Browse / Nord Security

Nord Security

See its reports on the map

What gets reported to Nord Security

• Information Disclosure10
• Access Control10
• Authentication6
• Misconfiguration6
• Denial of Service3
• Open Redirect2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. IDOR allow access to payments data of any userInsecure Direct Object Reference (IDOR)
   387 votes
2. Connection informaton is sent to a third-party servicePrivacy Violation
   332 votes
3. Password Reset Link Leaked In Refer Header In Request To Third Party Sites Cleartext Transmission of Sensitive Information
   215 votes
4. Incorrect control of the trial periodClient-Side Enforcement of Server-Side Security
   188 votes
5. xmlrpc.php FILE IS enable it will used for Bruteforce attack and Denial of Service(DoS)Uncontrolled Resource Consumption
   162 votes
6. Possible RCE through Windows Custom Protocol on Windows clientOS Command Injection
   120 votes
7. Getting SmartDNS for free from - join.nordvpn.comImproper Authentication - Generic
   104 votes
8. User data not anonymized is sent to analytics serverPrivacy Violation
   100 votes
9. No Rate Limit On Forgot Password Page Of NordVPNImproper Authentication - Generic
   99 votes
10. Version problem in wordpress leads to the many vulnearability
    96 votes
11. Disclosure of User InformationInformation Disclosure
    88 votes
12. User password left in memory in plain text after GUI launchViolation of Secure Design Principles
    82 votes
13. Open redirectOpen Redirect
    81 votes
14. DoS of https://nordvpn.com/ via CVE-2018-6389 exploitationUncontrolled Resource Consumption
    73 votes
15. CSRF to change passwordCross-Site Request Forgery (CSRF)
    71 votes
16. Blind SSRF on debug.nordvpn.com due to misconfigured sentry instanceServer-Side Request Forgery (SSRF)
    70 votes
17. Potential leak of server side software at repogohi.nordvpn.comImproper Access Control - Generic
    52 votes
18. Vulnerabilities chain leading to privilege escalationPrivilege Escalation
    42 votes
19. NordVPN Linux Client - Unsafe service file permissions leads to Local Privilege EscalationPrivilege Escalation
    40 votes
20. Subscription check bypass of NordVPN service Improper Authorization
    31 votes
21. Expired Available Domains in nordvpn.com website codePrivacy Violation
    29 votes
22. Password Reset Link Works Multiple TimesImproper Access Control - Generic
    26 votes
23. Unauthorized User Can Delete Any User AccountPrivacy Violation
    25 votes
24. CORS Misconfiguration on nordvpn.com leading to Private Information Disclosure,Account takeoverImproper Access Control - Generic
    21 votes
25. Reflected XSS via IECross-site Scripting (XSS) - Reflected
    20 votes
26. Arbitrary Set-Cookie via "?coupon=" due to semi-colon not encodedViolation of Secure Design Principles
    18 votes
27. Race condition (TOCTOU) in NordVPN can result in local privilege escalationImproper Access Control - Generic
    18 votes
28. Denial of Service with Cookie BombUncontrolled Resource Consumption
    17 votes
29. Clickjacking at join.nordvpn.comUI Redressing (Clickjacking)
    17 votes
30. Html Injection and Possible XSS in main nordvpn.com domainCross-site Scripting (XSS) - Reflected
    16 votes
31. Sensitive Information Disclosure on https://nordvpn.com/Information Disclosure
    14 votes
32. No Rate Limit On Forgot Password Page Of affiliates.nordvpn.comImproper Authentication - Generic
    12 votes
33. NordVPN Android Application privacy violation due to Google Advertising Identifier misusePrivacy Violation
    11 votes
34. Hard-coded API keys at NordVpn Android AppUse of Hard-coded Credentials
    11 votes
35. Misconfigured web directory allows to retrieve public proxy listInformation Disclosure
    11 votes
36. Host header injection/redirection | signup and login pageOpen Redirect
    11 votes
37. Past payments using the Direct Debit method keep subscriptions active even if payments failBusiness Logic Errors
    9 votes
38. Account deletion requests not entirely honoured. Misinformation even after seeking clarification from customer support.Privacy Violation
    8 votes
39. Password Reset Link not expiring after changing the email Leads To Account TakeoverImproper Authentication - Generic
    8 votes
40. Email address is not validated, No Rate Limit and RCE On Forgot Password Page Of affiliates.nordvpn.comImproper Authentication - Generic
    7 votes
41. Reduced Payment amount while paying on Crypto CurrenciesImproper Access Control - Generic
    5 votes
42. UI Redressing (Clickjacking) vulnerability UI Redressing (Clickjacking)
    5 votes
43. The Linux binaries (nordvpn and nordvpnd) don't use PIE/ASLRViolation of Secure Design Principles
    3 votes
44. Cross Origin Resource Sharing Misconfiguration | Lead to sensitive informationImproper Access Control - Generic
    3 votes
45. nordvpn Linux Desktop executable application does not use pie / no ASLRViolation of Secure Design Principles
    1 votes