Captcha Bypass in Snapchat's Geofilter Submission Process #54641 Valid Misconfiguration and Insecure Design – 2015-05-04 – 9 Password Reset - query param overrides postdata #96636 Valid Access Control – 2015-12-24 $1,500 12 Vulnerable to JavaScript injection. (WXS) (Javascript injection)! #54631 Valid Command and Code Injection – 2015-10-22 – 14 Subdomain takeover in http://support.scan.me pointing to Zendesk (a Snapchat acquisition) #114134 Valid Cross-site Scripting – 2016-02-16 – 14 Subdomain takeover of blog.snapchat.com #171942 Valid No weakness recorded – 2016-10-05 – 14 RTLO char allowed in chat #196222 Valid Misconfiguration and Insecure Design – 2017-02-28 – 18 Subdomain Takeover via unclaimed UserVoice domain #269109 Valid Access Control – 2017-10-04 $250 18 Bypassing "You've requested your data the maximum number of times today." + "Please Verify an email address with snapchat to continue" #173043 Valid Authentication – 2016-11-25 – 20 [render.bitstrips.com] Stored XSS via an incorrect avatar property value #159878 Valid Cross-site Scripting – 2017-01-04 $400 21 CSRF when unlocking lenses leads to lenses being forcefully installed without user interaction #1085336 Valid Cross-Site Request Forgery – 2021-07-29 $250 21 [spectacles.com] Bypassing quantity limit in orders #246803 Valid Injection and Smuggling – 2017-08-12 $250 22 CRLF Injection at vpn.bitstrips.com #237357 Valid Injection and Smuggling – 2017-06-15 – 24 Incoming email hijacking on sc-cdn.net #168476 Valid Misconfiguration and Insecure Design – 2016-09-23 – 25 Organization Members in Snap Kit may Deactivate Apps #1103448 Valid Access Control – 2021-08-26 – 26 Password reset tokens sent to CSP reporting endpoints #1626281 Valid Information Disclosure – 2022-08-31 – 26 Domain Takeover in [obviousengine.com] a snapchat acquisitions #392785 Valid Access Control – 2018-10-07 – 32 XSS found on Snapchat website #125849 Valid Cross-site Scripting – 2018-05-26 – 38 Subdomain Takeover via Unclaimed WordPress site #274336 Valid Authentication – 2017-10-06 – 39 Client IP Spoofing using "X-Forwarded-For: 127.0.0.1" on "studio-app.snapchat.com" exposing bucket details #382678 Valid Access Control – 2021-08-12 $500 40 Bypass Rate Limits on app.snapchat.com API Endpoint via X-Forwarded-For Header #727487 Valid Input Validation and Logic – 2021-08-04 – 40 CreatorID leaked from public content posted to SnapMaps #867521 Valid Server-Side Request Forgery – 2020-12-18 $1,000 49 Administrator access to a Django Administration Panel on *.sc-corp.net via bruteforced credentials #128114 Valid Authentication – 2016-07-14 $1,000 54 Bitmoji source code is accessible #301812 Valid Information Disclosure – 2021-07-31 $1,000 92 internal dev tokens disclosure #1940443 Valid Cryptography Low 2023-06-14 $250 96 Subdomain takeover on http://fastly.sc-cdn.net/ #154425 Valid Misconfiguration and Insecure Design – 2016-08-22 $3,000 114 RCE/LFI on test Jenkins instance due to improper authentication flow #258117 Valid Access Control – 2017-08-19 – 118 Intent Leads To Unauthorised Video Call Initiation Leaking Surrounding Informations Of Victim Analysed #2139260 Valid Information Disclosure Medium 2024-04-05 – 127 Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.io Analysed #911606 Valid Information Disclosure – 2021-08-12 $15,000 137 Stealing SSO Login Tokens (snappublisher.snapchat.com) Analysed #265943 Valid Authentication – 2021-07-29 $7,500 244 Server-Side Request Forgery using Javascript allows to exfill data from Google Metadata Analysed #530974 Valid Server-Side Request Forgery – 2020-11-30 – 421 Open prod Jenkins instance Analysed #231460 Valid Information Disclosure – 2017-08-19 $15,000 436 Access to multiple production Grafana dashboards Analysed #663628 Valid Information Disclosure – 2020-11-04 $10,000 464 Publicly accessible Continuous Integration Tool Analysed #313457 Valid Access Control – 2021-07-29 – 562 Github Token Leaked publicly for https://github.sc-corp.net Analysed #396467 Valid Cryptography – 2018-10-08 – 582 Delete anyone's content spotlight remotely. Analysed #1819832 Valid Insecure Direct Object Reference High 2023-03-06 $15,000 801 Improper Authentication - any user can login as other user with otp/logout & otp/login Analysed #921780 Valid Authentication – 2021-09-03 – 972 Exposed Kubernetes API - RCE/Exposed Creds Analysed #455645 Valid Command and Code Injection – 2021-07-29 $25,000 1,191