper Authentication - Generic
    5 votes
19. Session Token is not Verified while changing Account Setting's which Result In account TakeoverCross-Site Request Forgery (CSRF)
    5 votes
20. Leaking Referrer in Reset Password LinkViolation of Secure Design Principles
    $1005 votes
21. Email verification links still valid after changing it 2xInformativeViolation of Secure Design Principles
    4 votes
22. Weak password policyInformativeImproper Authentication - Generic
    4 votes
23. Dangerous Persistent xssCross-site Scripting (XSS) - Generic
    4 votes
24. Unwanted Spamming Using CSRF [LOGGED IN USER]InformativeCross-Site Request Forgery (CSRF)
    4 votes
25. Host Header is not validated resulting in Open RedirectViolation of Secure Design Principles
    $1004 votes
26. CSRF to Account Take Over Bug Cross-Site Request Forgery (CSRF)
    4 votes
27. Sign up CSRFCross-Site Request Forgery (CSRF)
    $1004 votes
28. Inadequate input validation on API endpoint leading to self denial of service and increased system load.Uncontrolled Resource Consumption
    $5003 votes
29. Reflected XSS in Pastebin-viewCross-site Scripting (XSS) - Generic
    3 votes
30. Password type input with auto-complete enabledInformativeViolation of Secure Design Principles
    3 votes
31. Persistent Cross Site Scripting within the IRCCloud Pastebin Cross-site Scripting (XSS) - Generic
    $5003 votes
32. User Account Creation CSRF Cross-Site Request Forgery (CSRF)
    3 votes
33. HTML Form without CSRF protectionCross-Site Request Forgery (CSRF)
    3 votes
34. Bruteforcing irccloud loginViolation of Secure Design Principles
    $1003 votes
35. Unsecure cookies, cookie flag secure not setViolation of Secure Design Principles
    $1003 votes
36. Missing Character RestrictionInformativeViolation of Secure Design Principles
    2 votes
37. Login CSRFCross-Site Request Forgery (CSRF)
    $1002 votes
38. Unvalidated Channel names causes IRC Command InjectionCross-Site Request Forgery (CSRF)
    $3001 votes
39. Log Out Cross site Request ForgeryCross-Site Request Forgery (CSRF)
    1 votes
40. CSRF - Creating accountsCross-Site Request Forgery (CSRF)
    1 votes
41. Session cookie can be leaked over an unencrypted HTTP connectionViolation of Secure Design Principles
    1 votes