HexBrain
Sign in

Browse / Snapchat

Snapchat

37disclosed reports
$96,900paid in bounties

See its reports on the map

What gets reported to Snapchat

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Exposed Kubernetes API - RCE/Exposed CredsOS Command Injection · critical
    $25,0001,191 votes
  2. Improper Authentication - any user can login as other user with otp/logout & otp/loginImproper Authentication - Generic · critical
    972 votes
  3. Delete anyone's content spotlight remotely.Insecure Direct Object Reference (IDOR) · high
    $15,000801 votes
  4. Github Token Leaked publicly for https://github.sc-corp.netCleartext Storage of Sensitive Information · critical
    582 votes
  5. Publicly accessible Continuous Integration ToolImproper Access Control - Generic · critical
    562 votes
  6. Access to multiple production Grafana dashboardsInformation Disclosure · high
    $10,000464 votes
  7. Open prod Jenkins instanceInformation Disclosure · high
    $15,000436 votes
  8. Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataServer-Side Request Forgery (SSRF)
    421 votes
  9. Stealing SSO Login Tokens (snappublisher.snapchat.com)Authentication Bypass · high
    $7,500244 votes
  10. Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.ioInformation Disclosure · high
    $15,000137 votes
  11. Intent Leads To Unauthorised Video Call Initiation Leaking Surrounding Informations Of VictimPrivacy Violation · medium
    127 votes
  12. RCE/LFI on test Jenkins instance due to improper authentication flowImproper Access Control - Generic · medium
    118 votes
  13. Subdomain takeover on http://fastly.sc-cdn.net/Violation of Secure Design Principles
    $3,000114 votes
  14. internal dev tokens disclosureCleartext Storage of Sensitive Information · low
    $25096 votes
  15. Bitmoji source code is accessibleInformation Exposure Through Directory Listing · medium
    $1,00092 votes
  16. Administrator access to a Django Administration Panel on *.sc-corp.net via bruteforced credentialsImproper Authentication - Generic
    $1,00054 votes
  17. CreatorID leaked from public content posted to SnapMapsServer-Side Request Forgery (SSRF) · medium
    $1,00049 votes
  18. Bypass Rate Limits on app.snapchat.com API Endpoint via X-Forwarded-For HeaderBusiness Logic Errors · medium
    40 votes
  19. Client IP Spoofing using "X-Forwarded-For: 127.0.0.1" on "studio-app.snapchat.com" exposing bucket detailsImproper Access Control - Generic · high
    $50040 votes
  20. Subdomain Takeover via Unclaimed WordPress siteImproper Authentication - Generic · medium
    39 votes
  21. XSS found on Snapchat websiteCross-site Scripting (XSS) - Generic
    38 votes
  22. Domain Takeover in [obviousengine.com] a snapchat acquisitionsPrivilege Escalation · high
    32 votes
  23. Password reset tokens sent to CSP reporting endpointsInformation Disclosure · low
    26 votes
  24. Organization Members in Snap Kit may Deactivate AppsPrivilege Escalation · low
    26 votes
  25. Incoming email hijacking on sc-cdn.netMisconfiguration
    25 votes
  26. CRLF Injection at vpn.bitstrips.comCRLF Injection · medium
    24 votes
  27. [spectacles.com] Bypassing quantity limit in ordersHTTP Request Smuggling · medium
    $25022 votes
  28. CSRF when unlocking lenses leads to lenses being forcefully installed without user interactionCross-Site Request Forgery (CSRF) · low
    $25021 votes
  29. [render.bitstrips.com] Stored XSS via an incorrect avatar property valueCross-site Scripting (XSS) - Generic
    $40021 votes
  30. Bypassing "You've requested your data the maximum number of times today." + "Please Verify an email address with snapchat to continue" Improper Authentication - Generic
    20 votes
  31. Subdomain Takeover via unclaimed UserVoice domainPrivilege Escalation · high
    $25018 votes
  32. RTLO char allowed in chatUI Redressing (Clickjacking) · medium
    18 votes
  33. Subdomain takeover of blog.snapchat.comMisconfiguration
    14 votes
  34. Subdomain takeover in http://support.scan.me pointing to Zendesk (a Snapchat acquisition)Cross-site Scripting (XSS) - Generic
    14 votes
  35. Vulnerable to JavaScript injection. (WXS) (Javascript injection)!Command Injection - Generic
    14 votes
  36. Password Reset - query param overrides postdataPrivilege Escalation
    $1,50012 votes
  37. Captcha Bypass in Snapchat's Geofilter Submission ProcessViolation of Secure Design Principles
    9 votes