Browse / Yelp

Yelp

See its reports on the map

What gets reported to Yelp

• Misconfiguration22
• Information Disclosure17
• Access Control7
• Authentication6
• Cross-Site Request Forgery4
• Cross-site Scripting3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. RCE on build server via misconfigured pip installDownload of Code Without Integrity Check · critical
   366 votes
2. yelp.com XSS ATO (via login keylogger, link Google account)Cross-site Scripting (XSS) - Generic · high
   324 votes
3. I.D.O.R To Order,Book,Buy,reserve On YELP FOR FREE (UNAUTHORIZED USE OF OTHER USER'S CREDIT CARD)Insecure Direct Object Reference (IDOR) · critical
   214 votes
4. Object Level access control leads to reading user's full requests, sessions, and error messagesImproper Access Control - Generic · medium
   113 votes
5. CRITICAL Insecure Direct Object Reference (I.D.O.R) - Link Other User's Credit Card Privacy Violation · high
   87 votes
6. Access to internal CMS containing private DataImproper Authentication - Generic
   83 votes
7. Yelp for Business: locked Email field silently editable via APIClient-Side Enforcement of Server-Side Security · medium
   76 votes
8. Privilege Escalation - A Non Owner User Who Does not Have access to the user management can invite other users to the restaurant pageImproper Access Control - Generic · low
   75 votes
9. X-Forward-For Header allows to bypass access restrictionsImproper Access Control - Generic · medium
   73 votes
10. Privilege Escalation - A Low Privilege User who does not have access to the user management module can remove the owner of the business accountImproper Access Control - Generic · low
    60 votes
11. RXSS AT https://proze.yelp.com/tmsubscribe.net/vidsn.aspxCross-site Scripting (XSS) - Reflected · medium
    56 votes
12. Debug Deep Link Abuse Allows Repeated Forced Logout and Application DisruptionViolation of Secure Design Principles · low
    54 votes
13. Bybass The Closing of the account and logged again to your accountImproper Authentication - Generic
    34 votes
14. I.D.O.R TO EDIT ALL USER'S CREDIT CARD INFORMATION+(Partial credit card info disclosure)Insecure Direct Object Reference (IDOR) · medium
    32 votes
15. No rate limiting for confirmation email lead to email floodingViolation of Secure Design Principles · medium
    24 votes
16. Able to download arbitrary PHP files at yelpblog.comPrivilege Escalation
    21 votes
17. Information disclosure - emails disclosed in response > staging.seatme.usCross-Site Request Forgery (CSRF)
    21 votes
18. CRITICAL-CLICKJACKING at Yelp Reservations Resulting in exposure of victim Private Data (Email info) + Victim Credit Card MissUse. Improper Access Control - Generic · medium
    18 votes
19. Password reset token not expiringImproper Authentication - Generic
    18 votes
20. Direct access to tox.ini file which is contain configuration detailsInsecure Storage of Sensitive Information · low
    15 votes
21. Clickjacking Vulnerability found on YelpCross-Site Request Forgery (CSRF) · low
    13 votes
22. CSRF on signup endpoint (auto-api.yelp.com)Cross-Site Request Forgery (CSRF)
    13 votes
23. Leaking sensitive information lead to compromise employer API keysInsecure Storage of Sensitive Information · high
    12 votes
24. IDNs displayed in unicode in messages/about/talk sections (Homograph Attack)Violation of Secure Design Principles
    12 votes
25. Verification of email addresses possible through https://www.yelp.com/signup/facebookInformation Disclosure
    10 votes
26. Verification of E-Mail address possible on https://biz.yelp.com/login and https://biz.yelp.com/forgotInformation Disclosure
    10 votes
27. Clickjacking lead to remove reviewUI Redressing (Clickjacking) · medium
    7 votes
28. Unauthorized Use of Victim Credit CardPrivacy Violation · low
    7 votes
29. Firefly's verify_access_token() function does a byte-by-byte comparison of HMAC values.Cryptographic Issues - Generic
    7 votes
30. X.509 certificate validation fails on international vanity domainsViolation of Secure Design Principles
    7 votes
31. Requesting Show CheckIn Alert for Non Friend UserInformation Disclosure · low
    7 votes
32. ClickJacking on IMPORTANT Functions of YelpUI Redressing (Clickjacking) · low
    5 votes