HexBrain
Sign in

Browse / Yelp

Yelp

74disclosed reports

See its reports on the map

What gets reported to Yelp

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. RCE on build server via misconfigured pip installDownload of Code Without Integrity Check · critical
    366 votes
  2. yelp.com XSS ATO (via login keylogger, link Google account)Cross-site Scripting (XSS) - Generic · high
    324 votes
  3. I.D.O.R To Order,Book,Buy,reserve On YELP FOR FREE (UNAUTHORIZED USE OF OTHER USER'S CREDIT CARD)Insecure Direct Object Reference (IDOR) · critical
    214 votes
  4. Object Level access control leads to reading user's full requests, sessions, and error messagesImproper Access Control - Generic · medium
    113 votes
  5. CRITICAL Insecure Direct Object Reference (I.D.O.R) - Link Other User's Credit Card Privacy Violation · high
    87 votes
  6. Access to internal CMS containing private DataImproper Authentication - Generic
    83 votes
  7. Unauthorized Reservation Cancellation Through IDOR VulnerabilityDuplicateInsecure Direct Object Reference (IDOR) · high
    79 votes
  8. Yelp for Business: locked Email field silently editable via APIClient-Side Enforcement of Server-Side Security · medium
    76 votes
  9. Privilege Escalation - A Non Owner User Who Does not Have access to the user management can invite other users to the restaurant pageImproper Access Control - Generic · low
    75 votes
  10. X-Forward-For Header allows to bypass access restrictionsImproper Access Control - Generic · medium
    73 votes
  11. Privilege Escalation - A Low Privilege User who does not have access to the user management module can remove the owner of the business accountImproper Access Control - Generic · low
    60 votes
  12. RXSS AT https://proze.yelp.com/tmsubscribe.net/vidsn.aspxCross-site Scripting (XSS) - Reflected · medium
    56 votes
  13. Debug Deep Link Abuse Allows Repeated Forced Logout and Application DisruptionViolation of Secure Design Principles · low
    54 votes
  14. Bybass The Closing of the account and logged again to your accountImproper Authentication - Generic
    34 votes
  15. I.D.O.R TO EDIT ALL USER'S CREDIT CARD INFORMATION+(Partial credit card info disclosure)Insecure Direct Object Reference (IDOR) · medium
    32 votes
  16. No rate limiting for confirmation email lead to email floodingViolation of Secure Design Principles · medium
    24 votes
  17. Multiple Vulnerabilities in (*.blog.yelp.com) - Leakage user admin Sensitive ExposureInformativeBusiness Logic Errors
    23 votes
  18. Able to download arbitrary PHP files at yelpblog.comPrivilege Escalation
    21 votes
  19. Information disclosure - emails disclosed in response > staging.seatme.usCross-Site Request Forgery (CSRF)
    21 votes
  20. CORS Misconfiguration on YelpInformativeMisconfiguration · medium
    19 votes
  21. CRITICAL-CLICKJACKING at Yelp Reservations Resulting in exposure of victim Private Data (Email info) + Victim Credit Card MissUse. Improper Access Control - Generic · medium
    18 votes
  22. Password reset token not expiringImproper Authentication - Generic
    18 votes
  23. Direct access to tox.ini file which is contain configuration detailsInsecure Storage of Sensitive Information · low
    15 votes
  24. DoS of https://blog.yelp.com/ and other WP instances via CVE-2018-6389InformativeUncontrolled Resource Consumption · medium
    15 votes
  25. [engineeringblog.yelp.com] CRLF InjectionN/ACRLF Injection
    14 votes
  26. No rate limit on subscribe form InformativeBusiness Logic Errors · medium
    13 votes
  27. Clickjacking Vulnerability found on YelpCross-Site Request Forgery (CSRF) · low
    13 votes
  28. CSRF on signup endpoint (auto-api.yelp.com)Cross-Site Request Forgery (CSRF)
    13 votes
  29. PURGE is not authenticatedInformativeImproper Authentication - Generic · low
    12 votes
  30. Leaking sensitive information lead to compromise employer API keysInsecure Storage of Sensitive Information · high
    12 votes
  31. IDNs displayed in unicode in messages/about/talk sections (Homograph Attack)Violation of Secure Design Principles
    12 votes
  32. Public Github Repo Leaking Internal Credentials InformativeInformation Disclosure · critical
    10 votes
  33. Robots.txt file with potentially sensitive content.N/APrivacy Violation · low
    10 votes
  34. Verification of email addresses possible through https://www.yelp.com/signup/facebookInformation Disclosure
    10 votes
  35. Verification of E-Mail address possible on https://biz.yelp.com/login and https://biz.yelp.com/forgotInformation Disclosure
    10 votes
  36. Self-XSS via location cookie city field when getting suggestions for a new locationInformativeCross-site Scripting (XSS) - Generic
    8 votes
  37. Clickjacking lead to remove reviewUI Redressing (Clickjacking) · medium
    7 votes
  38. Unauthorized Use of Victim Credit CardPrivacy Violation · low
    7 votes
  39. Firefly's verify_access_token() function does a byte-by-byte comparison of HMAC values.Cryptographic Issues - Generic
    7 votes
  40. X.509 certificate validation fails on international vanity domainsViolation of Secure Design Principles
    7 votes
  41. Requesting Show CheckIn Alert for Non Friend UserInformation Disclosure · low
    7 votes
  42. installed.json sensitive file was publicly accessible on your web application which discloses information about authors and admins InformativeInformation Disclosure · low
    6 votes
  43. Server-side request forgery (ssrf)N/AServer-Side Request Forgery (SSRF) · medium
    5 votes
  44. ClickJacking on IMPORTANT Functions of YelpUI Redressing (Clickjacking) · low
    5 votes
  45. Ngnix Server version disclosure 404 Page!InformativeInformation Disclosure
    5 votes
  46. IDOR(indirect object references) on add friend,complement and send message N/AViolation of Secure Design Principles
    5 votes
  47. Autofill/Autosave password on loginN/AInsufficiently Protected Credentials · medium
    4 votes
  48. CORS Misconfiguration on trust.yelp.comN/AMisconfiguration · medium
    4 votes
  49. xmlrpc file enabledDuplicateInformation Disclosure · low
    4 votes
  50. Fraudulent claim of business.N/Ahigh
    4 votes
  51. password field autocomplete enabledInformativeInsecure Storage of Sensitive Information · medium
    4 votes
  52. IDOR in locid parameter allowing to view others accounts Profile Locations InformativeBusiness Logic Errors · low
    4 votes
  53. Email flooding using user invitation feature in biz.yelp.com due to lack of rate limiting N/AViolation of Secure Design Principles · medium
    4 votes
  54. Nginx server version disclosure on engineeringblogInformativeInformation Disclosure
    4 votes
  55. Missing X-Frame-Options headerDuplicateUI Redressing (Clickjacking)
    4 votes
  56. no rate limit in forgot password sessionN/AImproper Restriction of Authentication Attempts · medium
    3 votes
  57. If the website does not impose additional defense against CSRF attacks, failing to use the 'Lax' or 'Strict' values could increase the risk of exposurN/ACross-Site Request Forgery (CSRF) · low
    3 votes
  58. JDBC credentials leaked via githubInformativeInformation Disclosure
    3 votes
  59. Content spoofing on yelp.oneloginInformativeOpen Redirect · low
    3 votes
  60. Subdomain Takeover on delivey.yelp.com N/APhishing · low
    2 votes
  61. Weak Password PolicyInformativeViolation of Secure Design Principles · low
    2 votes
  62. Research papers on yelp are getting indexed by google bots.N/AInformation Disclosure
    2 votes
  63. Click jacking in delete image of user in YelpDuplicateUI Redressing (Clickjacking) · medium
    2 votes
  64. Yelp.com is vulnerable to SWEET32 attackInformativeCryptographic Issues - Generic
    2 votes
  65. Clickjacking: X-Frame Header MissingInformativeUI Redressing (Clickjacking)
    2 votes
  66. Nginx version disclosure via forbidden pageInformativeInformation Disclosure · low
    1 votes
  67. ClickJacking DuplicateUI Redressing (Clickjacking)
    1 votes
  68. User can be fooled to Bookmark any restaurant by clickjackingInformativeUI Redressing (Clickjacking) · low
  69. ClickJacking in editing business nameInformativeUI Redressing (Clickjacking) · low
  70. One of yelp.com url is redirecting to domain which is not yet purchasedInformativeOpen Redirect
  71. Clickjacking @ Main Domain[www.yelp.com]InformativeUI Redressing (Clickjacking) · low
  72. [Yelp Blog] Backslash in search string causes JS errorInformativeViolation of Secure Design Principles
  73. Possible content spoofing due to missing error pageInformativeViolation of Secure Design Principles · low
  74. Error Page Text InjectionInformativeViolation of Secure Design Principles