Browse / Localize

Localize

See its reports on the map

What gets reported to Localize

• Information Disclosure23
• Cross-site Scripting11
• Cross-Site Request Forgery10
• Misconfiguration6
• Authentication5
• Cryptography3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. 2-factor authentication can be disabled when logged in without confirming account passwordBusiness Logic Errors · medium
   159 votes
2. Stored XSS in Document TitleCross-site Scripting (XSS) - Generic · medium
   $50124 votes
3. The password limit is not set, [DoS].Improper Authentication - Generic · low
   13 votes
4. Business logic Failure - Browser cache management and logout vulnerability.Improper Authentication - Generic
   13 votes
5. Full Path Disclosure / Info Disclosure in Creating New GroupInformation Disclosure
   12 votes
6. CSRF in adding phrase.Cross-Site Request Forgery (CSRF)
   12 votes
7. XSS & HTML injectionCross-Site Request Forgery (CSRF)
   11 votes
8. XSS in invite approvalCross-site Scripting (XSS) - Generic
   10 votes
9. XSS in main pageCross-site Scripting (XSS) - Generic
   10 votes
10. XSS in GroupsCross-site Scripting (XSS) - Generic
    10 votes
11. Private Project Access Request Invitation Sent Via CSRF Cross-Site Request Forgery (CSRF)
    9 votes
12. Sign-up Form CSRFCross-Site Request Forgery (CSRF)
    9 votes
13. XSS in main page (invitation)Cross-site Scripting (XSS) - Generic
    7 votes
14. HTML/Javascript possible in "Discussion" section of reviewsCross-site Scripting (XSS) - Generic
    6 votes
15. Atttacker can send "Invitation Request" to a Project that is not even created yet!Improper Authentication - Generic
    5 votes
16. Numerous open ports/servicesInformation Disclosure
    5 votes
17. Apache DocumentationInformation Disclosure
    5 votes
18. XSS in passwordCross-site Scripting (XSS) - Generic
    5 votes
19. Sensitive fileViolation of Secure Design Principles
    5 votes
20. Bug on registration as new Translator user
    4 votes
21. missing sender policy framework (SPF)Violation of Secure Design Principles
    4 votes
22. XSS in Team Only AreaCross-site Scripting (XSS) - Generic
    4 votes
23. Full Path Disclosure (FPD) in www.localize.imInformation Disclosure
    4 votes
24. Full Path DisclosureInformation Disclosure
    4 votes
25. A Serious Bug on SIGNUP Process!Memory Corruption - Generic
    4 votes
26. Information Disclosure (Directory Structure)Information Disclosure
    4 votes
27. Apache2 /icons/ folder accessibleInformation Disclosure
    4 votes
28. Uninitialized variable error message leaks information Information Disclosure
    4 votes
29. Path Disclosure (Info Disclosure) in http://www.localize.ioInformation Disclosure
    4 votes
30. XSS in Localize.ioCross-site Scripting (XSS) - Generic
    4 votes
31. Unexpected array leaks information about the systemInformation Disclosure
    4 votes
32. PHP PDOException and Full Path DisclosureInformation Disclosure
    3 votes
33. full path disclosure from false languageInformation Disclosure
    3 votes
34. Full Path Disclosure (FPD) in www.localize.imInformation Disclosure
    3 votes
35. Criptographic Issue: Strisct Transport Security with not good max age..(TOO SHORT!)Cryptographic Issues - Generic
    3 votes
36. Projects Watch or Notifications Settings Change Via CSRFCross-Site Request Forgery (CSRF)
    3 votes
37. OPTIONS Method Enabled
    3 votes
38. Deleting groups in any project without permission Privilege Escalation
    3 votes
39. Making groups in any project without permission Privilege Escalation
    3 votes
40. infinite number of new project creation!Memory Corruption - Generic
    3 votes
41. Full Path Disclosure / Info Disclosure in Importing XML Section!Information Disclosure
    3 votes
42. Full Path Disclosure (FPD) in www.localize.ioInformation Disclosure
    3 votes
43. Full Path Disclosure (2)Information Disclosure
    3 votes
44. Assigning a non-existing role to user causes exception when opening project pageUncontrolled Resource Consumption
    3 votes
45. No Cross-Site Request Forgery protection at multiple locationsCross-Site Request Forgery (CSRF)
    3 votes
46. Server header - information disclosure Information Disclosure
    3 votes
47. Full path disclosureInformation Disclosure
    3 votes
48. Stored XSSCross-site Scripting (XSS) - Generic
    3 votes
49. HTML Form Without CSRF protectionCryptographic Issues - Generic
    3 votes
50. files likes of README.md is publicInformation Disclosure
    2 votes
51. PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.Information Disclosure
    2 votes
52. PHP PDOException and Full Path DisclosureInformation Disclosure
    2 votes
53. No Wildcard DNSViolation of Secure Design Principles
    2 votes
54. Private Project Access Request Accpeted Via CSRF Cross-Site Request Forgery (CSRF)
    2 votes
55. Group Deletion Via CSRFCross-Site Request Forgery (CSRF)
    2 votes
56. Group Creation Via CSRFCross-Site Request Forgery (CSRF)
    2 votes
57. X-Content-Type-Options header missingViolation of Secure Design Principles
    2 votes
58. Password PolicyViolation of Secure Design Principles
    2 votes
59. Change user settings through CSRFCross-Site Request Forgery (CSRF)
    2 votes
60. No BruteForce ProtectionCryptographic Issues - Generic
    2 votes
61. ClickJackingUI Redressing (Clickjacking)
    2 votes