libphutil: removing bytes from a PhutilRope does not work as intended #105657 Valid No weakness recorded – 2015-12-16 – – Extended policy checks are buggy #109959 Valid No weakness recorded – 2016-01-11 – – Abusing VCS control on phabricator #16315 Valid Access Control – 2014-06-13 $600 1 Dashboard panel embedded onto itself causes a denial of service #85011 Valid Denial of Service – 2015-08-27 – 1 Information leakage through Graphviz blocks #88395 Valid Information Disclosure – 2015-09-13 – 1 Full path disclosure #143575 Informative Information Disclosure – 2016-06-08 – 1 Hyper Link Injection In email and Space Characters Allowed at Password Field. #252699 Informative No weakness recorded – 2017-07-23 – 1 Credential gets exposed #255132 Informative Information Disclosure – 2017-08-02 – 1 The "Download Raw Diff" URL is viewable by everyone #356408 Informative Information Disclosure – 2018-05-23 – 1 CSRF token valid even after the session logout of a particular user #2857 Informative Cross-Site Request Forgery – 2014-06-26 – 2 Abusing daemon logs for Privilege escalation under certain scenarios #16392 Valid Access Control – 2014-06-18 $300 2 Open redirection on secure.phabricator.com #25160 Valid Open Redirect – 2014-09-17 – 2 Content injection #36112 Informative Misconfiguration and Insecure Design – 2014-12-15 – 2 Phabricator Phame Blog Skins Local File Inclusion #39428 Valid Command and Code Injection – 2015-01-14 $500 2 XSS with Time-of-Day Format #52822 Valid Cross-site Scripting – 2015-04-19 – 2 Multiple so called 'type juggling' attacks. Most notably PhabricatorUser::validateCSRFToken() is 'bypassable' in certain cases. #86022 Valid Cross-Site Request Forgery – 2015-10-01 – 2 Passphrase credential lock bypass #139626 Valid Information Disclosure – 2016-05-18 – 2 An unsafe design practice in the Passphrase may result in Secret being accidentally changed. #218324 Informative Misconfiguration and Insecure Design – 2017-04-04 – 2 XSS in editor by any user #18691 Valid Cross-site Scripting – 2014-08-13 $1,000 3 Back - Refresh - Attack To Obtain User Credentials #21064 Informative Information Disclosure – 2014-07-23 – 3 Password Policy issue #26758 Informative Misconfiguration and Insecure Design – 2014-10-02 – 3 Content spoofing #27564 Informative Cross-site Scripting – 2014-09-11 – 3 Phabricator Diffusion application allows unauthorized users to delete mirrors #38965 Valid Authentication – 2015-01-09 $300 3 Server Side Request Forgery in macro creation #50537 Informative Information Disclosure – 2015-03-09 – 3 No authentication required to add an email address. #139965 Informative Authentication – 2016-05-27 – 3 link reset problem #164483 N/A No weakness recorded – 2016-08-30 – 3 Restricted file access when it exists in old versions of task or wiki document #203658 Informative Misconfiguration and Insecure Design – 2017-02-06 – 3 Autoclose can close any task regardless of policies/spaces #220909 Valid No weakness recorded – 2017-04-24 – 3 Edit Policy restriction does not prevent comments. #923759 Informative Access Control – 2020-07-17 – 3 Password Reset Links Not Expiring #22858 Informative Authentication – 2014-09-06 – 4 SSRF vulnerability (access to metadata server on EC2 and OpenStack) #53088 Valid Information Disclosure – 2015-03-26 $300 4 Error page Text Injection. #156196 N/A Misconfiguration and Insecure Design – 2016-08-25 – 4 Broken Authentication and Session Management lead to take over account #1271710 N/A Access Control High 2021-07-21 – 4 Content Spoofing through URL #28792 Informative Misconfiguration and Insecure Design – 2014-09-20 – 5 Enumerating emails through "Forgot Password" form #203614 Informative Misconfiguration and Insecure Design – 2017-02-06 – 5 The mailbox verification API interface is unlimited and can be used as a mailbox bomb #221948 N/A Access Control – 2017-04-26 – 5 The special code in editor has no Authority control and can lead to Information Disclosure #221950 Informative Information Disclosure – 2017-04-22 – 5 Request vulnerable to CSRF #513137 N/A Cross-Site Request Forgery – 2019-03-22 – 5 Slowvote and Countdown can cause Denial of Service due to recursive inclusion #1563142 Valid Denial of Service – 2022-05-09 – 5 UnAuthorized Editorial Publishing to Blogs #3356 Valid Authentication – 2014-04-05 $300 7 IRC-Bot exposes information #222870 Valid Information Disclosure – 2017-04-21 – 7 TOTP Key is shorter than RFC 4226 recommended minimum #435648 Valid Cryptography – 2018-12-07 $300 7 Deprecated owners.query API bypasses object view policy #1584409 Valid Access Control – 2022-05-31 $300 7 Control character allowed in username #3921 Valid No weakness recorded – 2014-04-12 $300 8 Persistent XSS: Editor link #4114 Valid Cross-site Scripting – 2014-04-16 $300 8 Forgot Password Issue #23363 Valid Authentication – 2014-09-10 – 8 Fetching binaries (for software installation) over HTTP without verification (RCE as ROOT by MITM) #186352 Valid No weakness recorded – 2016-12-29 $300 8 Issue:Form does not contain an anti-CSRF token #513134 N/A Cross-Site Request Forgery – 2019-03-22 – 8 OAuth access_token stealing in Phabricator #3596 Valid Open Redirect – 2014-04-11 $450 9 Conduit feed.publish API allows you to spoof other users or make it look like you have access to a restricted object #1566325 Valid No weakness recorded – 2022-05-18 $300 9