Browse / UPchieve

UPchieve

See its reports on the map

What gets reported to UPchieve

• Misconfiguration12
• Authentication10
• Information Disclosure4
• Access Control3
• Cryptography2
• Injection and Smuggling1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. User enumeration through forget passwordImproper Authentication - Generic · high
   66 votes
2. Zero click account Takeover due to Api misconfiguration 🏂🎩Improper Access Control - Generic · critical
   37 votes
3. Password reset token leak on third party website via Referer headerStoring Passwords in a Recoverable Format · medium
   28 votes
4. Session Hijacking leads to full control of account by attackerImproper Authentication - Generic
   21 votes
5. Hyper Link Injection while signup Improper Input Validation · low
   20 votes
6. Widespread CSRF on authenticated POST endpointsCross-Site Request Forgery (CSRF) · high
   17 votes
7. old session dose not expire after password change Improper Authentication - Generic
   17 votes
8. All user password hash can be seen from admin panelInsecure Storage of Sensitive Information · medium
   16 votes
9. Cross-origin resource sharing misconfig | steal user information Information Disclosure · high
   15 votes
10. No Rate Limit On Contact Us Improper Restriction of Authentication Attempts
    13 votes
11. No Rate Limit On Reset PasswordViolation of Secure Design Principles · low
    12 votes
12. CORS Misconfiguration, could lead to disclosure of sensitive informationWrap-around Error · medium
    10 votes
13. No Valid SPF Records/don't have DMARC recordImproper Access Control - Generic · critical
    8 votes
14. CORS origin validation failureMisconfiguration · medium
    5 votes
15. Clickjacking on profile page leading to unauthorized changesUI Redressing (Clickjacking) · medium
    4 votes