Browse / Shipt

Shipt

See its reports on the map

What gets reported to Shipt

• Misconfiguration4
• Information Disclosure2
• Access Control2
• Cryptography1
• Other weaknesses1
• Business Logic1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Multiple Subdomain Takeovers: fly.staging.shipt.com, fly.us-west-2.staging.shipt.com, fly.us-east-1.staging.shipt.comReliance on Reverse DNS Resolution for a Security-Critical Action
   128 votes
2. Slack token leaking in stackoverflow and devtimes Cleartext Storage of Sensitive Information
   $300113 votes
3. Improper Access Control + Financial fraud allows attacker to disclose + add arbitrary products to another's user's order Improper Access Control - Generic
   $3,90079 votes
4. Subdomain Takeover at test.shipt.comMisconfiguration
   $75073 votes
5. Sensitive Clickjacking on admin login page.UI Redressing (Clickjacking)
   55 votes
6. Vulnerabilities in exported activity WebView
   $35042 votes
7. Price manipulation via fraction values (Parameter Tampering)Business Logic Errors
   $10034 votes
8. Api Token Leaked in [shoppers.shipt.com]Information Disclosure
   $20027 votes
9. Subdomain takeover at segway.shipt.comMisconfiguration
   $30023 votes
10. Open redirect on marketing siteOpen Redirect
    17 votes
11. Any user can completely delete their own account without authorization and/or going through any kind of membership cancellation protocol.Improper Access Control - Generic
    16 votes
12. bypass the [OKTA] login redirect can lead to disclosing limited-information about the sub-domain at [ shiptsec.com ]Violation of Secure Design Principles
    11 votes