Read the researcher's report on HackerOne
No analysis of this report yet. What HackerOne publishes about it is below, with the link to the report. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| [CSRF] TikTok Careers Portal Account Takeover | Not clear from the report | No object involved | A forged sign-on flow could affect a careers portal account. |
| CSRF on connecting Paypal as Payment Provider | Not clear from the report | Another user's | A victim store’s payment settings were changed to connect an attacker-controlled PayPal account. |
| Account Takeover using Linked Accounts due to lack of CSRF protection | No account | Another user's | A victim’s account was linked in a way that could grant the attacker access. |
| Periscope android app deeplink leads to CSRF in follow action | No account | Another user's | A link opened in the Android app triggered a follow action on another user's account. |
| Take over of accounts created using Google or Facebook | No account | Another user's | A forged request changed another user's account password. |
| Improper CSRF token validation allows attackers to access victim's accounts linked to Hackerone | A user account | Another user's | A victim’s third-party integration authorization was attached to the attacker’s account. |
| CSRF protection bypass in GitHub Enterprise management console | No account | No object involved | A crafted cross-site request bypassed the management console's CSRF protection for a logged-in user. |
| Slack integration setup lacks CSRF protection | A user account | Another user's | Linking an attacker-controlled Slack account to a victim team’s integrations. |
| SocialClub Account Take Over Through Import Friends feature | No account | Another user's | A cross-site request linked the attacker’s social account to the victim’s account. |
| CSRF token validation system is disabled on Stripe Dashboard | No account | The attacker's own | A malicious site caused a logged-in user’s browser to submit changes to that user’s dashboard account. |
| Referer Leakage Vulnerability in socialclub.rockstargames.com/crew/ leads to FB'S OAuth token theft. | A user account | The attacker's own | Sensitive OAuth token data in a source URI was disclosed through a Referer header during cross-domain navigation. |
| Cross-Site Request Forgery | A privileged role | No object involved | A cross-site request used an administrator's authenticated session to create a new administrator. |