Browse / WakaTime

WakaTime

See its reports on the map

What gets reported to WakaTime

• Misconfiguration18
• Authentication17
• Information Disclosure9
• Access Control8
• Insecure Direct Object Reference2
• Business Logic2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Unauthorized Disclosure of Private Emails via WakaTime Private LeaderboardsInformation Disclosure · medium
   93 votes
2. Leaked credentials ( emails and passwords , etc...)Information Disclosure
   77 votes
3. Login Information and Credentials Have Been Leaked on wakatime.comInformation Disclosure
   74 votes
4. User Email Disclosure via ID-Based InvitationInformation Disclosure · medium
   73 votes
5. user api key leakedInformation Disclosure
   65 votes
6. Double Clickjacking Attack on WakaTime OAuth Authorization Flow at https://wakatime.com/oauth/authorizeViolation of Secure Design Principles · medium
   57 votes
7. Broken Access Control Exposes Email Verification Status and Privacy Settings via API EndpointImproper Access Control - Generic · low
   57 votes
8. previous token seems to work even though it does not verify emailViolation of Secure Design Principles · low
   35 votes
9. JSON CSRF on POST Heartbeats APICross-Site Request Forgery (CSRF) · medium
   34 votes
10. Add arbitrary content to Password Reset EmailCode Injection
    24 votes
11. IDOR create accounts and verify them with original account emailInsecure Direct Object Reference (IDOR) · low
    15 votes
12. Vulnerability Name: Host Header Injection RedirectOpen Redirect · low
    14 votes
13. Password Policy IssueImproper Authentication - Generic · low
    14 votes
14. [Privilege Escalation] Authenticated users can manipulate others fullname without their knowledgePrivilege Escalation · medium
    14 votes
15. Email Spoofing Via /api/v1/users/reset_passwordImproper Authentication - Generic
    14 votes
16. by pass rate limit exceed Improper Access Control - Generic
    12 votes
17. [Privilege Escalation] Authenticated users can manipulate others fullname without their knowledge [Team Vector]Privilege Escalation · medium
    12 votes
18. Password reset links should expire after being used, instead of at specific timeImproper Authentication - Generic · medium
    12 votes
19. Using an outdated version of OpenSSH on db01.wakatime.comInformation Disclosure · low
    11 votes
20. Two email addresses can access the same accountViolation of Secure Design Principles
    10 votes
21. No rate limit when creating new goals [https://wakatime.com/goals]Violation of Secure Design Principles
    10 votes
22. Leaking password reset token via referrer from external Twitter share buttonInformation Disclosure
    10 votes
23. Missing SPF FlagsViolation of Secure Design Principles · low
    10 votes
24. [wakatime.com] HTML Injection github-btn.htmlCross-site Scripting (XSS) - DOM · low
    9 votes
25. Lack of Password Confirmation When Changing EmailViolation of Secure Design Principles
    9 votes
26. No redirect uri for Twitter Oath resulting in token leakImproper Authentication - Generic · low
    9 votes
27. Users with member privilege are able to see emails and membership information of other usersInformation Disclosure · medium
    9 votes
28. Mailgun misconfiguration Privilege Escalation
    9 votes
29. Impersonation of Wakatime user using Invitation functionality.Violation of Secure Design Principles
    8 votes
30. Bypassing Access control, changing owner's name in a private leaderboardImproper Access Control - Generic · medium
    8 votes
31. No rate limiting for confirmation email, can spam anyone with confirmation emailsViolation of Secure Design Principles
    8 votes
32. Clickjacking on authorized page https://wakatime.com/share/embedUI Redressing (Clickjacking) · low
    8 votes
33. Blocking users to sign up on the siteViolation of Secure Design Principles
    7 votes
34. Missing filteration of meta characters in all full name field on wakatime.comViolation of Secure Design Principles · low
    7 votes
35. No notificatoin sent on email after account deletion.Violation of Secure Design Principles · low
    7 votes
36. Forgot password link doesn't expire after used, only after some hoursWeak Password Recovery Mechanism for Forgotten Password · low
    7 votes
37. Password token validation in https://wakatime.com/Improper Authentication - Generic · low
    7 votes
38. Private leaderboard owner email disclosure when sending invitesInformation Disclosure
    6 votes
39. No rate limit on creating private leaderboards.Improper Restriction of Authentication Attempts
    6 votes
40. https://wakatime.com/ website CSP "script-src" includes "unsafe-inline"Violation of Secure Design Principles · low
    6 votes
41. UI Redressing on Embedded ChartsUI Redressing (Clickjacking) · low
    6 votes
42. Missing Account Deletion Notification
    5 votes
43. SSH backdated version open portImproper Restriction of Authentication Attempts
    4 votes
44. Unsafe Inline and Eval CSP UsageViolation of Secure Design Principles · low
    4 votes
45. Rate Limit too lenient for endpoint sending emailsWeak Password Recovery Mechanism for Forgotten Password
    3 votes