Browse / WakaTime

WakaTime

See its reports on the map

What gets reported to WakaTime

• Misconfiguration18
• Authentication17
• Information Disclosure9
• Access Control8
• Insecure Direct Object Reference2
• Business Logic2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. IDOR to view order information of users and personal informationN/AInsecure Direct Object Reference (IDOR)
   126 votes
2. Unauthorized Disclosure of Private Emails via WakaTime Private LeaderboardsInformation Disclosure · medium
   93 votes
3. Leaked credentials ( emails and passwords , etc...)Information Disclosure
   77 votes
4. Login Information and Credentials Have Been Leaked on wakatime.comInformation Disclosure
   74 votes
5. User Email Disclosure via ID-Based InvitationInformation Disclosure · medium
   73 votes
6. user api key leakedInformation Disclosure
   65 votes
7. Double Clickjacking Attack on WakaTime OAuth Authorization Flow at https://wakatime.com/oauth/authorizeViolation of Secure Design Principles · medium
   57 votes
8. Broken Access Control Exposes Email Verification Status and Privacy Settings via API EndpointImproper Access Control - Generic · low
   57 votes
9. Session Replay Attack Allows Authentication Bypass via Captured Login Responses Allowing Bypass of 429 Too many attempts for Multiple Failed LoginsInformativeImproper Authentication - Generic · high
   54 votes
10. Not a Vuln: Race Condition Allows Creation of Multiple Organizations with the Same NameN/ABusiness Logic Errors
    40 votes
11. previous token seems to work even though it does not verify emailViolation of Secure Design Principles · low
    35 votes
12. JSON CSRF on POST Heartbeats APICross-Site Request Forgery (CSRF) · medium
    34 votes
13. InvalidInformativeImproper Access Control - Generic · low
    26 votes
14. Add arbitrary content to Password Reset EmailCode Injection
    24 votes
15. IDOR create accounts and verify them with original account emailInsecure Direct Object Reference (IDOR) · low
    15 votes
16. Vulnerability Name: Host Header Injection RedirectOpen Redirect · low
    14 votes
17. Password Policy IssueImproper Authentication - Generic · low
    14 votes
18. [Privilege Escalation] Authenticated users can manipulate others fullname without their knowledgePrivilege Escalation · medium
    14 votes
19. Email Spoofing Via /api/v1/users/reset_passwordImproper Authentication - Generic
    14 votes
20. by pass rate limit exceed Improper Access Control - Generic
    12 votes
21. [Privilege Escalation] Authenticated users can manipulate others fullname without their knowledge [Team Vector]Privilege Escalation · medium
    12 votes
22. Password reset links should expire after being used, instead of at specific timeImproper Authentication - Generic · medium
    12 votes
23. Using an outdated version of OpenSSH on db01.wakatime.comInformation Disclosure · low
    11 votes
24. Two email addresses can access the same accountViolation of Secure Design Principles
    10 votes
25. No rate limit when creating new goals [https://wakatime.com/goals]Violation of Secure Design Principles
    10 votes
26. Leaking password reset token via referrer from external Twitter share buttonInformation Disclosure
    10 votes
27. Missing SPF FlagsViolation of Secure Design Principles · low
    10 votes
28. [wakatime.com] HTML Injection github-btn.htmlCross-site Scripting (XSS) - DOM · low
    9 votes
29. Lack of Password Confirmation When Changing EmailViolation of Secure Design Principles
    9 votes
30. No redirect uri for Twitter Oath resulting in token leakImproper Authentication - Generic · low
    9 votes
31. Users with member privilege are able to see emails and membership information of other usersInformation Disclosure · medium
    9 votes
32. Mailgun misconfiguration Privilege Escalation
    9 votes
33. Impersonation of Wakatime user using Invitation functionality.Violation of Secure Design Principles
    8 votes
34. Bypassing Access control, changing owner's name in a private leaderboardImproper Access Control - Generic · medium
    8 votes
35. No rate limiting for confirmation email, can spam anyone with confirmation emailsViolation of Secure Design Principles
    8 votes
36. Clickjacking on authorized page https://wakatime.com/share/embedUI Redressing (Clickjacking) · low
    8 votes
37. Broken Authentication and session management OWASP A2N/AImproper Authentication - Generic
    7 votes
38. Blocking users to sign up on the siteViolation of Secure Design Principles
    7 votes
39. Missing filteration of meta characters in all full name field on wakatime.comViolation of Secure Design Principles · low
    7 votes
40. No notificatoin sent on email after account deletion.Violation of Secure Design Principles · low
    7 votes
41. Session Not Expired On LogoutDuplicateImproper Authentication - Generic
    7 votes
42. Forgot password link doesn't expire after used, only after some hoursWeak Password Recovery Mechanism for Forgotten Password · low
    7 votes
43. Password token validation in https://wakatime.com/Improper Authentication - Generic · low
    7 votes
44. Private leaderboard owner email disclosure when sending invitesInformation Disclosure
    6 votes
45. No rate limit on creating private leaderboards.Improper Restriction of Authentication Attempts
    6 votes
46. Login page password - guessing attackInformativeImproper Restriction of Authentication Attempts · low
    6 votes
47. https://wakatime.com/ website CSP "script-src" includes "unsafe-inline"Violation of Secure Design Principles · low
    6 votes
48. UI Redressing on Embedded ChartsUI Redressing (Clickjacking) · low
    6 votes
49. Session Duplication due to Broken Access ControlDuplicateImproper Access Control - Generic · high
    5 votes
50. Missing Account Deletion Notification
    5 votes
51. Session not expired on logoutDuplicateImproper Authentication - Generic
    5 votes
52. Can link to websites from profileInformativeImproper Authentication - Generic · low
    4 votes
53. password token validationInformativeImproper Authentication - Generic · low
    4 votes
54. SSH backdated version open portImproper Restriction of Authentication Attempts
    4 votes
55. Unsafe Inline and Eval CSP UsageViolation of Secure Design Principles · low
    4 votes
56. [invalid][false-positive] csrftoken on profile pageN/AViolation of Secure Design Principles
    3 votes
57. Rate Limit too lenient for endpoint sending emailsWeak Password Recovery Mechanism for Forgotten Password
    3 votes
58. Validation of Password reset tokensInformativeViolation of Secure Design Principles · low
    3 votes
59. Failure to check password historyN/AWeak Password Recovery Mechanism for Forgotten Password · low
    3 votes
60. Running 2 accounts with a single emailInformativeBusiness Logic Errors
    3 votes
61. Sensitive Cookie Without 'HttpOnly' FlagInformativeMisconfiguration
    3 votes
62. HTML - injection N/ACode Injection
    1 votes
63. Logout CSRFDuplicateCross-Site Request Forgery (CSRF) · low