clickjacking on deleting user's clips [https://crossclip.com/clips] #1294767 Valid Misconfiguration and Insecure Design Low 2021-11-05 – 4 Moderator user has access to owner's support portal and tickets #1071918 Valid Access Control Medium 2021-01-20 $200 19 Stored XSS on oslo.io in notifications via project name change #1070859 Valid Cross-site Scripting Medium 2021-01-05 – 26 Steal any users `access_token` via open redirect in https://streamlabs.com/global/identity?popup=1&r= #1327742 Valid No weakness recorded Medium 2021-11-04 – 27 GET based Open redirect on [streamlabs.com/content-hub/streamlabs-obs/search?query=] #978680 Valid Open Redirect Low 2020-10-09 $100 34 Sensitive information disclosure to shared access user via streamlabs platform api #1072893 Valid Information Disclosure Medium 2021-01-20 $200 36 Host Header injection in oslo.io (using X-Forwarded-For header) leading to email spoofing #1072277 Valid Input Validation and Logic High 2021-01-07 – 37 Privilege Escalation Leads to Control The Owner Access Token Which leads to control the stream [streamlabs.com] #1174527 Valid Access Control Low 2021-04-27 – 38 SSRF allows reading AWS EC2 metadata using "readapi" variable in Streamlabs Cloudbot #1108418 Valid Server-Side Request Forgery Medium 2021-02-24 $200 41 CSRF in changing users donation_settings [https://streamlabs.com/api/v6/viewer-portal/viewer-settings/donation_settings] #1049360 Valid Cross-Site Request Forgery Medium 2020-12-26 – 49 session takeover via open protocol redirection on streamlabs.com #1178239 Valid Open Redirect Medium 2021-09-01 $200 50 IDOR when creating App on [platform.streamlabs.com/api/v1/store/whitelist] with user_id field #983070 Valid Insecure Direct Object Reference Low 2020-11-26 – 61 Stored XSS in [https://streamlabs.com/dashboard#/*goal] pages #1049012 Valid Cross-site Scripting Low 2020-12-26 – 68 Manipulating response leads to free access to Streamlabs Prime Analysed #1070510 Valid Input Validation and Logic Medium 2021-01-21 – 80 One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.com Analysed #1046630 Valid Cross-Site Request Forgery Medium 2021-01-06 – 99