Browse / UPchieve

UPchieve

See its reports on the map

What gets reported to UPchieve

• Misconfiguration12
• Authentication10
• Information Disclosure4
• Access Control3
• Cryptography2
• Injection and Smuggling1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. User enumeration through forget passwordImproper Authentication - Generic · high
   66 votes
2. Full account takeover of any user through reset passwordDuplicateImproper Access Control - Generic · critical
   54 votes
3. Zero click account Takeover due to Api misconfiguration 🏂🎩Improper Access Control - Generic · critical
   37 votes
4. Password reset token leak on third party website via Referer headerStoring Passwords in a Recoverable Format · medium
   28 votes
5. Session Hijacking leads to full control of account by attackerImproper Authentication - Generic
   21 votes
6. Hyper Link Injection while signup Improper Input Validation · low
   20 votes
7. Widespread CSRF on authenticated POST endpointsCross-Site Request Forgery (CSRF) · high
   17 votes
8. old session dose not expire after password change Improper Authentication - Generic
   17 votes
9. All user password hash can be seen from admin panelInsecure Storage of Sensitive Information · medium
   16 votes
10. Cross-origin resource sharing misconfig | steal user information Information Disclosure · high
    15 votes
11. No Rate Limit On Contact Us Improper Restriction of Authentication Attempts
    13 votes
12. Postgres Admin Username and Password in Plain textInformativeInsecure Storage of Sensitive Information · low
    12 votes
13. Password reset token leakageDuplicateMisconfiguration · high
    12 votes
14. No Rate Limiting on /reset-password-request/ endpointN/AViolation of Secure Design Principles · medium
    12 votes
15. No Rate Limit On Reset PasswordViolation of Secure Design Principles · low
    12 votes
16. CORS Misconfiguration, could lead to disclosure of sensitive informationWrap-around Error · medium
    10 votes
17. Business logic errorN/ABusiness Logic Errors · low
    9 votes
18. Failed to validate Session after Password ChangeDuplicateInsufficient Session Expiration · low
    9 votes
19. Authentication Bypass - Email Verification code bypass in account registration process.DuplicateImproper Authentication - Generic · critical
    8 votes
20. No Valid SPF Records/don't have DMARC recordImproper Access Control - Generic · critical
    8 votes
21. Password ReuseN/AMisconfiguration · medium
    6 votes
22. CORS origin validation failureMisconfiguration · medium
    5 votes
23. OTP reflecting in response sensitive data exposure leads to account take overN/AInformation Disclosure · critical
    5 votes
24. No Rate Limit on forgot password pageN/AImproper Restriction of Authentication Attempts · medium
    5 votes
25. url redirectionN/AOpen Redirect · critical
    5 votes
26. No character limit in password fieldN/AUse of Hard-coded Password · medium
    4 votes
27. Outdated Copyright Message @ Welcome emailN/AMisconfiguration
    4 votes
28. Missing Validation in editing "Your Phone Number" N/AMisconfiguration · medium
    4 votes
29. No Rate Limiting for Password Reset Email Leads to Email FloodingN/ANULL Pointer Dereference · medium
    4 votes
30. i can join without user and pass in this website https://argocd.upchieve.org/settings/accountsN/AReusing a Nonce, Key Pair in Encryption · high
    4 votes
31. CLICKJACKING LEADS TO DEACTIVATE ACCOUNTDuplicateUI Redressing (Clickjacking) · low
    4 votes
32. blind sql on [ https://argocd.upchieve.org/login?return_url=id= ]N/ASQL Injection · critical
    4 votes
33. Clickjacking on profile page leading to unauthorized changesUI Redressing (Clickjacking) · medium
    4 votes
34. Clickjacking login page of https://hackers.upchieve.org/loginN/AUI Redressing (Clickjacking) · medium
    3 votes
35. No rate Limit on Password Reset page on upchieveN/AImproper Restriction of Authentication Attempts · medium
    3 votes
36. Vulnerability Report - sweet32 UPchieveInformativeCryptographic Issues - Generic
    3 votes
37. Clickjacking ar https://hackers.upchieve.org/loginN/AUI Redressing (Clickjacking) · low
    2 votes
38. hackers.upchieve.org and argocd.upchieve.org is not preloaded.N/AViolation of Secure Design Principles · low
    2 votes