Browse / Yelp

Yelp

See its reports on the map

What gets reported to Yelp

• Misconfiguration22
• Information Disclosure17
• Access Control7
• Authentication6
• Cross-Site Request Forgery4
• Cross-site Scripting3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. [engineeringblog.yelp.com] CRLF InjectionN/ACRLF Injection
   14 votes
2. Robots.txt file with potentially sensitive content.N/APrivacy Violation · low
   10 votes
3. Server-side request forgery (ssrf)N/AServer-Side Request Forgery (SSRF) · medium
   5 votes
4. IDOR(indirect object references) on add friend,complement and send message N/AViolation of Secure Design Principles
   5 votes
5. Autofill/Autosave password on loginN/AInsufficiently Protected Credentials · medium
   4 votes
6. CORS Misconfiguration on trust.yelp.comN/AMisconfiguration · medium
   4 votes
7. Fraudulent claim of business.N/Ahigh
   4 votes
8. Email flooding using user invitation feature in biz.yelp.com due to lack of rate limiting N/AViolation of Secure Design Principles · medium
   4 votes
9. no rate limit in forgot password sessionN/AImproper Restriction of Authentication Attempts · medium
   3 votes
10. If the website does not impose additional defense against CSRF attacks, failing to use the 'Lax' or 'Strict' values could increase the risk of exposurN/ACross-Site Request Forgery (CSRF) · low
    3 votes
11. Subdomain Takeover on delivey.yelp.com N/APhishing · low
    2 votes
12. Research papers on yelp are getting indexed by google bots.N/AInformation Disclosure
    2 votes