Browse / LinkedIn

LinkedIn

See its reports on the map

What gets reported to LinkedIn

• Insecure Direct Object Reference13
• Access Control11
• Authentication5
• Cross-site Scripting4
• Information Disclosure3
• Business Logic2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Can delete other user's post and company page postImproper Access Control - Generic
   156 votes
2. Session Cookie Leakage via Static Header Field in WebViewerFragmentMisconfiguration · high
   131 votes
3. Persistent XSS (unvalidated Open Graph embed) at LinkedIn.comCross-site Scripting (XSS) - Stored
   119 votes
4. Unauthorized User can View Subscribers of Other Users NewslettersInsecure Direct Object Reference (IDOR) · high
   117 votes
5. Previous commentor on post can still comment even after comment permission is changed to disabledImproper Access Control - Generic · low
   112 votes
6. Unauthorized access to resumes stored on LinkedInInsecure Direct Object Reference (IDOR) · high
   112 votes
7. Can see phone numbers of others by providing mail addressInformation Disclosure · high
   111 votes
8. HTML Injection in LinkedIn Premium Support ChatCross-site Scripting (XSS) - Generic · low
   102 votes
9. Improper Access Control - Access to "Active Hiring" (Premium feature) filter results Improper Access Control - Generic · medium
   100 votes
10. IDOR allows an attacker to delete anyone's featured photo.Insecure Direct Object Reference (IDOR) · medium
    99 votes
11. An attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users.Insecure Direct Object Reference (IDOR) · high
    94 votes
12. Stored XSS on LinkedIn App via iframe tag in ArticleCross-site Scripting (XSS) - Stored · critical
    93 votes
13. IDOR to make someone attend or leave an eventInsecure Direct Object Reference (IDOR) · medium
    87 votes
14. Attackers can use TRIAL Premium only by paying **IDR 10,000.00** from the original price of `IDR462,400.00` per monthInsecure Direct Object Reference (IDOR) · high
    84 votes
15. Information disclosure by sending a GIFClient-Side Enforcement of Server-Side Security · medium
    84 votes
16. Forced OAuth authorization using button ID in hash and holding spaceImproper Authentication - Generic · medium
    79 votes
17. Entire database of emails exposed through URN injectionCode Injection · medium
    79 votes
18. Access to Deactivated LinkedIn Company Pages via Competitor Analytics APIInsecure Direct Object Reference (IDOR) · medium
    77 votes
19. Employee-only Area BypassImproper Access Control - Generic · medium
    77 votes
20. Attackers can *Upgrade and claim offer* on the Premium Trial Subscription with a total price of *IDR0.00* from the original *IDR7,022,061.82*Business Logic Errors · high
    70 votes
21. Can access the job name, creator name and can report any draft/under review/rejected jobInsecure Direct Object Reference (IDOR) · medium
    65 votes
22. Users can access exams in course without having to subscribe to PREMIUMImproper Access Control - Generic · medium
    64 votes
23. User Details Can Be Disclosed Even If The Account IS In Hibernation StateInformation Disclosure · low
    57 votes
24. Blocking a company page admin prevents him from delete paid media admin or edit his rolesImproper Access Control - Generic · medium
    55 votes
25. Html injection in event Description Improper Input Validation · low
    55 votes
26. CSRF that makes any linkedin user follow attacker controlled accounts by simply clicking https://www.linkedin.com/comm/mynetwork/discovery-see-all/*Cross-Site Request Forgery (CSRF) · medium
    53 votes
27. IDOR - Delete technical skill assessment result & Gained Badges result of any userInsecure Direct Object Reference (IDOR) · medium
    48 votes
28. Privilege Escalation - "Analyst" Role Can View Email Domains of a Company - [GET /voyager/api/voyagerOrganizationDashEmailDomainMappings]Privilege Escalation · medium
    48 votes
29. Attackers do not need to Pay for a Subscription to get the `Discussion Group URL` in `Paid Learning`Insecure Direct Object Reference (IDOR) · medium
    44 votes
30. Anyone can view the results of linkedin skill test -if failed to earn a badge or if the badge earned is kept private: both cases results can be viewedInsecure Direct Object Reference (IDOR) · medium
    43 votes
31. CSRF that makes any user send invitations to the attacker by simply clicking on a link.Cross-Site Request Forgery (CSRF) · medium
    41 votes
32. bypass two-factor authentication.Improper Authentication - Generic · medium
    41 votes
33. Delete any LinkedIn comment on learning API of other usersImproper Access Control - Generic · medium
    41 votes
34. Deny Admin from Editing LinkedIn Company Page using Gen Form Visibility via POST /voyager/api/voyagerOrganizationDashCompanies/{id}Improper Access Control - Generic · medium
    34 votes
35. An Attacker Can Flag Draft Job Posts And Can Disclose The Draft Job Posts Details [ Similar to #1581528 Resolved Report]Business Logic Errors · medium
    34 votes
36. HTML injection at Company Name or Product Name and can be shown on Contact Sales formCross-site Scripting (XSS) - Generic · low
    32 votes
37. Ad Account TakeoverPrivilege Escalation · critical
    30 votes
38. “See who’s interested in working for your company” - security issueInformation Disclosure · medium
    28 votes
39. [ Continuation Report from #1814842 ] Can create articles using other users' NewsLettersInsecure Direct Object Reference (IDOR) · medium
    23 votes
40. Campaign Account Balance and History Disclosed in API ResponseInsecure Direct Object Reference (IDOR) · medium
    21 votes
41. Attacker can unpin posts from companies he's not part of.low
    20 votes
42. Add me email address Authentication bypassInformativeImproper Authentication - Generic
    8 votes
43. Rate limit Bypass on contact-us through IP Rotator (burp extension)(https://www.linkedin.com/help/linkedin/solve/contact)N/AImproper Restriction of Authentication Attempts
    7 votes
44. The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more suN/AImproper Restriction of Authentication Attempts · medium
    3 votes