Browse / WePay

WePay

See its reports on the map

What gets reported to WePay

• Cross-Site Request Forgery5
• Cross-site Scripting3
• Access Control3
• Authentication3
• Misconfiguration3
• Information Disclosure2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Reflected XSS in the IE 11 / Edge (latest versions) on the stage-go.wepay.comCross-site Scripting (XSS) - Reflected
   $10023 votes
2. Active mixed content issues on the site https://stage-go.wepay.com.Man-in-the-Middle
   $10019 votes
3. open 80 port of internal host leaking some configuration infoInformation Exposure Through Debug Information
   $10013 votes
4. [stage-go.wepay.com] XSS via Request URICross-site Scripting (XSS) - Reflected
   $10012 votes
5. Enumeration of registered email addresses using bruteforce search on userIdsInformation Disclosure
   $20011 votes
6. Invited users can modify and/or remove account owner Privilege Escalation
   $25010 votes
7. 2-step Verification bypassImproper Authentication - Generic
   $1505 votes
8. Critical : Account removing using CSRF attackCross-Site Request Forgery (CSRF)
   $3505 votes
9. Session FixationImproper Authentication - Generic
   $5004 votes
10. Unauthenticated Stored XSS in API PanelCross-site Scripting (XSS) - Generic
    $1002 votes
11. Subdomain Takeover in http://staging.wepay.com/ pointing to FastlyPrivilege Escalation
    $1002 votes
12. Session fixation in wepay.comViolation of Secure Design Principles
    $1002 votes
13. Unauthorized Access via Join Email LinkViolation of Secure Design Principles
    $1001 votes
14. CSRF on email address operations. Also performing unintended operations. Cross-Site Request Forgery (CSRF)
    $1501 votes
15. CSRF & Nonce Token Weak ImplementationCross-Site Request Forgery (CSRF)
    1 votes
16. Broken Authentication – Session Token bugUI Redressing (Clickjacking)
17. Horizontal Privilege EscalationPrivilege Escalation
    $350
18. CSRF (Make email primary) may lead to account compromiseCross-Site Request Forgery (CSRF)
19. oauth redirect uri validation bug leads to open redirect and account compromiseOpen Redirect
20. Typical form vulnerable to csrf attackCross-Site Request Forgery (CSRF)
21. Open RedirectOpen Redirect
    $300
22. Sensitive settings need Re authenticationImproper Authentication - Generic