Browse / Veris

Veris

See its reports on the map

What gets reported to Veris

• Access Control12
• Cross-site Scripting12
• Authentication8
• Information Disclosure5
• Misconfiguration3
• Denial of Service2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. bugImproper Authentication - Generic
   10 votes
2. Email spoofing in [email protected] Uncontrolled Resource Consumption
   9 votes
3. Wordpress Pingback DDoS Attacks in domain: veris.inUncontrolled Resource Consumption
   6 votes
4. Critical - Insecure Direct Object Reference - Deleting any member of any organization remotelyPrivilege Escalation
   6 votes
5. Password reset link is not ExpiringViolation of Secure Design Principles
   6 votes
6. [XSS] sandbox.veris.inCross-site Scripting (XSS) - Generic
   5 votes
7. Captcha Bypass enable login bruteforceImproper Authentication - Generic
   5 votes
8. Complete or Edit Another User's ProfileImproper Authentication - Generic
   4 votes
9. Critical IDOR - Get Authentication Details of any Terminal/GatekeeperPrivilege Escalation
   4 votes
10. Critical IDOR - Delete any group of any organization remotelyPrivilege Escalation
    4 votes
11. Password(s) can be found via login process.Improper Authentication - Generic
    4 votes
12. SSL/TLS BEAST ATTACK VULNERABILITY Cryptographic Issues - Generic
    3 votes
13. Stored XSS in member bookCross-site Scripting (XSS) - Generic
    3 votes
14. Not Using Secure Flag Option on Cookies Could Lead to a Man in the Middle Session HighjackingImproper Authentication - Generic
    3 votes
15. User enumeration via error messageImproper Authentication - Generic
    3 votes
16. Creating multiple user with the same link which is sent to email after registerationViolation of Secure Design Principles
    3 votes
17. Critical IDOR - Make Rule for Any Group & Any Venue remotelyPrivilege Escalation
    3 votes
18. Critical IDOR - Get Rules of any organization remotelyPrivilege Escalation
    3 votes
19. Critical IDOR - Can select any Parent while creating new VenuePrivilege Escalation
    3 votes
20. Critical IDOR - Get venue data of any organization remotelyPrivilege Escalation
    3 votes
21. Critical IDOR - Set anyone's Terminal Data remotelyPrivilege Escalation
    3 votes
22. Critical IDOR - Get anyone's Terminal Data remotelyPrivilege Escalation
    3 votes
23. Critical IDOR - Delete any terminal/gatekeeper of any organization remotelyPrivilege Escalation
    3 votes
24. Critical IDOR - Delete any rule of any organization remotelyPrivilege Escalation
    3 votes
25. Critical IDOR - Delete any venue of any organization remotelyPrivilege Escalation
    3 votes
26. www.veris.in DOM based XSSCross-site Scripting (XSS) - Generic
    3 votes
27. Text injection can be used in phishing 404 page and should not include attacker textViolation of Secure Design Principles
    2 votes
28. [Stored XSS] sandbox.veris.in Cross-site Scripting (XSS) - Generic
    2 votes
29. XSS in Asset nameCross-site Scripting (XSS) - Generic
    2 votes
30. Complete Profile URL is not Random and not expiring Improper Authentication - Generic
    2 votes
31. Insecure Direct 'org-invite-log' ReferencesInformation Disclosure
    2 votes
32. Security Vulnerability - SMTP protection not usedImproper Authentication - Generic
    2 votes
33. Stored XSS Cross-site Scripting (XSS) - Generic
    2 votes
34. Registeration Link "Jacking&Redirecting"Open Redirect
    1 votes
35. Reflected XSS in domain www.veris.inCross-site Scripting (XSS) - Generic
    1 votes
36. Stored XSS on 'Badges' pageCross-site Scripting (XSS) - Generic
    1 votes
37. Stored XSS in Access RulesCross-site Scripting (XSS) - Generic
    1 votes
38. Insecure Direct 'org-visitor-log' ReferencesInformation Disclosure
    1 votes
39. Insecure Direct Member DisclosureInformation Disclosure
    1 votes
40. Server and PHP version Disclosed in Response HeaderInformation Disclosure
    1 votes
41. Multiple Stored XSS on Sanbox.veris.in through Veris Frontdesk Android AppCross-site Scripting (XSS) - Generic
    1 votes
42. Multiple Stored XSSCross-site Scripting (XSS) - Generic
    1 votes
43. Missing Server Side Validation of CSRF Middleware Token in Change Password RequestCross-Site Request Forgery (CSRF)
    1 votes