Browse / LinkedIn

LinkedIn

See its reports on the map

What gets reported to LinkedIn

• Insecure Direct Object Reference13
• Access Control11
• Authentication5
• Cross-site Scripting4
• Information Disclosure3
• Business Logic2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Can delete other user's post and company page postImproper Access Control - Generic
   156 votes
2. Session Cookie Leakage via Static Header Field in WebViewerFragmentMisconfiguration · high
   131 votes
3. Unauthorized User can View Subscribers of Other Users NewslettersInsecure Direct Object Reference (IDOR) · high
   117 votes
4. Previous commentor on post can still comment even after comment permission is changed to disabledImproper Access Control - Generic · low
   112 votes
5. Unauthorized access to resumes stored on LinkedInInsecure Direct Object Reference (IDOR) · high
   112 votes
6. Can see phone numbers of others by providing mail addressInformation Disclosure · high
   111 votes
7. HTML Injection in LinkedIn Premium Support ChatCross-site Scripting (XSS) - Generic · low
   102 votes
8. Improper Access Control - Access to "Active Hiring" (Premium feature) filter results Improper Access Control - Generic · medium
   100 votes
9. IDOR allows an attacker to delete anyone's featured photo.Insecure Direct Object Reference (IDOR) · medium
   99 votes
10. An attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users.Insecure Direct Object Reference (IDOR) · high
    94 votes
11. Stored XSS on LinkedIn App via iframe tag in ArticleCross-site Scripting (XSS) - Stored · critical
    93 votes
12. IDOR to make someone attend or leave an eventInsecure Direct Object Reference (IDOR) · medium
    87 votes
13. Attackers can use TRIAL Premium only by paying **IDR 10,000.00** from the original price of `IDR462,400.00` per monthInsecure Direct Object Reference (IDOR) · high
    84 votes
14. Information disclosure by sending a GIFClient-Side Enforcement of Server-Side Security · medium
    84 votes
15. Forced OAuth authorization using button ID in hash and holding spaceImproper Authentication - Generic · medium
    79 votes
16. Entire database of emails exposed through URN injectionCode Injection · medium
    79 votes
17. Access to Deactivated LinkedIn Company Pages via Competitor Analytics APIInsecure Direct Object Reference (IDOR) · medium
    77 votes
18. Employee-only Area BypassImproper Access Control - Generic · medium
    77 votes
19. Attackers can *Upgrade and claim offer* on the Premium Trial Subscription with a total price of *IDR0.00* from the original *IDR7,022,061.82*Business Logic Errors · high
    70 votes
20. Can access the job name, creator name and can report any draft/under review/rejected jobInsecure Direct Object Reference (IDOR) · medium
    65 votes
21. Users can access exams in course without having to subscribe to PREMIUMImproper Access Control - Generic · medium
    64 votes
22. User Details Can Be Disclosed Even If The Account IS In Hibernation StateInformation Disclosure · low
    57 votes
23. Blocking a company page admin prevents him from delete paid media admin or edit his rolesImproper Access Control - Generic · medium
    55 votes
24. Html injection in event Description Improper Input Validation · low
    55 votes
25. CSRF that makes any linkedin user follow attacker controlled accounts by simply clicking https://www.linkedin.com/comm/mynetwork/discovery-see-all/*Cross-Site Request Forgery (CSRF) · medium
    53 votes
26. IDOR - Delete technical skill assessment result & Gained Badges result of any userInsecure Direct Object Reference (IDOR) · medium
    48 votes
27. Privilege Escalation - "Analyst" Role Can View Email Domains of a Company - [GET /voyager/api/voyagerOrganizationDashEmailDomainMappings]Privilege Escalation · medium
    48 votes
28. Attackers do not need to Pay for a Subscription to get the `Discussion Group URL` in `Paid Learning`Insecure Direct Object Reference (IDOR) · medium
    44 votes
29. Anyone can view the results of linkedin skill test -if failed to earn a badge or if the badge earned is kept private: both cases results can be viewedInsecure Direct Object Reference (IDOR) · medium
    43 votes
30. CSRF that makes any user send invitations to the attacker by simply clicking on a link.Cross-Site Request Forgery (CSRF) · medium
    41 votes
31. bypass two-factor authentication.Improper Authentication - Generic · medium
    41 votes
32. Delete any LinkedIn comment on learning API of other usersImproper Access Control - Generic · medium
    41 votes
33. Deny Admin from Editing LinkedIn Company Page using Gen Form Visibility via POST /voyager/api/voyagerOrganizationDashCompanies/{id}Improper Access Control - Generic · medium
    34 votes
34. An Attacker Can Flag Draft Job Posts And Can Disclose The Draft Job Posts Details [ Similar to #1581528 Resolved Report]Business Logic Errors · medium
    34 votes
35. HTML injection at Company Name or Product Name and can be shown on Contact Sales formCross-site Scripting (XSS) - Generic · low
    32 votes
36. Ad Account TakeoverPrivilege Escalation · critical
    30 votes
37. “See who’s interested in working for your company” - security issueInformation Disclosure · medium
    28 votes
38. [ Continuation Report from #1814842 ] Can create articles using other users' NewsLettersInsecure Direct Object Reference (IDOR) · medium
    23 votes
39. Campaign Account Balance and History Disclosed in API ResponseInsecure Direct Object Reference (IDOR) · medium
    21 votes
40. Attacker can unpin posts from companies he's not part of.low
    20 votes