POJIA破甲
查找接入 AI账户
地图 / Reddit

Reddit

Reddit 的公开漏洞报告、类别分布与常见资产。

72公开报告
$50,700披露赏金
15漏洞类别
10主要弱点

攻击面

下载 .txt

共 0 个子域名，0 个根域

加载中…

弱点类别分布

主要弱点

常见资产

高票报告

当前状态 72 份 · 全部 72

  1. 509
    One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.com访问控制 · 2022-08-02 · 严重
    $0访问控制缺陷（通用）
  2. 394
    [accounts.reddit.com] Redirect parameter allows for XSS跨站脚本 · 2023-05-18 · 高危
    $5,000XSS（通用）
  3. 344
    Blind SSRF to internal services in matrix preview_link API服务端请求伪造 · 2023-04-26 · 高危
    $6,000SSRF
  4. 296
    Exposed proxy allows to access internal reddit domains访问控制 · 2025-02-24 · 高危
    $7,500访问控制缺陷（通用）
  5. 280
    RichText parser vulnerability in scheduled posts allows XSS跨站脚本 · 2023-04-21 · 高危
    $5,000存储型 XSS
  6. 267
    Deleting all DMs on RedditGifts.com不安全的直接对象引用 · 2021-10-22 · 高危
    $5,000IDOR
  7. 238
    Infromation Disclosure To Use of Hard-coded Cryptographic Key密码学缺陷 · 2024-02-07 · 中危
    $0Use of Hard-coded Cryptographic Key
  8. 218
    XSS via Mod Log Removed Posts跨站脚本 · 2022-03-11 · 高危
    $0存储型 XSS
  9. 208
    IDOR allows an attacker to modify the links of any user不安全的直接对象引用 · 2022-09-30 · 高危
    $0IDOR
  10. 200
    Able to bypass email verification and change email to any other user email访问控制 · 2022-05-07 · 高危
    $5,000访问控制缺陷（通用）
  11. 191
    Able to approve admin approval and change effective status without adding payment details .业务逻辑 · 2022-06-22 · 高危
    $5,000业务逻辑错误
  12. 186
    Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.访问控制 · 2022-11-14 · 高危
    $0访问控制缺陷（通用）
  13. 166
    Reflected xss in https://sh.reddit.com跨站脚本 · 2022-05-08 · 高危
    $5,000反射型 XSS
  14. 163
    Getting access of mod logs from any public or restricted subreddit with IDOR vulnerability不安全的直接对象引用 · 2022-08-05 · 高危
    $5,000IDOR
  15. 157
    XSS Reflected on reddit.com via url path跨站脚本 · 2022-09-28 · 高危
    $0反射型 XSS
  16. 101
    Regression on dest parameter sanitization doesn't check scheme/websafe destinations跨站脚本 · 2023-06-03 · 中危
    $500反射型 XSS
  17. 96
    s3 bucket takeover presented in https://github.com/reddit/rpan-studio/blob/e1782332c75ecb2f774343258ff509788feab7ce/CI/full-build-macos.sh业务逻辑 · 2021-10-22 · 高危
    $0业务逻辑错误
  18. 72
    Reddit talk promotion offers don't expire, allowing users to accept them after being demoted不安全的直接对象引用 · 2022-10-03 · 中危
    $0IDOR
  19. 67
    GPS metadata preserved when converting HEIF to PNG信息泄露 · 2021-10-22 · 高危
    $0隐私侵犯
  20. 65
    Image queue default key of 'None' and GraphQL unhandled type exception内存破坏 · 2021-10-27 · 中危
    $500类型混淆
  21. 52
    Outsider can affect Upvote Percentage of private subreddit post by calling /api/vote API访问控制 · 2021-10-27 · 低危
    $0访问控制缺陷（通用）
  22. 47
    IDOR lets a malicious user reveal the unpinned achievement badges of any Reddit user不安全的直接对象引用 · 2024-08-09 · 低危
    $0IDOR
  23. 47
    CSRF (protection bypassed) to force a below 18 user into viewing an nsfw subreddit !跨站请求伪造 · 2022-06-16 · 中危
    $0跨站请求伪造
  24. 44
    Hash-Collision Denial-of-Service Vulnerability in Markdown Parser拒绝服务 · 2021-10-22 · 中危
    $0资源消耗失控
  25. 42
    IDOR to pay less for coin purchases on oauth.reddit.com via /api/v2/gold/paypal/create_coin_purchase_order in `order_id` parameter业务逻辑 · 2021-10-22 · 中危
    $500业务逻辑错误
第 1 / 3 页下一页 →