subdomain takeover at odoo-staging.exness.io #1540252 Valid Access Control – 2022-07-18 – 9 Improper Implementation of SDK Allows Universal XSS in Webview Leading to Account Takeover #1455987 Valid Access Control – 2022-04-13 – 11 Acess control vulnerability (read/write) #1174387 Valid Insecure Direct Object Reference – 2022-04-13 – 12 CRLF Injection - Http Response Splitting #1514359 Valid Injection and Smuggling – 2022-04-13 $200 15 Double forward slash breaks server-side restrictions & allows access to prohibited services from a partner account #1829170 Valid No weakness recorded Low 2023-02-10 – 16 Access control vulnerability (read/write) #1174734 Valid Insecure Direct Object Reference – 2022-04-13 – 22 Access control vulnerability (read-only) #1159367 Valid Insecure Direct Object Reference – 2022-04-13 – 25 Verification process done using different documents without corresponding to user information / User information can be changed after verification #1446107 Valid Input Validation and Logic – 2023-01-27 – 25 [com.exness.android.pa Android] Universal XSS in webview. Lead to steal user cookies #532836 Valid Access Control – 2022-05-24 $400 26 Taking position in a discontinued forex pair without executing any trades #1509211 Valid No weakness recorded – 2022-04-13 – 32 IDOR in Stats API Endpoint Allows Viewing Equity or Net Profit of Any MT Account #1644436 Valid Insecure Direct Object Reference – 2022-12-05 – 58 Unrestricted Access to Celery Flower Instance #2264960 Valid No weakness recorded High 2023-12-14 – 97 Blind SSRF on https://my.exnessaffiliates.com/ allows for internal network enumeration #1832494 Valid Server-Side Request Forgery Medium 2023-10-25 – 120 SSRF in graphQL query (pwapi.ex2b.com) Analysed #1864188 Valid Server-Side Request Forgery Medium 2023-07-24 $3,000 261