Attacker can unpin posts from companies he's not part of. Analysed #1862677 Valid No weakness recorded Low 2023-05-12 – 20 [ Continuation Report from #1814842 ] Can create articles using other users' NewsLetters Analysed #1818969 Valid Insecure Direct Object Reference Medium 2023-05-15 – 23 “See who’s interested in working for your company” - security issue Analysed #1945417 Valid Information Disclosure Medium 2023-06-21 – 28 Ad Account Takeover Analysed #1791720 Valid Access Control Critical 2023-07-20 – 30 HTML injection at Company Name or Product Name and can be shown on Contact Sales form Analysed #2076019 Valid No weakness recorded Low 2023-10-18 – 32 An Attacker Can Flag Draft Job Posts And Can Disclose The Draft Job Posts Details [ Similar to #1581528 Resolved Report] Analysed #1675674 Valid Input Validation and Logic Medium 2023-08-24 – 34 Deny Admin from Editing LinkedIn Company Page using Gen Form Visibility via POST /voyager/api/voyagerOrganizationDashCompanies/{id} Analysed #2081744 Valid Access Control Medium 2023-10-19 – 34 Delete any LinkedIn comment on learning API of other users Analysed #1801527 Valid Access Control Medium 2023-05-12 – 41 bypass two-factor authentication. Analysed #1842183 Valid Authentication Medium 2023-08-01 – 41 CSRF that makes any user send invitations to the attacker by simply clicking on a link. Analysed #1961163 Valid Cross-Site Request Forgery Medium 2023-12-06 – 41 Anyone can view the results of linkedin skill test -if failed to earn a badge or if the badge earned is kept private: both cases results can be viewed Analysed #1837309 Valid Insecure Direct Object Reference Medium 2023-05-17 – 43 Attackers do not need to Pay for a Subscription to get the `Discussion Group URL` in `Paid Learning` Analysed #1813450 Valid Insecure Direct Object Reference Medium 2023-05-12 – 44 CSRF that makes any linkedin user follow attacker controlled accounts by simply clicking https://www.linkedin.com/comm/mynetwork/discovery-see-all/* Analysed #1964211 Valid Cross-Site Request Forgery Medium 2023-12-06 – 53 User Details Can Be Disclosed Even If The Account IS In Hibernation State Analysed #1728087 Valid Information Disclosure Low 2023-12-06 – 57 Entire database of emails exposed through URN injection Analysed #1806939 Valid Command and Code Injection Medium 2023-05-22 – 79 Information disclosure by sending a GIF Analysed #1801427 Valid Input Validation and Logic Medium 2023-04-28 – 84 Attackers can use TRIAL Premium only by paying **IDR 10,000.00** from the original price of `IDR462,400.00` per month Analysed #1808719 Valid Insecure Direct Object Reference High 2023-08-24 – 84 IDOR allows an attacker to delete anyone's featured photo. Analysed #1608735 Valid Insecure Direct Object Reference Medium 2023-08-24 – 99 Unauthorized User can View Subscribers of Other Users Newsletters Analysed #1716300 Valid Insecure Direct Object Reference High 2023-03-29 – 117 Can delete other user's post and company page post Analysed #337755 Valid Access Control – 2023-04-11 – 156