HexBrain
Sign in

Browse / Mozilla

Mozilla

68disclosed reports
$44,650paid in bounties

See its reports on the map

What gets reported to Mozilla

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)Code Injection · critical
    $12,000361 votes
  2. IDOR: Account Deletion via Session Misbinding – Attacker Can Delete Victim AccountInsecure Direct Object Reference (IDOR) · high
    244 votes
  3. Mozilla VPN Clients: RCE via file write and path traversalPath Traversal · high
    $6,000173 votes
  4. Netlify Authentication Token Exposed in Public Mozilla CI LogsInformation Disclosure · critical
    123 votes
  5. [Hubs] - Broken access control in placing objects in hubs roomImproper Access Control - Generic · medium
    99 votes
  6. Bypass "No Links" Restriction in Biography via Protocol-Relative URL (//)Improper Input Validation · low
    98 votes
  7. Bypass of Restricted Keyword "Mozilla" in Display Name Field via Unicode Homoglyphs on addons.allizom.orgImproper Input Validation · low
    $50093 votes
  8. Bypass Email Verification on Add Email MonitoringInformation Disclosure · medium
    93 votes
  9. SQL Injection on prod.oidc-proxy.prod.webservices.mozgcp.net via invite_code parameter - Mozilla social inscriptionSQL Injection · critical
    93 votes
  10. Bypass Email verification for monitoring at `monitor.mozilla.org`Business Logic Errors · medium
    85 votes
  11. Microsoft `x-apikey` Exposed in Mozilla CI Public LogsCleartext Storage of Sensitive Information · medium
    $20084 votes
  12. IDOR on Delete Email address featuresInsecure Direct Object Reference (IDOR) · high
    84 votes
  13. Subdomain takeover on one of the subdomain under mozaws.netMisconfiguration · medium
    79 votes
  14. Subdomain takeover on a subdomain under firefox.comMisconfiguration · medium
    $50075 votes
  15. two aws access key and secret key and database username and password exposed Information Disclosure · critical
    71 votes
  16. Leakage of traffic in plaintext towards the IP address of VPN serverCleartext Transmission of Sensitive Information · low
    67 votes
  17. [ addons-preview-cdn.mozilla.net ] A subdomain takeover is available via unregistered domain in FastlyMisconfiguration · medium
    $50066 votes
  18. Jira Credential Disclosure within Mozilla SlackInformation Disclosure · critical
    $1,00065 votes
  19. Exposure of account recovery hint by querying by user emailExposure of Sensitive Information Due to Incompatible Policies · low
    $25064 votes
  20. After the upload of an private file, using transformations, the file becomes public without the possibility of changing it.Improper Access Control - Generic · medium
    $1,00064 votes
  21. csrftoken not unique to session or specific user and csrfmiddlewaretoken can be alteredCross-Site Request Forgery (CSRF) · low
    $50063 votes
  22. Stored XSS on the public Pontoon dashboards: the latest-activity tooltip re-parses a contributor's account address as HTMLCross-site Scripting (XSS) - Stored · high
    $3,00061 votes
  23. Security bug https://bugzilla.mozilla.org/oauth/authorize - CRLF Header injection via "redirect_uri" parameterCRLF Injection · low
    $20061 votes
  24. MozillaVPN: Elevation of Privilege via a Logic VulnerabilityImproper Link Resolution Before File Access ('Link Following') · medium
    60 votes
  25. [Privilege Escalation] User can Pin|Unpin Any Comment on Any Project or LocalePrivilege Escalation · low
    59 votes
  26. Remote code execution and exfiltration of secret tokens by poisoning the mozilla/fxa CI build cacheCode Injection · critical
    $8,00058 votes
  27. Insecure S3 Bucket Exposing Git Directory in Mozilla Foundation Infographics ProjectImproper Access Control - Generic · low
    56 votes
  28. RCE on worker host due to unsanitized "env" variable name in task definition on community-tc.services.mozilla.comCode Injection · low
    $50056 votes
  29. DOS via cache poisoning on [developer.mozilla.org]Cache Poisoning · low
    55 votes
  30. Account deletion using the /v1/account/destroy API endpoint using account password without 2FA verificationImproper Authentication - Generic · medium
    $1,00053 votes
  31. Internal Blind Server-Side Request Forgery (SSRF) allows scanning internal portsInformativeServer-Side Request Forgery (SSRF)
    53 votes
  32. Private Emails of Moz Workers Leaked in Public fileInformativeImproper Access Control - Generic
    52 votes
  33. Subdomain takeover on one of the subdomains under mozaws.netMisconfiguration · medium
    52 votes
  34. sentry Auth Token exposed publicly in docker hub image Information Disclosure
    51 votes
  35. Race condition leads to add more than 5 email at Data breaches monitor system at https://stage.firefoxmonitor.nonprod.cloudops.mozgcp.netConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · low
    50 votes
  36. Subdomain takeover on one of the subdomain under mozaws.netMisconfiguration · medium
    49 votes
  37. Mozilla FuzzManager API Token Exposed in Git CommitCleartext Storage of Sensitive Information · critical
    49 votes
  38. Leaking VPN traffic through non-RFC1918 local IP addressesCleartext Transmission of Sensitive Information · medium
    49 votes
  39. User API Key leakage in Github commit leads to unauthorized access to sql.telemetry.mozilla.orgInformation Disclosure · high
    47 votes
  40. [Vertical Privilege Escalation] User can Unapproved any Approved Translation at [/translations/unapprove/]Privilege Escalation · medium
    46 votes
  41. Information disclosure on password cancel endpoint Information Disclosure · low
    46 votes
  42. Subdomain takeover on one of the subdomain under mozaws.netMisconfiguration · medium
    44 votes
  43. Taskcluster web-server OAuth2 authorization codes are reusable and the exchange handler checks the wrong expiry columnAuthentication Bypass by Capture-replay · medium
    $2,00043 votes
  44. Potential Spoofing Risk through Firefox Private Relay ServiceContent Spoofing · medium
    $1,00043 votes
  45. paypal client_id And stripe api key indexed on web archiveInformation Disclosure
    42 votes
  46. Mozilla Employee's Token for sql.telemetry.mozilla.org Exposed in Git CommitCleartext Storage of Sensitive Information · critical
    42 votes
  47. HTML Injection at https://stage.firefoxmonitor.nonprod.cloudops.mozgcp.net/user/unsubscribeCross-Site Scripting (XSS) · low
    $50042 votes
  48. MozillaVPN: Elevation of Privilege via a Race Condition VulnerabilityConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · medium
    41 votes
  49. Subdomain takeover on one of the subdomain under mozaws.netMisconfiguration · medium
    41 votes
  50. Subdomain takeover on one of the subdomain under mozaws.netMisconfiguration · medium
    40 votes
  51. Subdomain takeover on one of the subdomain under mozgcp.netMisconfiguration · medium
    39 votes
  52. CSRF to Information disclosure on password resetCross-Site Request Forgery (CSRF) · low
    39 votes
  53. User Can Delete Other Users' Personal Access Tokens at /delete-token/{token_id}/ on Mozilla PontoonImproper Access Control - Generic · low
    38 votes
  54. Subdomain takeover on one of the subdomain under mozaws.netMisconfiguration · medium
    37 votes
  55. Subdomain takeover on one of the subdomains under mozaws.netMisconfiguration · medium
    34 votes
  56. A disabled account's API key still works on BMO's Mojolicious /rest/ routes, including for security-group bugs filed after the disableImproper Authentication - Generic · high
    $4,00032 votes
  57. Possibility of Deface through translation tool - www.mozilla.comInformation Disclosure · low
    30 votes
  58. Subdomain takeover on one of the subdomain under mozgcp.netMisconfiguration · medium
    29 votes
  59. Subdomain takeover on one of the subdomain under mozaws.netImproper Resource Shutdown or Release · medium
    26 votes
  60. Denial of Access to Static Resources via Cache Poisoning on addons.allizom.orgCache Poisoning · low
    24 votes
  61. Flickr API key leaked in GitHub commitInformation Disclosure · low
    24 votes
  62. Subdomain takeover on one of the subdomain under mozgcp.netMisconfiguration · medium
    22 votes
  63. Email user account in indexacao waybackurlBrute Force · medium
    $1,00018 votes
  64. HTML Injection / Reflected Cross-Site Scripting with CSP on https://accounts.firefox.com/settingsImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · medium
    $1,00018 votes
  65. Subdomain takeover on one of the subdomain under mozgcp.netMisconfiguration · medium
    8 votes
  66. Subdomain takeover on one of the subdomain under mozaws.netMisconfiguration · medium
    4 votes
  67. Subdomain takeover on one of the subdomain under mozaws.netMisconfiguration · medium
    3 votes
  68. Subdomain takeover on one of the subdomain under mozaws.netMisconfiguration · medium
    3 votes