Browse / Slack

Slack

See its reports on the map

What gets reported to Slack

• Cross-site Scripting33
• Misconfiguration17
• Authentication16
• Information Disclosure12
• Code Execution11
• Access Control10

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesHTTP Request Smuggling · critical
   870 votes
2. Remote Code Execution in Slack desktop apps + bonusCode Injection · critical
   509 votes
3. XSS vulnerable parameter in a location hashCross-site Scripting (XSS) - Generic
   455 votes
4. URL link spoofingPhishing · low
   $250362 votes
5. TURN server allows TCP and UDP proxying to internal network, localhost and meta-data servicesServer-Side Request Forgery (SSRF) · critical
   $3,500323 votes
6. AWS bucket leading to iOS test build code and configuration exposureInformation Disclosure · critical
   $1,500321 votes
7. Slack DTLS uses a private key that is in the public domain, which may lead to SRTP stream hijackUse of Hard-coded Cryptographic Key · high
   $2,000170 votes
8. XSS in gist integrationCross-site Scripting (XSS) - Generic
   $500157 votes
9. Unauthenticated LFI revealing log informationInformation Disclosure · high
   123 votes
10. Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domainViolation of Secure Design Principles
    120 votes
11. Ability to join an arbitrary workspace by utilizing a proxy to manipulate invite linksImproper Authentication - Generic · critical
    109 votes
12. Denial of Service via Hyperlinks in PostsUncontrolled Resource Consumption · medium
    $1,500109 votes
13. SSRF via Office file thumbnailsInformation Disclosure · critical
    $4,000109 votes
14. Team members can trigger arbitrary code execution in Slack Desktop Apps via HTML NotificationsCode Injection · high
    107 votes
15. Stored XSS on team.slack.com using new Markdown editor of posts inside the Editing mode and using javascript-URIsCross-site Scripting (XSS) - Generic
    103 votes
16. Tricking the "Create snippet" feature into displaying the wrong filetype can lead to RCE on Slack usersUnrestricted Upload of File with Dangerous Type · high
    $1,500101 votes
17. Lack of URL normalization renders Blocked-Previews feature ineffectualSecurity Through Obscurity · medium
    $1,000100 votes
18. Real Time Error Logs Through Debug InformationInformation Exposure Through Debug Information · high
    100 votes
19. Header modification results in disclosure of Slack infra metadata to unauthorized partiesServer-Side Request Forgery (SSRF) · medium
    97 votes
20. User-assisted RCE in Slack for macOS (from official site) due to improper quarantine meta-attribute handling for downloaded filesCode Injection · high
    97 votes
21. Many Slack teams can be joined by abusing an improperly configured support@ inboxImproper Authentication - Generic
    88 votes
22. Bypass invite accept for victimBusiness Logic Errors · medium
    84 votes
23. SSRF in api.slack.com, using slash commands and bypassing the protections.Server-Side Request Forgery (SSRF) · medium
    84 votes
24. Unauthorized access to GovSlackImproper Authentication - Generic · medium
    $1,50081 votes
25. Stored XSS through PDF viewerCross-site Scripting (XSS) - Stored · high
    $4,87576 votes
26. OSX slack:// protocol handler javascript injectionCommand Injection - Generic
    72 votes
27. Eavesdropping on private Slack callsImproper Authentication - Generic · high
    $1,00068 votes
28. Access to some Slack workspace metadata and settings available to unauthorized partiesImproper Authentication - Generic
    $7,00060 votes
29. The Custom Emoji Page has a Reflected XSSCross-site Scripting (XSS) - Reflected · high
    56 votes
30. Bypass of the SSRF protection in Event Subscriptions parameter.Server-Side Request Forgery (SSRF) · medium
    52 votes
31. Internal SSRF bypass using slash commands at api.slack.comServer-Side Request Forgery (SSRF) · medium
    51 votes
32. [Android] Directory traversal leading to disclosure of auth tokensPath Traversal · high
    $3,50050 votes
33. XSS on link and window.opener Cross-site Scripting (XSS) - Reflected · medium
    $1,00049 votes
34. Linux Desktop application slack executable does not use pie / no ASLRViolation of Secure Design Principles · low
    $10047 votes
35. The POODLE attack (SSLv3 supported) at status.slack.comCryptographic Issues - Generic · medium
    44 votes
36. Store XSSCross-site Scripting (XSS) - Generic · high
    44 votes
37. Information leakage and default open portInformation Disclosure · low
    41 votes
38. Slack-Corp Heroku application disclosing limited info about company membersInformation Disclosure · low
    39 votes
39. Workspace configuration metadata disclosureInformation Disclosure · high
    39 votes
40. Private application files can be uploaded to Slack via malicious uploaderInformation Disclosure · medium
    $50038 votes
41. CSS Injection to disable app & potential message exfilImproper Input Validation · medium
    37 votes
42. Bypass two-factor authenticationImproper Authentication - Generic
    36 votes
43. URL filter bypass in Enterprise GridPhishing · low
    $10032 votes
44. Access of Android protected components via embedded intentPrivilege Escalation · critical
    31 votes
45. Snooping into messages via email serviceImproper Authentication - Generic
    30 votes
46. DoS on the Direct MessagesUncontrolled Resource Consumption · medium
    $50029 votes
47. Race Condition in account surveyViolation of Secure Design Principles
    29 votes
48. Stored XSS(Cross Site Scripting) In Slack App NameCross-site Scripting (XSS) - Generic
    $1,00029 votes
49. Email html InjectionCode Injection · low
    $25028 votes
50. Subdomain takeover on podcasts.slack-core.comCross-site Scripting (XSS) - Generic · low
    $10027 votes
51. Rate-limit bypassImproper Authentication - Generic
    $50027 votes
52. HTTP parameter pollution from outdated Greenhouse.io JS dependencyResource Injection · medium
    26 votes
53. Source code leakage through GIT web access at host '52.91.137.42'Improper Authentication - Generic
    26 votes
54. Misuse of groups feature allows workspace members to join private channels without being invitedImproper Access Control - Generic · high
    23 votes
55. [Screenhero] Subdomain takeoverViolation of Secure Design Principles
    23 votes
56. CSRF in github integrationCross-Site Request Forgery (CSRF) · medium
    $50022 votes
57. Stored XSS in files.slack.comCross-site Scripting (XSS) - Stored · medium
    19 votes
58. Uninstalling Slack for Windows (64-bit), then reinstalling keeps you logged in without authenticationInsufficiently Protected Credentials · low
    $50018 votes
59. Facebook Takeover using Slack using 302 from files.slack.com with access_tokenOpen Redirect
    17 votes
60. Invitation reminder emails contain insecure linksCryptographic Issues - Generic · low
    $35015 votes
61. Bypass to postMessage origin validation via FTPCross-site Scripting (XSS) - Generic · high
    15 votes
62. Information Disclosure on stun.screenhero.comInformation Disclosure · medium
    $70014 votes
63. Code Injection in Slack's Windows Desktop Client leads to Privilege EscalationCommand Injection - Generic
    14 votes
64. Bypass of the SSRF protection (Slack commands, Phabricator integration)Server-Side Request Forgery (SSRF)
    $10014 votes
65. Cross-site leak allows attacker to de-anonymize members of his team from another originPrivilege Escalation · low
    $25013 votes
66. HTML Injection inside Slack promotional emailsCross-site Scripting (XSS) - Generic · low
    $10013 votes
67. Shared-channel BETA persists integration after unshareBusiness Logic Errors · medium
    $75013 votes
68. dom xss in https://www.slackatwork.comCross-site Scripting (XSS) - Generic · low
    13 votes
69. Open Redirect on slack.comCross-site Scripting (XSS) - Generic
    $50012 votes
70. Relative Path Vulnerability Results in Arbitrary Command Execution/Privilege EscalationCommand Injection - Generic · medium
    $75010 votes
71. Creating Post on a restricted channelPrivilege Escalation
    10 votes
72. User can start call in a channel of an unpaid accountPrivilege Escalation
    $10010 votes
73. Authentication bypass leads to sensitive data exposure (token+secret)Improper Authentication - Generic
    $2,00010 votes
74. Slack OAuth2 "redirect_uri" Bypass Improper Authentication - Generic
    10 votes
75. Possibility to freeze/crash the host system of all Slack Desktop users easilyViolation of Secure Design Principles · low
    9 votes
76. a stored xss issue in https://files.slack.comCross-site Scripting (XSS) - Generic
    $5009 votes
77. Stored XSS FoundCross-site Scripting (XSS) - Generic
    9 votes
78. Data exports stored on S3 can be scraped easilyImproper Authentication - Generic
    9 votes
79. "a stored xss issue in share post menu"Cross-site Scripting (XSS) - Generic
    $5008 votes
80. Open Redirect login accountOpen Redirect
    $1008 votes
81. Stored XSS in Slackbot Direct MessagesCross-site Scripting (XSS) - Generic
    8 votes
82. Stored XSS in www.slack-files.comCross-site Scripting (XSS) - Generic
    8 votes
83. Broken Authentication (including Slack OAuth bugs)Violation of Secure Design Principles
    8 votes
84. CSRF - Add optional two factor mobile numberCross-Site Request Forgery (CSRF)
    $5007 votes
85. RC4 cipher suites detected on status.slack.comViolation of Secure Design Principles
    6 votes
86. a stored xss in slack integration https://onerror.slack.com/services/importCross-site Scripting (XSS) - Generic
    $5006 votes
87. State parameter missing on google OAuthCross-Site Request Forgery (CSRF)
    6 votes
88. Stored XSS on this link https://sehacure.slack.com/help/requests/Cross-site Scripting (XSS) - Generic
    6 votes
89. Email information leakage for certain addressesInformation Disclosure
    $4005 votes
90. Generate new Test tokenImproper Authentication - Generic
    $1005 votes
91. File upload over private IM channelPrivilege Escalation
    5 votes
92. Password Policy issue (Weak Protect)Violation of Secure Design Principles
    5 votes
93. SSRF on https://whitehataudit.slack.com/account/photoCommand Injection - Generic
    5 votes
94. Stored XSS in Slack.comCross-site Scripting (XSS) - Generic
    5 votes
95. CSRF vulnerability on https://sehacure.slack.com/account/settingsCross-Site Request Forgery (CSRF)
    5 votes
96. URL redirection flawOpen Redirect
    5 votes
97. Trick make all fixed open redirect links vulnerable againOpen Redirect
    $1,0004 votes
98. Executing scripts on slack-files.com using SVGCross-site Scripting (XSS) - Generic
    4 votes
99. Stored XSS in Slack (weird, trial and error)Cross-site Scripting (XSS) - Generic
    4 votes
100. Content Spoofing all Integrations in https://team.slack.com/services/new/Violation of Secure Design Principles
     $2004 votes