Browse / Phabricator

Phabricator

See its reports on the map

What gets reported to Phabricator

• Access Control12
• Information Disclosure12
• Authentication11
• Misconfiguration7
• Cross-site Scripting6
• Cross-Site Request Forgery6

Most upvoted reports

AllValidInformativeN/ADuplicate

1. The special code in editor has no Authority control and can lead to Information DisclosureInformativeInformation Disclosure · medium
   5 votes
2. Enumerating emails through "Forgot Password" formInformativeViolation of Secure Design Principles
   5 votes
3. Content Spoofing through URLInformativeViolation of Secure Design Principles
   5 votes
4. Password Reset Links Not ExpiringInformativeImproper Authentication - Generic
   4 votes
5. Edit Policy restriction does not prevent comments.InformativeImproper Access Control - Generic · medium
   3 votes
6. Restricted file access when it exists in old versions of task or wiki documentInformativeViolation of Secure Design Principles
   3 votes
7. No authentication required to add an email address.InformativeImproper Authentication - Generic
   3 votes
8. Server Side Request Forgery in macro creationInformativeInformation Disclosure
   3 votes
9. Content spoofingInformativeCross-site Scripting (XSS) - Generic
   3 votes
10. Password Policy issueInformativeViolation of Secure Design Principles
    3 votes
11. Back - Refresh - Attack To Obtain User CredentialsInformativeInformation Disclosure
    3 votes
12. An unsafe design practice in the Passphrase may result in Secret being accidentally changed.InformativeViolation of Secure Design Principles · high
    2 votes
13. Content injection InformativeViolation of Secure Design Principles
    2 votes
14. CSRF token valid even after the session logout of a particular userInformativeCross-Site Request Forgery (CSRF)
    2 votes
15. The "Download Raw Diff" URL is viewable by everyoneInformativeInformation Disclosure · low
    1 votes
16. Credential gets exposedInformativeInformation Disclosure · low
    1 votes
17. Hyper Link Injection In email and Space Characters Allowed at Password Field.InformativeImproper Authentication - Generic · medium
    1 votes
18. Full path disclosureInformativeInformation Disclosure
    1 votes