Chaturbate - HackerOne Reports
View on HackerOne52
Total Reports
1
Critical
4
High
14
Medium
28
Low
Leaking Username and Password in the URLs via Virustotal, can leads to account takeover
Reported by:
sumit7
|
Disclosed:
Weakness: Information Exposure Through Sent Data
Open redirection at https://chaturbate.com/auth/login/
Reported by:
shailesh4594
|
Disclosed:
Low
Weakness: Open Redirect
Blind SSRF at https://chaturbate.com/notifications/update_push/
Reported by:
robin0oklay
|
Disclosed:
High
Weakness: Server-Side Request Forgery (SSRF)
Stored XSS against all Chaturbate users using an application name
Reported by:
nahamsec
|
Disclosed:
Medium
Weakness: Cross-site Scripting (XSS) - Stored
[chatws25.stream.highwebmedia.com] - Reflected XSS in c parameter
Reported by:
kazan71p
|
Disclosed:
Medium
Weakness: Cross-site Scripting (XSS) - Reflected
Bounty: $350.00
CSRF on change video thumbnail at https://chaturbate.com
Reported by:
avinash_
|
Disclosed:
Low
Weakness: Cross-Site Request Forgery (CSRF)
A 10GB file is reachable
Reported by:
apt-mirror
|
Disclosed:
Weakness: Information Disclosure
Web cache deception attack - expose token information
Reported by:
memon
|
Disclosed:
Medium
Weakness: Information Disclosure
Reflected XSS on secure.chaturbate.com
Reported by:
glc
|
Disclosed:
High
Weakness: Cross-site Scripting (XSS) - Reflected
Bounty: $800.00
No rate limit in affiliate statsapi endpoint
Reported by:
maximus-decimus-meridius
|
Disclosed:
Low
Weakness: Improper Restriction of Authentication Attempts
Open redirect on chaturbate.com (tipping/purchase_success)
Reported by:
glc
|
Disclosed:
Low
Weakness: Open Redirect
Bounty: $250.00
No rate limit in stats api token endpoint
Reported by:
maximus-decimus-meridius
|
Disclosed:
Low
Weakness: Improper Restriction of Authentication Attempts
Camo Image Proxy Bypass with CSS Escape Sequences
Reported by:
zhutyra
|
Disclosed:
Low
Weakness: Improper Neutralization of Escape, Meta, or Control Sequences
[chaturbate.com] - CSRF Vulnerability on image upload
Reported by:
corb3nik
|
Disclosed:
Medium
Bounty: $300.00
DoS attacks utilizing camo.stream.highwebmedia.com
Reported by:
teuvokas
|
Disclosed:
Medium
Weakness: Uncontrolled Resource Consumption
Bounty: $400.00
Internal loop going to infinite for cb.setTimeout(func, msecs) for broadcast app.
Reported by:
hackaccinocraft
|
Disclosed:
Weakness: Business Logic Errors
Open redirect in securegatewayaccess.com / secure.chaturbate.com via prejoin_data parameter
Reported by:
inhibitor181
|
Disclosed:
Medium
Weakness: Open Redirect
Bounty: $250.00
CSRF in REPORT EMOTICON feature
Reported by:
encrypt
|
Disclosed:
Low
Weakness: Cross-Site Request Forgery (CSRF)
Bounty: $250.00
Private and group tokens per minute endpoint active for disabled users
Reported by:
encrypt
|
Disclosed:
Low
Weakness: Improper Access Control - Generic
Bounty: $150.00
Blind SSRF on image proxy camo.stream.highwebmedia.com
Reported by:
hackaccinocraft
|
Disclosed:
Medium
Weakness: Server-Side Request Forgery (SSRF)