Browse / WHO COVID-19 Mobile App

WHO COVID-19 Mobile App

See its reports on the map

What gets reported to WHO COVID-19 Mobile App

• Injection and Smuggling2
• Misconfiguration2
• Access Control1
• Cross-site Scripting1
• Authentication1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Internal API endpoint is accesible for everyoneImproper Access Control - Generic · medium
   39 votes
2. Probably unexploitable XSS via Header InjectionCross-site Scripting (XSS) - Reflected · low
   19 votes
3. Improper Input Validation on User's Location on PUT /WhoService/putLocation Could Affect Availability/Falsify UsersImproper Input Validation · low
   15 votes
4. DMARC and SPF recordsMisconfiguration · medium
   9 votes
5. Improper Input Validation on User's Location on PUT /WhoService/putLocation Could Affect Availability/Falsify UsersImproper Input Validation · medium
   8 votes
6. Error Page Text Injection (no compromise)N/AMisconfiguration
   4 votes
7. ArcGIS Rest Service linked to unsecured survey dataAuthentication Bypass Using an Alternate Path or Channel · medium
   3 votes