Browse / Localize

Localize

See its reports on the map

What gets reported to Localize

• Information Disclosure23
• Cross-site Scripting11
• Cross-Site Request Forgery10
• Misconfiguration6
• Authentication5
• Cryptography3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. 2-factor authentication can be disabled when logged in without confirming account passwordBusiness Logic Errors · medium
   159 votes
2. Stored XSS in Document TitleCross-site Scripting (XSS) - Generic · medium
   $50124 votes
3. open redirected by host headerDuplicateOpen Redirect
   73 votes
4. Stored XSS in Name of Team Member InvitationDuplicateCross-site Scripting (XSS) - Stored · low
   15 votes
5. The password limit is not set, [DoS].Improper Authentication - Generic · low
   13 votes
6. Business logic Failure - Browser cache management and logout vulnerability.Improper Authentication - Generic
   13 votes
7. Full Path Disclosure / Info Disclosure in Creating New GroupInformation Disclosure
   12 votes
8. CSRF in adding phrase.Cross-Site Request Forgery (CSRF)
   12 votes
9. XSS & HTML injectionCross-Site Request Forgery (CSRF)
   11 votes
10. XSS in invite approvalCross-site Scripting (XSS) - Generic
    10 votes
11. XSS in main pageCross-site Scripting (XSS) - Generic
    10 votes
12. XSS in GroupsCross-site Scripting (XSS) - Generic
    10 votes
13. Private Project Access Request Invitation Sent Via CSRF Cross-Site Request Forgery (CSRF)
    9 votes
14. Sign-up Form CSRFCross-Site Request Forgery (CSRF)
    9 votes
15. Nginx version is disclosed in HTTP responseDuplicateUncontrolled Resource Consumption
    7 votes
16. Possible sensitive filesDuplicateInformation Disclosure
    7 votes
17. XSS in main page (invitation)Cross-site Scripting (XSS) - Generic
    7 votes
18. Login page password-guessing attackDuplicateImproper Authentication - Generic
    6 votes
19. HTML/Javascript possible in "Discussion" section of reviewsCross-site Scripting (XSS) - Generic
    6 votes
20. Atttacker can send "Invitation Request" to a Project that is not even created yet!Improper Authentication - Generic
    5 votes
21. Numerous open ports/servicesInformation Disclosure
    5 votes
22. Apache DocumentationInformation Disclosure
    5 votes
23. XSS in passwordCross-site Scripting (XSS) - Generic
    5 votes
24. Sensitive fileViolation of Secure Design Principles
    5 votes
25. Bug on registration as new Translator user
    4 votes
26. missing sender policy framework (SPF)Violation of Secure Design Principles
    4 votes
27. XSS in Team Only AreaCross-site Scripting (XSS) - Generic
    4 votes
28. Full Path Disclosure (FPD) in www.localize.imInformation Disclosure
    4 votes
29. Full Path DisclosureInformation Disclosure
    4 votes
30. Password type input with auto-complete enabledInformativeImproper Authentication - Generic
    4 votes
31. A Serious Bug on SIGNUP Process!Memory Corruption - Generic
    4 votes
32. Information Disclosure (Directory Structure)Information Disclosure
    4 votes
33. Apache2 /icons/ folder accessibleInformation Disclosure
    4 votes
34. Uninitialized variable error message leaks information Information Disclosure
    4 votes
35. Path Disclosure (Info Disclosure) in http://www.localize.ioInformation Disclosure
    4 votes
36. XSS in Localize.ioCross-site Scripting (XSS) - Generic
    4 votes
37. Unexpected array leaks information about the systemInformation Disclosure
    4 votes
38. PHP PDOException and Full Path DisclosureInformation Disclosure
    3 votes
39. full path disclosure from false languageInformation Disclosure
    3 votes
40. Full Path Disclosure (FPD) in www.localize.imInformation Disclosure
    3 votes
41. Criptographic Issue: Strisct Transport Security with not good max age..(TOO SHORT!)Cryptographic Issues - Generic
    3 votes
42. Projects Watch or Notifications Settings Change Via CSRFCross-Site Request Forgery (CSRF)
    3 votes
43. OPTIONS Method Enabled
    3 votes
44. Deleting groups in any project without permission Privilege Escalation
    3 votes
45. Making groups in any project without permission Privilege Escalation
    3 votes
46. infinite number of new project creation!Memory Corruption - Generic
    3 votes
47. Full Path Disclosure / Info Disclosure in Importing XML Section!Information Disclosure
    3 votes
48. Full Path Disclosure (FPD) in www.localize.ioInformation Disclosure
    3 votes
49. Full Path Disclosure (2)Information Disclosure
    3 votes
50. Assigning a non-existing role to user causes exception when opening project pageUncontrolled Resource Consumption
    3 votes
51. No Cross-Site Request Forgery protection at multiple locationsCross-Site Request Forgery (CSRF)
    3 votes
52. Server header - information disclosure Information Disclosure
    3 votes
53. Full path disclosureInformation Disclosure
    3 votes
54. Stored XSSCross-site Scripting (XSS) - Generic
    3 votes
55. HTML Form Without CSRF protectionCryptographic Issues - Generic
    3 votes
56. files likes of README.md is publicInformation Disclosure
    2 votes
57. PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.Information Disclosure
    2 votes
58. PHP PDOException and Full Path DisclosureInformation Disclosure
    2 votes
59. No Wildcard DNSViolation of Secure Design Principles
    2 votes
60. Private Project Access Request Accpeted Via CSRF Cross-Site Request Forgery (CSRF)
    2 votes
61. Group Deletion Via CSRFCross-Site Request Forgery (CSRF)
    2 votes
62. Group Creation Via CSRFCross-Site Request Forgery (CSRF)
    2 votes
63. X-Content-Type-Options header missingViolation of Secure Design Principles
    2 votes
64. User credentials are sent in clear textInformativeInformation Disclosure
    2 votes
65. Password PolicyViolation of Secure Design Principles
    2 votes
66. Change user settings through CSRFCross-Site Request Forgery (CSRF)
    2 votes
67. No BruteForce ProtectionCryptographic Issues - Generic
    2 votes
68. ClickJackingUI Redressing (Clickjacking)
    2 votes