HexBrain
Sign in

Browse / Starbucks

Starbucks

128disclosed reports

See its reports on the map

What gets reported to Starbucks

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll DatabaseSQL Injection · critical
    801 votes
  2. JumpCloud API Key leaked via Open Github Repository.Use of Hard-coded Credentials · critical
    739 votes
  3. Webshell via File Upload on ecjobs.starbucks.com.cnOS Command Injection · critical
    688 votes
  4. RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/Code Injection · critical
    572 votes
  5. XXE at ecjobs.starbucks.com.cn/retail/hxpublic_v6/hxdynamicpage6.aspxXML External Entities (XXE) · critical
    319 votes
  6. Subdomain takeover of datacafe-cert.starbucks.comPrivilege Escalation · high
    311 votes
  7. Singapore - Account Takeover via IDORInsecure Direct Object Reference (IDOR) · critical
    260 votes
  8. Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sgImproper Access Control - Generic · critical
    247 votes
  9. Misuse of an authentication cookie combined with a path traversal on app.starbucks.com permitted access to restricted dataPath Traversal · critical
    239 votes
  10. Blind SQLi leading to RCE, from Unauthenticated access to a test API WebserviceSQL Injection · critical
    236 votes
  11. Blind SQL Injection on starbucks.com.gt and WAF Bypass :*SQL Injection · high
    210 votes
  12. sdrc.starbucks.com - Information Disclosure via unsecured attachment directoryInformation Disclosure · critical
    197 votes
  13. Reflected Cross site Scripting (XSS) on www.starbucks.comCross-site Scripting (XSS) - Reflected · medium
    181 votes
  14. Bug in GraphQL and API integration leads to limited user address disclosureImproper Access Control - Generic · high
    144 votes
  15. Subdomain takeover of d02-1-ag.productioncontroller.starbucks.comPrivilege Escalation · high
    122 votes
  16. Subdomain takeover of mydailydev.starbucks.comExternally Controlled Reference to a Resource in Another Sphere · high
    122 votes
  17. China – Limited Partner PII Regarding Work Scheduling via Unauthenticated API EndpointInformation Disclosure · critical
    116 votes
  18. Subdomain takeover on svcgatewayus.starbucks.comPrivilege Escalation · critical
    109 votes
  19. Subdomain takeover on happymondays.starbucks.com due to non-used AWS S3 DNS recordPrivilege Escalation · high
    105 votes
  20. Thailand - a small number of SMB CCTV footage backup servers were accessible without authentication.Improper Access Control - Generic · medium
    99 votes
  21. Subdomain takeover on wfmnarptpc.starbucks.comPrivilege Escalation · high
    91 votes
  22. Multiple Subdomain takeovers via unclaimed instancesPrivilege Escalation · high
    83 votes
  23. Korea - LFI via path traversal at https://msr.istarbucks.co.kr:6443/appif/Path Traversal · critical
    81 votes
  24. Cross-Site Scripting (XSS) on www.starbucks.com | .co.uk login pagesCross-site Scripting (XSS) - Generic · high
    78 votes
  25. Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using ChromeCross-Site Request Forgery (CSRF) · high
    77 votes
  26. Leaking sensitive files on Github leads to internal files (python scripts,SQL files)Information Disclosure · critical
    73 votes
  27. Reflected cross-site scripting on multiple Starbucks assets.Cross-site Scripting (XSS) - Reflected · low
    72 votes
  28. Reflected XSS in https://www.starbucks.co.jp/store/search/Cross-site Scripting (XSS) - Reflected · medium
    72 votes
  29. China - president-starbucks.com.cn DNS configuration reported as takeoverPrivilege Escalation · high
    71 votes
  30. Parameter Manipulation allowed for viewing of other user’s teavana.com ordersImproper Authentication - Generic
    71 votes
  31. [mena.starbucks.com] Laravel App Log & Configuration Disclosure.Information Disclosure · high
    63 votes
  32. Singapore - Unrestricted File Upload Leads to XSS on campaign.starbucks.com.sg/api/uploadCross-site Scripting (XSS) - Stored · medium
    61 votes
  33. WAF bypass via double encoded non standard ASCII chars permitted a reflected XSS on response page not found pages - (629745 bypass)Cross-site Scripting (XSS) - Reflected · low
    58 votes
  34. Information disclosure on sim.starbucks.comInformation Disclosure · low
    58 votes
  35. Store Development Resource Center was vulnerable to a Remote Code Execution - Unauthenticated Remote Command Injection (CVE-2019-0604)OS Command Injection · critical
    57 votes
  36. Open Redirection in Login - Korean StarbucksOpen Redirect · low
    54 votes
  37. Subdomain takeover on developer.openapi.starbucks.comImproper Access Control - Generic · high
    51 votes
  38. Unauthorized access to jiratest.starbucks.com Improper Authentication - Generic · critical
    49 votes
  39. Information Leak - Github - JMS InformationInformation Disclosure · high
    48 votes
  40. Java Deserialization RCE via JBoss on card.starbucks.inCode Injection · critical
    48 votes
  41. China - ecjobsdc.starbucks.com.cn html/shtml file upload vulnerabilityPrivilege Escalation · high
    46 votes
  42. China - IDOR on Reservation Staging/Non Production Site - https://reservation.stg.starbucks.com.cnInsecure Direct Object Reference (IDOR) · medium
    45 votes
  43. Reflected XSS in https://www.starbucks.com/account/create/redeem/MCP131XSR via xtl_amount, xtl_coupon_code, xtl_amount_type parametersCross-site Scripting (XSS) - Reflected · medium
    43 votes
  44. Java Deserialization RCE via JBoss JMXInvokerServlet/EJBInvokerServlet on card.starbucks.inCode Injection
    42 votes
  45. Able to purchase a gift card with any amountInsecure Direct Object Reference (IDOR) · high
    41 votes
  46. svcardproxydevus.starbucks.com Subdomain take overImproper Access Control - Generic · high
    39 votes
  47. PHPinfo pageInformation Disclosure · low
    39 votes
  48. Stored XSS on www.starbucks.com.sg/careers/career-center/career-landing-*Cross-site Scripting (XSS) - Stored · medium
    37 votes
  49. Parameter Manipulation allowed for editing the shipping address for other user’s teavana.com subscriptions.Improper Authentication - Generic
    37 votes
  50. Thailand - Insecure Direct Object Reference permits an unauthorized user to transfer funds from a victim using only the victims Starbucks cardInsecure Direct Object Reference (IDOR) · high
    36 votes
  51. www.starbucks.co.uk Reflected XSS via utm_source parameterCross-site Scripting (XSS) - Generic
    36 votes
  52. Subdomain takeover on svcgatewaydevus.starbucks.com and svcgatewayloadus.starbucks.comPrivilege Escalation · critical
    35 votes
  53. Time-based Blind SQLi on news.starbucks.comSQL Injection · high
    35 votes
  54. Persistent XSS in www.starbucks.comCross-site Scripting (XSS) - Generic · high
    35 votes
  55. CRLF injection on www.starbucks.comCRLF Injection · medium
    34 votes
  56. SSRF at ideas.starbucks.comServer-Side Request Forgery (SSRF) · high
    33 votes
  57. Starbucks China Android app cloud storage service leaks a credential.Information Disclosure · high
    33 votes
  58. Singapore - XXE at https://www.starbucks.com.sg/RestApi/soap11XML External Entities (XXE) · high
    32 votes
  59. athome.starbucks.com - URL parameter tampering of review forms permitted possible content injectionImproper Input Validation · medium
    31 votes
  60. Account take over of 'light' starbuckscardb2b usersImproper Authentication - Generic · high
    30 votes
  61. Possible SOP bypass in www.starbucks.com due to insecure crossdomain.xmlCross-Site Request Forgery (CSRF) · high
    29 votes
  62. SAP Server - default credentials enabledImproper Authentication - Generic · medium
    29 votes
  63. Thailand - IDOR on www.starbuckscardth.in.th: A logged in user could view any Thailand Starbucks card balance if they knew that Starbucks card numberInsecure Direct Object Reference (IDOR) · low
    28 votes
  64. Full Api Access and Run All Functions via Starbucks AppImproper Authentication - Generic · medium
    28 votes
  65. Norway - store.starbucks.no - CSRF on email changeCross-Site Request Forgery (CSRF) · high
    27 votes
  66. DOM XSS on app.starbucks.com via ReturnUrlCross-site Scripting (XSS) - DOM · medium
    27 votes
  67. SQL injection in partner id field on https://www.teavana.com (Sign-up form)SQL Injection · medium
    27 votes
  68. XSS on https://www.starbucks.co.uk (can lead to credit card theft) (/shop/paymentmethod)Cross-site Scripting (XSS) - Generic · high
    27 votes
  69. [stagecafrstore.starbucks.com] CRLF Injection, XSSCross-site Scripting (XSS) - Generic · low
    27 votes
  70. Reflected XSS by exploiting CSRF vulnerability on teavana.com wishlist comment module. (wishlist-comments)Cross-site Scripting (XSS) - Generic · medium
    27 votes
  71. Bulgaria - Subdomain takeover of mail.starbucks.bgPrivilege Escalation · high
    26 votes
  72. Possible subdomain takeover at openapi.starbucks.comMisconfiguration · high
    24 votes
  73. Improper handling of payment callback allows topping up a Swiss Starbucks Card bypassing actual payment via a crafted success messageBusiness Logic Errors · high
    23 votes
  74. Thailand – a small number of alarm system portals accessible with the default credentialsImproper Authentication - Generic · high
    23 votes
  75. [newscdn.starbucks.com] CRLF Injection, XSSHTTP Response Splitting · medium
    23 votes
  76. unuse domain still in using at wechat by Starbucks East ChinaImproper Access Control - Generic · critical
    22 votes
  77. Unauthorized access to a system used for CI/CD processesImproper Authentication - Generic · high
    22 votes
  78. Persistent CSRF in /GiftCert-AddToBasket prevents purchases on eCommerce sitesCross-Site Request Forgery (CSRF) · high
    22 votes
  79. DVR default username and passwordImproper Authentication - Generic · medium
    21 votes
  80. Singapore - IDOR in campaign.starbucks.com.sgInsecure Direct Object Reference (IDOR) · medium
    20 votes
  81. India - OTP bypass on Phone number verification for account creationImproper Authentication - Generic · medium
    20 votes
  82. Default credentials for the temporary POC site alipoc.stg.starbucks.com.cn permitted WAF bypass and RCEOS Command Injection · medium
    19 votes
  83. Host header injection/redirection via newsletter signupOpen Redirect · low
    19 votes
  84. Stored XSS in comments on https://www.starbucks.co.uk/blog/*Cross-site Scripting (XSS) - Stored · high
    19 votes
  85. Open redirect / Reflected XSS payload in root that affects all your sites (store.starbucks.* / shop.starbucks.* / teavana.com)Cross-site Scripting (XSS) - Generic · medium
    19 votes
  86. Able to reset other user's password in https://card.starbucks.com.sg/Improper Authentication - Generic · medium
    18 votes
  87. Lack of Controls Allowing for Card and PIN Enumeration Leading to FraudInformation Disclosure · high
    18 votes
  88. DOM-based XSS in store.starbucks.co.uk on IE 11Cross-site Scripting (XSS) - DOM · low
    17 votes
  89. Korea - LFI Server directory traversal at starbucks.co.krPath Traversal · high
    16 votes
  90. Sidekiq web UI (Ruby background processing) accessible unauthenticated via https://gift-test.starbucks.co.jp/sidekiq/busyImproper Access Control - Generic · medium
    16 votes
  91. Exposed Unencrypted Telnet EndpointInformation Disclosure · low
    16 votes
  92. Minimal information disclosure of internal asset names and links which were not publicly accessible.Information Disclosure · low
    15 votes
  93. Backup Source Code Detectedmedium
    15 votes
  94. DOM XSS on teavana.com via "pr_zip_location" parameterCross-site Scripting (XSS) - Generic · medium
    15 votes
  95. Reflected XSS on teavana.com (Locale-Change)Cross-site Scripting (XSS) - Generic · medium
    15 votes
  96. Dom Based Xss DIV.innerHTML parameters store.starbucks*Cross-site Scripting (XSS) - Generic · low
    15 votes
  97. India - An Insecure Direct Object Reference (IDOR) allowed unauthorized access to view card index number and monetary balanceInsecure Direct Object Reference (IDOR) · medium
    14 votes
  98. Reflected DOM XSS on www.starbucks.co.ukCross-site Scripting (XSS) - Reflected · medium
    14 votes
  99. Reflected XSS on https://www.starbucks.co.uk/shop/paymentmethod/ (bypass for 227486)Cross-site Scripting (XSS) - Reflected · medium
    14 votes
  100. out of date disqus shortname usage in the web app source codeViolation of Secure Design Principles · critical
    14 votes