Browse / Superhuman (formerly Grammarly)

Superhuman (formerly Grammarly)

See its reports on the map

What gets reported to Superhuman (formerly Grammarly)

• Access Control7
• Information Disclosure3
• Cross-site Scripting3
• Business Logic3
• Misconfiguration3
• Authentication2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Employee's GitHub Token Found In Travis CI Build LogsInformation Disclosure · high
   $5,000408 votes
2. Account takeover through the combination of cookie manipulation and XSSCross-site Scripting (XSS) - Stored · high
   292 votes
3. Ability to DOS any organization's SSO and open up the door to account takeoversImproper Authentication - Generic · high
   $10,500260 votes
4. Config override using non-validated query parameter allows at least reflected XSS by injecting configuration into stateBusiness Logic Errors · medium
   223 votes
5. Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's originMisconfiguration · critical
   202 votes
6. Previously created sessions continue being valid after MFA activationImproper Access Control - Generic · medium
   176 votes
7. Lack of CSRF header validation at https://g-mail.grammarly.com/profileInformation Disclosure · medium
   140 votes
8. `socket` command allows sending data over WebSockets to arbitrary origins from Grammarly Extensionhigh
   140 votes
9. Unauthenticated users can access all food.grammarly.io user's dataImproper Access Control - Generic · low
   138 votes
10. Lack or Origin check leads to Cross-Site Websocket Hijacking (CSWSH)Improper Access Control - Generic · high
    $800134 votes
11. Use Github pack with Coda employee github account (search code of Coda's private repositories)Improper Access Control - Generic · medium
    104 votes
12. Grammarly Keyboard for Android <4.1 leaks user input through logs (except for sensitive input fields)Information Exposure Through Debug Information · low
    84 votes
13. “email” MFA mode allows bypassing MFA from victim’s device when the device trust is not expiredImproper Authentication - Generic · medium
    $2,50082 votes
14. Grammarly Keyboard for Android "Authorization Code with PKCE" flow implementation vulnerability that allows account takeoverUse of Cryptographically Weak Pseudo-Random Number Generator (PRNG) · medium
    76 votes
15. DOM based CSS Injection on grammarly.comCross-site Scripting (XSS) - DOM · low
    $25063 votes
16. `open-url` command allows opening unlimited number of tabs pointing to arbitrary URLsBusiness Logic Errors · medium
    37 votes
17. Permissive CORS policy trusting arbitrary extensions originImproper Access Control - Generic · medium
    $50033 votes
18. "More on Wikipedia" link disclose "Referrer" and leak `window.opener` reference for arbitrary websitesViolation of Secure Design Principles · low
    29 votes
19. Unrestricted access to any "connected pack" on docsImproper Access Control - Generic · medium
    27 votes
20. Can register any mobile number in MFA without current code.Improper Access Control - Generic · low
    15 votes