Reddit 的公开漏洞报告、类别分布与常见资产。
72公开报告
$50,700披露赏金
15漏洞类别
10主要弱点
攻击面
弱点类别分布
主要弱点
常见资产
- www.reddit.comURL · 31
- *.redditinc.comWILDCARD · 6
- *.reddit.comWILDCARD · 4
- com.reddit.frontpageGOOGLE_PLAY_APP_ID · 4
- oauth.reddit.comURL · 3
- accounts.reddit.comURL · 3
- old.reddit.comURL · 2
- ads-api.reddit.comURL · 2
- gql.reddit.comURL · 2
- *.redditgifts.comWILDCARD · 2
高票报告
当前状态 13 份 · 全部 72
- 47IDOR lets a malicious user reveal the unpinned achievement badges of any Reddit user不安全的直接对象引用 · 2024-08-09 · 低危$0IDOR
- 20Can use the Reddit android app as usual even though revoking the access of it from reddit.com身份认证 · 2022-07-16 · 严重$0会话过期不足
- 19Misconfigurated login page able to lock login action for any account without user interaction身份认证 · 2022-06-07 · 严重$0Unlabeled
- 16api keys leaked访问控制 · 2022-11-10 · 中危$0访问控制缺陷（通用）
- 11oauth misconfigration lead to account takeover访问控制 · 2023-05-18 · 未评级$0Incorrect Authorization
- 11HTML injection in API response including request url代码执行 · 2023-05-18 · 严重$0远程文件包含
- 11Application level DOS at Login Page ( Accepts Long Password )身份认证 · 2022-02-08 · 高危$0Unlabeled
- 11registering with the same email address multiple times leads to account takeover身份认证 · 2022-03-15 · 低危$0认证缺陷（通用）
- 10Open Redirect through POST Request in www.redditinc.com开放重定向 · 2022-07-09 · 中危$0开放重定向
- 8hardcoded api secret & api key in com.reddit.frontpage身份认证 · 2021-10-22 · 严重$0认证缺陷（通用）
- 6Regular Expression Denial of Service vulnerability拒绝服务 · 2022-04-12 · 中危$0资源消耗失控
- 6Broken links make users from France unable to understand the allowed content policy其他弱点 · 2023-05-18 · 低危$0Unlabeled
- 4S3 bucket Upload on studio.redditinc.com (s3-r-w.ap-east-1.amazonaws.com)访问控制 · 2021-10-22 · 低危$0访问控制缺陷（通用）