EXNESS
EXNESS 的公开漏洞报告、类别分布与常见资产。
14公开报告
$3,600披露赏金
6漏洞类别
7主要弱点
攻击面
弱点类别分布
主要弱点
常见资产
- Personal Area for Web TradingOTHER · 5
- com.exness.android.paOTHER_APK · 1
- com.exness.investmentsGOOGLE_PLAY_APP_ID · 1
- exnessaffiliates.comURL · 1
- Logical trading issuesOTHER · 1
- PartnershipOTHER · 1
- Public Area for Web TradingOTHER · 1
- pwapi.ex2b.comURL · 1
- api.excalls.mobiURL · 1
- Web TerminalOTHER · 1
高票报告
当前状态 14 份 · 全部 14
- 261SSRF in graphQL query (pwapi.ex2b.com)服务端请求伪造 · 2023-07-25 · 中危$3,000SSRF
- 120Blind SSRF on https://my.exnessaffiliates.com/ allows for internal network enumeration服务端请求伪造 · 2023-10-25 · 中危$0SSRF
- 97Unrestricted Access to Celery Flower Instance其他弱点 · 2023-12-14 · 高危$0Unlabeled
- 58IDOR in Stats API Endpoint Allows Viewing Equity or Net Profit of Any MT Account不安全的直接对象引用 · 2022-12-05 · 中危$0IDOR
- 32Taking position in a discontinued forex pair without executing any trades其他弱点 · 2022-04-13 · 中危$0Unlabeled
- 26[com.exness.android.pa Android] Universal XSS in webview. Lead to steal user cookies访问控制 · 2022-05-24 · 低危$400访问控制缺陷（通用）
- 25Verification process done using different documents without corresponding to user information / User information can be changed after verification业务逻辑 · 2023-01-28 · 中危$0业务逻辑错误
- 25Access control vulnerability (read-only)不安全的直接对象引用 · 2022-04-13 · 中危$0IDOR
- 22Access control vulnerability (read/write)不安全的直接对象引用 · 2022-04-13 · 中危$0IDOR
- 16Double forward slash breaks server-side restrictions & allows access to prohibited services from a partner account其他弱点 · 2023-02-10 · 低危$0Unlabeled
- 15CRLF Injection - Http Response Splitting注入与走私 · 2022-04-13 · 低危$200CRLF 注入
- 12Acess control vulnerability (read/write)不安全的直接对象引用 · 2022-04-13 · 中危$0IDOR
- 11Improper Implementation of SDK Allows Universal XSS in Webview Leading to Account Takeover访问控制 · 2022-04-13 · 低危$0访问控制缺陷（通用）
- 9subdomain takeover at odoo-staging.exness.io访问控制 · 2022-07-18 · 低危$0权限提升