地图 / 业务逻辑错误

业务逻辑错误

Business Logic Errors · 业务逻辑

业务逻辑 / 业务逻辑错误

392公开报告

—CWE 编号

0已标注发现方式

392关联报告

发现方式分布

暂无发现方式标注。

关联报告

Modify in-flight data to payment provider Smart2PayValve · 2021-08-10 · 高危 · $7,500 · 443 票 H1514 Ability to MiTM Shopify PoS Session to Takeover CommunicationsShopify · 2019-11-04 · 低危 · 372 票 Hackerone is not properly deleting user idHackerOne · 2021-06-11 · 低危 · 356 票 Double Payout via PayPalCoinbase · 2018-04-04 · 高危 · $10,000 · 324 票 Getting New Invitations without Leaving ProgramsHackerOne · 2020-10-15 · 低危 · 322 票 [fleet.city-mobil.ru] Driver balance increasingMail.ru · — · 未评级 · 319 票 Race Condition allows to redeem multiple times gift cards which leads to free "money"Reverb.com · 2020-01-25 · 中危 · 308 票 An attacker can run pipeline jobs as arbitrary userGitLab · 2020-08-26 · 高危 · $12,000 · 307 票 Ethereum account balance manipulationCoinbase · 2018-03-21 · 高危 · 276 票 An attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business lossSemrush · 2020-04-02 · 中危 · 267 票 Fee discounts can be redeemed many times, resulting in unlimited fee-free transactionsStripe · 2023-02-25 · 低危 · $5,000 · 266 票 Change phone number OTP flaw leads to any phone number takeoverinDrive · 2024-10-09 · 高危 · $2,000 · 241 票 [www.zomato.com] Availing Zomato Gold membership for free by tampering plan id(s)Eternal · 2019-03-18 · 低危 · 229 票 Config override using non-validated query parameter allows at least reflected XSS by injecting configuration into stateSuperhuman (formerly Grammarly) · 2021-03-01 · 低危 · 223 票 ETH contract handling errorsCoinbase · 2018-04-04 · 高危 · 208 票 Able to approve admin approval and change effective status without adding payment details .Reddit · 2022-06-22 · 中危 · $5,000 · 191 票 adding h1_analyst_* to username for normal usersHackerOne · 2023-04-12 · 低危 · $500 · 187 票 OLO Total price manipulation using negative quantitiesUpserve · 2019-07-06 · 高危 · 167 票 Abusing "Report as abuse" functionality to delete any user's post.Vanilla · — · 未评级 · $300 · 160 票 2-factor authentication can be disabled when logged in without confirming account passwordLocalize · 2020-02-10 · 低危 · 159 票 Takeover of Twitter-owned domain at mobileapplinking.comX / xAI · 2019-02-28 · 低危 · 159 票 Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.comHackerOne · 2019-04-05 · 低危 · 154 票 Steal collateral during `end` process, by earning DSR interest after `flow`.BlockDev Sp. Z o.o · 2019-09-09 · 中危 · 152 票 Bypassing CORS Misconfiguration Leads to Sensitive ExposureU.S. Dept Of Defense · 2020-05-14 · 低危 · 145 票 [blog.makerdao.com] Multiple Vulnerabilities - Leads to leakage user admin sensitive exposureBlockDev Sp. Z o.o · 2020-04-14 · 未评级 · 140 票 Bypassing HackerOne 2FA due to race conditionHackerOne · 2024-10-30 · 低危 · 139 票 worki.ru: SMS code bruteforceMail.ru · — · 未评级 · $1,657 · 136 票 [api.zomato.com] Able to manipulate order amountEternal · 2019-04-16 · 中危 · 136 票 Business Logic Error – Bypass of OTP Verification During Signup on hover.comTucows (VDP) · 2025-09-02 · 低危 · 135 票 Add upto 10K rupees to a wallet by paying an arbitrary amountEternal · 2022-02-23 · 中危 · $2,000 · 132 票 Able to manipulate order amount by removing cancellation amount and cause financial impactEternal · 2019-08-16 · 中危 · 130 票 Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended ProductsTikTok · 2024-07-19 · 低危 · $1,000 · 129 票 Non-premium user can disable Ads in japanese version of dic.pixiv.netpixiv · 2026-04-27 · 中危 · $3,000 · 123 票 Any user could upload attachments to pentest scoping form they don't have access toHackerOne · 2024-05-15 · 中危 · 121 票 Account recovery text message is sending a wrong domain to users.HackerOne · 2019-05-31 · 低危 · 117 票 @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant.HackerOne · 2019-01-02 · 低危 · 117 票 critical server misconfiguration lead to access to any user sensitive data which include user email and passwordFlickr · 2021-11-02 · 低危 · $500 · 116 票 Availing Zomato gold by using a random third-party `wallet_id`Eternal · 2020-08-07 · 高危 · $2,000 · 116 票 [help.steampowered.com] Account takeover bruteforcing SteamGuardValve · 2019-01-23 · 中危 · $2,500 · 112 票 Unlimited fake rate to the passenger in city to city, Affected endpoint `/api/v1/reviews/ride/<ID>/driver`inDrive · 2024-07-02 · 低危 · 110 票 Ability to perform actions (Tweet, Retweet, DM) and other actions, unauthenticated, on any account with SMS enabled.X / xAI · 2019-09-26 · 高危 · 106 票 [stories.showmax.com] Cross Origin Misconfiguration - Sensitive Information ExposureShowmax · — · 未评级 · 104 票 Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding featureHackerOne · 2018-04-18 · 低危 · $2,500 · 103 票 Subdomain takeover of fr1.vpn.zomans.comEternal · 2021-09-17 · 低危 · $350 · 99 票 s3 bucket takeover presented in https://github.com/reddit/rpan-studio/blob/e1782332c75ecb2f774343258ff509788feab7ce/CI/full-build-macos.shReddit · 2021-10-21 · 中危 · 96 票 Race condition on add 1 free domainAutomattic · 2025-05-09 · 低危 · 93 票 Cloud Computer Hackerone Triager can be Accessible for everyone [[email protected]] computerHackerOne · 2024-05-10 · 低危 · 91 票 Multiple vulnerability leading to account takeover in TikTok SMB subdomain.TikTok · 2022-02-02 · 高危 · 91 票 Misconfigured oauth leads to Pre account takeoverBumble · 2021-03-18 · 低危 · 90 票 Bypassing the block of Security Domain Restriction and normally invite blocked domains with special characters “İ”Frontegg · 2024-03-20 · 低危 · 88 票 Authorization Bypass in Starknet Snap via enableAuthorize parameter leads to unauthorized transaction signingMetaMask · 2026-03-13 · 低危 · $350 · 86 票 Bypass Email verification for monitoring at `monitor.mozilla.org`Mozilla · 2025-01-22 · 低危 · 85 票 Ability to getting Twitter Blue verified badge without purchase itX / xAI · 2024-02-22 · 低危 · 85 票 Bypass invite accept for victimSlack · 2023-02-17 · 低危 · 84 票 No rate limiting for confirmation email lead to huge Mass mailingsNextcloud · 2020-11-04 · 低危 · 82 票 Lack of proper paymentProfileUUID validation allows any number of free rides without any outstanding balanceUber · 2019-07-18 · 低危 · 82 票 Manipulating response leads to free access to Streamlabs PrimeLogitech · 2021-01-21 · 低危 · 80 票 Business Logic Bypass Allows Setting “Read Access” Role Without Pro Plan SubscriptionLovable VDP · 2026-03-16 · 低危 · 78 票 [www.zomato.com] Tampering with Order Quantity and paying less amount then actual amount, leads to business lossEternal · 2018-09-17 · 中危 · 78 票 IDOR - Scheduled data leak to other accounts By "projectID"SingleStore · 2025-08-12 · 低危 · 77 票 Domain pointing to vimeo portfolio are prone to takeover using on-demand.Vimeo · 2018-08-27 · 中危 · 77 票 Exposure of shopify employee summit page allows anonymous user to place orders for free booksShopify · 2024-07-29 · 低危 · 76 票 Asset Inventory Internal Descriptions are leaked in CSV exportHackerOne · 2023-07-12 · 低危 · 76 票 Race Condition of Transfer data Credits to Organization Leads to Add Extra free Data Credits to the OrganizationHelium · 2020-11-27 · 低危 · $250 · 74 票 Дюп предметов lootdog и возможность их продавать.Mail.ru · — · 未评级 · $5,000 · 73 票 Availability Impact from Exploiting Project Name VulnerabilitiesDoppler · 2024-11-13 · 低危 · $250 · 71 票 Subdomain takeover of images.crossinstall.comX / xAI · 2022-01-05 · 中危 · 71 票 Improper use of "path" parameter can be used to trick testers into leaking their Front-End PoCBugPoC · — · 未评级 · $1,000 · 71 票 myshopify.com domain takeoverShopify · 2018-02-27 · 低危 · 71 票 Claiming ownership of GitHub handles via forked GitHub gists.Keybase · — · 未评级 · $1,000 · 71 票 Exceed the maximum number of subscribers using Race ConditionSingleStore · 2025-08-12 · 低危 · 70 票 Attackers can *Upgrade and claim offer* on the Premium Trial Subscription with a total price of *IDR0.00* from the original *IDR7,022,061.82*LinkedIn · 2024-06-18 · 中危 · 70 票 WordPress Plugin Update Confusion at trafficfactory.comTraffic Factory · 2021-11-25 · 低危 · $200 · 70 票 Unlimited Reuse of Coupon Code Allows Free Shipping on All Orders on ██████████AWS VDP · 2026-02-09 · 低危 · 69 票 attacker can book unlimited tickets in free at https://aaf.com/checkout/order-received/21237/?key=wc_order_5bbef48fa35b2Alliance of American Football · 2019-04-25 · 中危 · 68 票 Lack of payment type validation in dial.uber.com allows for free ridesUber · 2018-11-20 · 中危 · 68 票 Bypass subscriptionImgur · 2020-12-13 · 低危 · 67 票 Unlock underage blocked app without support interaction using airplane modeTools for Humanity · 2025-06-30 · 低危 · $300 · 66 票 Race Condition in Folder Creation Allows Bypassing Folder LimitDust · 2025-04-29 · 低危 · 65 票 Improper input validation in emoji field leads to sidebar UI denial of serviceNextcloud · 2026-09-20 · 低危 · 64 票 Minor security issue with Hackerone Invitations from sandbox programHackerOne · 2024-07-22 · 低危 · 64 票 Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changesNextcloud · 2026-09-17 · 低危 · $150 · 63 票 Bypassing Bronze Partner Wallet Restriction to Accept Trips with Negative BalanceBykea · 2025-06-13 · 低危 · 63 票 Earn free DAI interest (inflation) through instant CDP+DSR in one txBlockDev Sp. Z o.o · 2019-08-12 · 中危 · 63 票 Exceeding the limit of Workspaces via Race ConditionSingleStore · 2025-10-06 · 低危 · 62 票 Attacker can add two free bags offered by the site at the same time.Mars · 2024-06-25 · 低危 · 62 票 Incorrect logic when buy one more license which may lead to extend the expire date of existing licensePortSwigger Web Security · 2024-04-16 · 未评级 · 61 票 Bypassing x profile verification to receive instant blue checkmark and unlimited profile changesX / xAI · 2024-03-26 · 低危 · $250 · 60 票 Steam chat - trade offer presentation vulnerabilityValve · 2020-02-19 · 低危 · 60 票 File sizes may be manipulated into negative numbers when uploadingLY Corporation · 2024-07-10 · 低危 · $500 · 59 票 Attachments may be hijacked via AppCache+CookieBombing trick (bc3_production_blobs bucket)Basecamp · 2020-11-26 · 中危 · 57 票 Обход комиссии на переводыQIWI · — · 未评级 · 56 票 Lack of minimum value bid wheel verification on customer_bid in Rental TripsBykea · 2025-11-20 · 低危 · 55 票 Subdomain takeover of www█████████.affirm.comAffirm · 2021-08-18 · 低危 · $500 · 55 票 No rate limiting for subscribe email + lead to Cross origin misconfigurationStripo Inc · 2020-11-30 · 低危 · 54 票 Email Forwarding invitations for Drafts are not marked as accepted, allowing multiple users to join a program after disabling Email ForwardingHackerOne · 2018-04-18 · 低危 · $500 · 54 票 Premium Email Address Check Bypass - HeyBasecamp · 2020-12-15 · 低危 · 53 票 Password Strength Policy Bypass via Server-Side Validation FlawTucows (VDP) · 2026-03-27 · 低危 · 52 票 User Limit Bypass via Pending Invitations in Workspace SystemDust · 2025-04-29 · 低危 · 51 票 Able to use 'PREMIUM TEMPLATES' in 'FREE PLAN' at [https://my.stripo.email/cabinet/#/my-templates/]Stripo Inc · 2021-01-25 · 中危 · 51 票

查看全部 392 份报告 →