地图 / 错误配置

错误配置

Misconfiguration · 错误配置

错误配置 / 错误配置

83公开报告

—CWE 编号

0已标注发现方式

83关联报告

发现方式分布

暂无发现方式标注。

关联报告

Spring Actuator endpoints publicly available and broken authenticationLY Corporation · 2020-08-06 · 高危 · $12,500 · 234 票 Internal Access to Hackerone confluence DocsHackerOne · 2025-08-15 · 中危 · $12,500 · 227 票 Ability To Delete User(s) Account Without User InteractionGitLab · 2021-03-17 · 中危 · 221 票 Spring Actuator endpoints publicly available, leading to account takeoverLY Corporation · 2020-08-04 · 高危 · $5,000 · 143 票 Session Cookie Leakage via Static Header Field in WebViewerFragmentLinkedIn · 2026-03-17 · 中危 · 131 票 Wordpress Takeover using setup configuration at http://████.edu [HtUS]U.S. Dept Of Defense · 2023-01-13 · 高危 · $1,000 · 102 票 Mass account takeover!Stripe · 2022-12-21 · 中危 · 101 票 Exposed Cortex API at https://cortex-ingest.shopifycloud.com/Shopify · 2022-12-02 · 低危 · $6,300 · 101 票 Cross-origin resource sharing misconfig | steal user informationSemrush · 2017-12-17 · 低危 · 97 票 Complete Admin account takeover due to PhpDebugBar turned on in Uber's production serverUber · 2023-08-23 · 低危 · 90 票 Subdomain takeover in Gitlab pagesGitLab · 2024-10-09 · 低危 · 79 票 Subdomain takeover on one of the subdomain under mozaws.netMozilla · 2024-01-04 · 低危 · 79 票 Subdomain takeover on a subdomain under firefox.comMozilla · 2025-07-03 · 低危 · $500 · 75 票 Remove obsolete domain from handbook subdomainGitLab · 2024-10-01 · 低危 · 72 票 Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████Essity · 2026-09-18 · 高危 · 68 票 [ addons-preview-cdn.mozilla.net ] A subdomain takeover is available via unregistered domain in FastlyMozilla · 2024-12-06 · 低危 · $500 · 66 票 Register & create a ticket as somebody else on HackerOne SupportHackerOne · 2023-07-31 · 低危 · 56 票 Graphql introspection is enabled and leaks details about the schemaOn · 2021-05-09 · 低危 · 56 票 2M Reports on HackerOne Celebration! - Ability to bulk-submit many reports.HackerOne · 2023-07-11 · 低危 · 54 票 Subdomain takeover on one of the subdomains under mozaws.netMozilla · 2024-07-25 · 低危 · 52 票 phpinfo() exposed on ██████████Mars · 2024-11-21 · 低危 · 51 票 RC Between GitHub's Repo Update REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access RetentionGitHub · 2024-09-17 · 低危 · 50 票 RC Between GitHub's Repo Transfer REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access RetentionGitHub · 2024-01-12 · 低危 · 50 票 Subdomain takeover on one of the subdomain under mozaws.netMozilla · 2024-02-11 · 低危 · 49 票 Unauthenticated Varnish Cache PurgeAdobe · — · 未评级 · 44 票 Subdomain takeover on one of the subdomain under mozaws.netMozilla · 2024-01-04 · 低危 · 44 票 Subdomain takeover on one of the subdomain under mozaws.netMozilla · 2024-02-03 · 低危 · 41 票 Subdomain takeover on one of the subdomain under mozaws.netMozilla · 2024-01-04 · 低危 · 40 票 subdomain takeover at █████████Mars · 2023-11-15 · 中危 · 40 票 Subdomain takeover on one of the subdomain under mozgcp.netMozilla · 2023-11-12 · 低危 · 39 票 Delimiter injection in GitHub Actions core.exportVariableGitHub · 2022-08-18 · 低危 · $4,617 · 39 票 Misconfiguration in AWS CloudFront CDN configuration makes rubygems.org serve (and cache) content from a unclaimed S3-bucketInternet Bug Bounty · 2023-12-07 · 低危 · 38 票 Subdomain takeover on one of the subdomain under mozaws.netMozilla · 2024-01-04 · 低危 · 37 票 Weak password policy leading to exposure of administrator account accessU.S. General Services Administration · 2021-05-20 · 高危 · 37 票 phpinfo() exposed on ██████████Mars · 2024-11-21 · 未评级 · 36 票 Subdomain takeover on one of the subdomains under mozaws.netMozilla · 2024-07-25 · 低危 · 34 票 No error thrown when IDOR attempted while editing addressOpenMage · 2021-04-26 · 低危 · 33 票 Bitly link takeoverYahoo! · — · 未评级 · 32 票 Subdomain takeover on 'de-headless.staging.gymshark.com'Gymshark · 2022-10-27 · 中危 · 31 票 Subdomain takeover on one of the subdomain under mozgcp.netMozilla · 2023-11-12 · 低危 · 29 票 Memory Dump and Env Disclosure via Spring Boot ActuatorStripo Inc · 2021-03-02 · 低危 · 27 票 The `stripe/veneur` GitHub repository links to a domain `veneur.org`, which is not under stripe's controlStripe · 2023-07-03 · 低危 · 26 票 Social media link hijack of team member [Linkedin] at https://mackeeper.com/team/Clario · 2021-04-21 · 低危 · 26 票 unclaimed subdomain special.rkeeper.ru to takeover from tilda.ccMail.ru · — · 未评级 · 26 票 Incoming email hijacking on sc-cdn.netSnapchat · 2016-09-23 · 未评级 · 25 票 Subdomain takeover on one of the subdomain under mozgcp.netMozilla · 2023-11-12 · 低危 · 22 票 Mirror of https://city-mobil.ru admin interfaceMail.ru · — · 未评级 · $150 · 22 票 CORS bypass on TikTok Ads EndpointTikTok · 2020-12-31 · 低危 · $257 · 19 票 Subdomain Takeover due to unclaimed domain pointing to Acquia CloudInsulet Corporation · 2021-01-14 · 中危 · 18 票 GraphQL introspection query works through unauthenticated WebSocketNuri · 2021-01-09 · 低危 · 17 票 Enumerating HackerOne PentestsHackerOne · 2021-08-25 · 低危 · 16 票 [OPEN S3 BUCKET] All uploaded files are public.Courier · 2021-04-01 · 低危 · 16 票 Security misconfigurationlemlist · 2022-05-16 · 中危 · 15 票 Information Leakage via TikTok Ads Web Cache DeceptionTikTok · 2022-03-31 · 低危 · 14 票 Route53 Subdomain Takeover on test-cncf-aws.canary.k8s.ioKubernetes · 2021-01-16 · 中危 · 13 票 Subdomain Takeover on proxies.sifchain.finance pointing to vercelSifchain · 2022-04-01 · 中危 · 12 票 Мисконфигурация Cisco Smart InstallAzbuka Vkusa · 2021-11-16 · 高危 · 12 票 Password reset token leakageUPchieve · 2022-03-26 · 中危 · 12 票 Django DEBUG mode enabled and leaked system information.Dropcontact · 2020-08-21 · 中危 · 12 票 Helpdesk takeover (subdomain takeover) in razerzone.com domain via unclaimed Zendesk instanceRazer · — · 未评级 · $250 · 12 票 Угон домена photo-test.gb.ru (возможно)Mail.ru · — · 未评级 · 11 票 CORS MisconfigurationSifchain · 2021-05-12 · 低危 · 11 票 vk.com profile page takeover on https://cabinet.am.ru/Mail.ru · — · 未评级 · 10 票 Subdomain takeover on one of the subdomain under mozgcp.netMozilla · 2024-02-11 · 低危 · 8 票 Missing SPF record on trycourier.appCourier · 2022-02-17 · 低危 · 8 票 Wrong implementation of Telegram link on the main page for PC usersSifchain · 2021-06-12 · 低危 · 8 票 Захват домена ozoncorporate.ruOzon · 2021-05-28 · 低危 · 8 票 Dependecy Confusion via Lookup Request Forwarding to PyPi.orgGitLab · 2022-11-21 · 未评级 · 6 票 Password ReuseUPchieve · 2022-03-26 · 低危 · 6 票 Wrong Url in Main PageSifchain · 2021-05-12 · 低危 · $200 · 6 票 wrong url in hackerone > goes to wix.com > unconnectedSifchain · 2021-05-07 · 低危 · 5 票 mailgun subdomain takeover on "email.mail.geekbrains.ru"Mail.ru · — · 未评级 · 5 票 Subdomain takeover on one of the subdomain under mozaws.netMozilla · 2024-02-11 · 低危 · 4 票 Outdated Copyright Message @ Welcome emailUPchieve · 2022-03-26 · 低危 · 4 票 Missing Validation in editing "Your Phone Number"UPchieve · 2022-03-26 · 低危 · 4 票 Error Page Text Injection (no compromise)WHO COVID-19 Mobile App · 2021-02-13 · 低危 · 4 票 misconfigured CORS let to HPP and SOP bypassBTFS · 2020-05-07 · 中危 · 4 票 Subdomain takeover on one of the subdomain under mozaws.netMozilla · 2024-02-11 · 低危 · 3 票 Subdomain takeover on one of the subdomain under mozaws.netMozilla · 2024-02-11 · 低危 · 3 票 [staging.tarantool.org] Github Pages Subdomain-take-overMail.ru · — · 未评级 · 2 票 Misconfiguration Certificate Authority Authorization RuleSifchain · 2021-12-09 · 低危 · 1 票 Wrong Implementation of Url in https://docs.sifchain.finance/Sifchain · 2021-12-09 · 低危 · 0 票 Wrong Url in Main page of sifchain.financeSifchain · 2021-12-09 · 低危 · 0 票