Browse / Visma Public

Visma Public

See its reports on the map

What gets reported to Visma Public

• Access Control8
• Cross-site Scripting5
• Insecure Direct Object Reference4
• Authentication3
• Code Execution2
• Open Redirect2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. HTML-injection in PDF-export leads to LFIPath Traversal
   $500330 votes
2. Unrestricted file upload leads to Stored XSSUnrestricted Upload of File with Dangerous Type
   $250268 votes
3. Arbitrary File Upload to Stored XSSCross-site Scripting (XSS) - Stored
   $250245 votes
4. HTTP Request Smuggling at app.workbox.dkHTTP Request Smuggling
   $500139 votes
5. Stored XSS in 'Notes'Cross-site Scripting (XSS) - Stored
   $250130 votes
6. Stored XSS when uploading files to an invoiceCross-site Scripting (XSS) - Stored
   $250128 votes
7. A non-administrator user can change his email even when it is restricted by an administratorPrivilege Escalation
   $250124 votes
8. Unrestricted file upload when creating quotes allows for Stored XSSUnrestricted Upload of File with Dangerous Type
   $25057 votes
9. SXSS using unsanitized `customer no` in eaccountingprinting.stage.vismaonline.comCross-site Scripting (XSS) - Stored
   $25053 votes
10. A user can view the name and number of a customer in another company if the GUID is knownInsecure Direct Object Reference (IDOR)
    $25049 votes
11. SSRF in the application's image export functionalityServer-Side Request Forgery (SSRF)
    $25042 votes
12. [IDOR]Ability to View/Delete/Edit (Forward to attachment archive) Email of other user if GUID is known.Insecure Direct Object Reference (IDOR)
    $25024 votes
13. Administration page visible without authenticationMissing Authentication for Critical Function
    $10021 votes
14. Bypassing Business ID/VAT # validation during registration to create accounts with duplicate Business ID/VAT #Business Logic Errors
    $10013 votes
15. [CSRF]While Closing and opening Fiscal year.Cross-Site Request Forgery (CSRF)
    $25013 votes
16. Able to continue user creation process after deleting the HTML element that shows the message that the session is closedInsufficient Session Expiration
    $10013 votes
17. A 'Read only' user can modify the company logotype and invoice background imageImproper Access Control - Generic
    $10012 votes
18. Missing authorization allows sales only user to record payment.Missing Authorization
    $25011 votes
19. Stored XSS in eaccounting.stage.vismaonline.comCross-site Scripting (XSS) - Stored
    $25010 votes
20. Session replay vulnerability in app.workbox.dk domainInsufficient Session Expiration
    $10010 votes
21. Reverse Tabnabbing in printing source document imagesOpen Redirect
    $1009 votes
22. Information disclosure to "Permission as auditor" userInformation Disclosure
    $1007 votes
23. Improper access control allows sales only user to view bank balance of company accounts.Improper Access Control - Generic
    $1007 votes
24. Read-only user can access payroll information without having access to payroll.Improper Access Control - Generic
    $2506 votes
25. Ability to delete projects from Archived companies (Read only version)Improper Access Control - Generic
    $1005 votes
26. [IDOR]Ability to Pause & Resume the Invoice of other users If GUID is known.Insecure Direct Object Reference (IDOR)
    $2505 votes
27. [IDOR]Ability to edit Description of api_key's of other users.Insecure Direct Object Reference (IDOR)
    $2505 votes
28. A sales only user can edit the purchase invoice drafts.Privilege Escalation
    $1004 votes
29. Access control on https://eaccounting.stage.vismaonline.com/Improper Access Control - Generic
    $1003 votes
30. Open Redirection In connect.identity.stagaws.visma.comOpen Redirect
    $1003 votes