HexBrain
Sign in

Browse / Reddit

Reddit

72disclosed reports
$50,700paid in bounties

See its reports on the map

What gets reported to Reddit

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comImproper Access Control - Generic · critical
    509 votes
  2. [accounts.reddit.com] Redirect parameter allows for XSSCross-site Scripting (XSS) - Generic · high
    $5,000394 votes
  3. Blind SSRF to internal services in matrix preview_link APIServer-Side Request Forgery (SSRF) · high
    $6,000344 votes
  4. Exposed proxy allows to access internal reddit domainsImproper Access Control - Generic · high
    $7,500296 votes
  5. RichText parser vulnerability in scheduled posts allows XSSCross-site Scripting (XSS) - Stored · high
    $5,000280 votes
  6. Deleting all DMs on RedditGifts.comInsecure Direct Object Reference (IDOR) · high
    $5,000267 votes
  7. Infromation Disclosure To Use of Hard-coded Cryptographic KeyDuplicateUse of Hard-coded Cryptographic Key · medium
    238 votes
  8. XSS via Mod Log Removed PostsCross-site Scripting (XSS) - Stored · high
    218 votes
  9. IDOR allows an attacker to modify the links of any userInsecure Direct Object Reference (IDOR) · high
    208 votes
  10. Able to bypass email verification and change email to any other user email Improper Access Control - Generic · high
    $5,000200 votes
  11. Able to approve admin approval and change effective status without adding payment details . Business Logic Errors · high
    $5,000191 votes
  12. Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.Improper Access Control - Generic · high
    186 votes
  13. Reflected xss in https://sh.reddit.comCross-site Scripting (XSS) - Reflected · high
    $5,000166 votes
  14. Getting access of mod logs from any public or restricted subreddit with IDOR vulnerabilityInsecure Direct Object Reference (IDOR) · high
    $5,000163 votes
  15. XSS Reflected on reddit.com via url pathCross-site Scripting (XSS) - Reflected · high
    157 votes
  16. Regression on dest parameter sanitization doesn't check scheme/websafe destinationsCross-site Scripting (XSS) - Reflected · medium
    $500101 votes
  17. s3 bucket takeover presented in https://github.com/reddit/rpan-studio/blob/e1782332c75ecb2f774343258ff509788feab7ce/CI/full-build-macos.shBusiness Logic Errors · high
    96 votes
  18. Reddit talk promotion offers don't expire, allowing users to accept them after being demotedInsecure Direct Object Reference (IDOR) · medium
    72 votes
  19. GPS metadata preserved when converting HEIF to PNGPrivacy Violation · high
    67 votes
  20. Image queue default key of 'None' and GraphQL unhandled type exceptionType Confusion · medium
    $50065 votes
  21. Outsider can affect Upvote Percentage of private subreddit post by calling /api/vote APIImproper Access Control - Generic · low
    52 votes
  22. IDOR lets a malicious user reveal the unpinned achievement badges of any Reddit userInformativeInsecure Direct Object Reference (IDOR) · low
    47 votes
  23. CSRF (protection bypassed) to force a below 18 user into viewing an nsfw subreddit !Cross-Site Request Forgery (CSRF) · medium
    47 votes
  24. Hash-Collision Denial-of-Service Vulnerability in Markdown ParserUncontrolled Resource Consumption · medium
    44 votes
  25. IDOR to pay less for coin purchases on oauth.reddit.com via /api/v2/gold/paypal/create_coin_purchase_order in `order_id` parameter Business Logic Errors · medium
    $50042 votes
  26. Race condition leads to Inflation of coins when bought via Google Play Store at endpoint https://oauth.reddit.com/api/v2/gold/android/verify_purchase Time-of-check Time-of-use (TOCTOU) Race Condition · medium
    42 votes
  27. Open Redirect on www.redditinc.com via `failed` query paramOpen Redirect · medium
    41 votes
  28. Weak rate limit could lead to ATO due to weak password protection mechanismsImproper Restriction of Authentication Attempts · low
    39 votes
  29. Unrestricted File Upload on reddit.secure.force.comImproper Access Control - Generic · low
    $10034 votes
  30. [dubsmash] Long String in 'shoutout' Parameter Leading Internal server Error on Popular hastags , Community and User ProfileUncontrolled Resource Consumption · high
    33 votes
  31. Third party app could steal access token as well as protected files using inAppBrowserInformation Disclosure · medium
    32 votes
  32. No Rate Limit on redditgifts gift when Adding CommentViolation of Secure Design Principles · low
    25 votes
  33. Open Redirect on www.redditinc.com via `failed` query param bypass after fixed bug #1257753Open Redirect · medium
    21 votes
  34. Oauth Misconfiguration Lead To Account TakeoverDuplicateImproper Authorization · medium
    21 votes
  35. [dubmash] Lack of authorization checks - Update Sound TitlesImproper Authorization · high
    21 votes
  36. Can use the Reddit android app as usual even though revoking the access of it from reddit.comInformativeInsufficient Session Expiration · critical
    20 votes
  37. Domain Takeover of Reddit.ru via DNS HijackingImproper Access Control - Generic · medium
    $50020 votes
  38. Misconfigurated login page able to lock login action for any account without user interactionInformativeImproper Authentication - Generic · critical
    19 votes
  39. Moderators can send messages to users from banned subreddits via `oauth.reddit.com/api/mod/conversations`Improper Input Validation · low
    $10019 votes
  40. [dubsmash] Username and password bruteforceImproper Restriction of Authentication Attempts · low
    18 votes
  41. api keys leakedInformativeImproper Access Control - Generic · medium
    16 votes
  42. read and message other user's messagesN/AInsecure Direct Object Reference (IDOR) · critical
    14 votes
  43. Missing rate limit in current password change settings leads to Account takeoverDuplicateImproper Restriction of Authentication Attempts · medium
    13 votes
  44. oauth misconfigration lead to account takeoverInformativeIncorrect Authorization
    11 votes
  45. HTML injection in API response including request urlInformativeRemote File Inclusion · critical
    11 votes
  46. No rate limit leads to spaming postDuplicateImproper Authentication - Generic · medium
    11 votes
  47. Application level DOS at Login Page ( Accepts Long Password )InformativeImproper Authentication - Generic · high
    11 votes
  48. registering with the same email address multiple times leads to account takeover InformativeImproper Authentication - Generic · low
    11 votes
  49. Open Redirect through POST Request in www.redditinc.comInformativeOpen Redirect · medium
    10 votes
  50. XSSN/ACross-site Scripting (XSS) - Generic
    10 votes
  51. critical file found etc/passwd on www.reddit.comN/AInformation Disclosure · high
    10 votes
  52. XSS in redditmedia.com can compromise data of reddit.comN/ACross-site Scripting (XSS) - Stored · medium
    10 votes
  53. Rate limit is implemented in Reddit , but its not working . DuplicateImproper Authentication - Generic · low
    9 votes
  54. User Account has been taken outDuplicateWeak Cryptography for Passwords · critical
    9 votes
  55. Huge amount of Subdomains Takeovers at Reddit.comDuplicateImproper Access Control - Generic · medium
    8 votes
  56. hardcoded api secret & api key in com.reddit.frontpageInformativeImproper Authentication - Generic · critical
    8 votes
  57. No Rate limit on change password leads to account takeoverDuplicateImproper Restriction of Authentication Attempts · low
    8 votes
  58. Regular Expression Denial of Service vulnerabilityInformativeUncontrolled Resource Consumption · medium
    6 votes
  59. Broken links make users from France unable to understand the allowed content policyInformative
    6 votes
  60. sensitive data exposureN/AInsecure Storage of Sensitive Information · high
    5 votes
  61. Broken Authendication And Session ManagementN/AImproper Access Control - Generic
    5 votes
  62. Reflected XSS via File UploadN/ACross-site Scripting (XSS) - Reflected · medium
    4 votes
  63. S3 bucket Upload on studio.redditinc.com (s3-r-w.ap-east-1.amazonaws.com)InformativeImproper Access Control - Generic · low
    4 votes
  64. CVE-2020-11022N/ACross-site Scripting (XSS) - Reflected · medium
    3 votes
  65. Email Verification Bypass And Get access to user's private invitation.N/ABusiness Logic Errors · medium
    3 votes
  66. Several Subdomains TakeoverN/Ahigh
    2 votes
  67. No rate limit on password reset leads to email enumeration at gateway-production.dubsmash.com Improper Restriction of Authentication Attempts
    2 votes
  68. com.reddit.frontpage vulernable to Task Hijacking (aka StrandHogg Attack)DuplicatePhishing · medium
    2 votes
  69. No Password Length Restriction leads to Denial of ServiceDuplicateUncontrolled Resource Consumption
    2 votes
  70. Vulnerability Name: URL Redirection / Unvalidate Open RedirectN/AOpen Redirect
    2 votes
  71. Content Spoofing/Text Injection at https://gateway-production.dubsmash.comN/AUser Interface (UI) Misrepresentation of Critical Information
    1 votes
  72. Content SpoofingN/APhishing · low
    1 votes