Unable to register in starbucks app #236276 N/A Authentication – 2017-08-15 – 2 SQL Injection Proof of Concept for Starbucks URL #360539 N/A SQL Injection – 2019-01-09 – 2 Unable to register in starbucks IN app #212015 N/A Denial of Service – 2017-08-15 – 3 Create New User Whilst Logged On #193478 N/A Open Redirect – 2017-01-13 – 4 Reflected XSS on card.starbucks.com.sg/unsubRevert.php via the 'ct' Parameter #541199 Valid Cross-site Scripting – 2019-12-12 – 4 China - Open redirect at trackinghub.starbucks.com.cn #856137 Valid Open Redirect – 2020-06-30 – 4 csrf blogs.starbucks.com #198470 Duplicate Cross-Site Request Forgery – 2017-08-15 – 5 Information Exposure Through an Error Message at news.starbucks.com #482707 N/A Information Disclosure – 2019-01-31 – 5 China - Leaked credentials permitted a limited ability to create Starbucks coupons and cards #766770 Valid Authentication – 2020-04-01 – 5 Able to bypass information requirements before launching a Chat. #450882 N/A Insecure Direct Object Reference – 2018-12-20 – 6 Password Change not notified when changed from settings #242846 Informative Authentication – 2019-02-08 – 7 Reflected XSS on card.starbucks.com.sg/unsub.php via the 'ct' Parameter #540399 Valid Cross-site Scripting – 2019-12-12 – 7 CSRF exploit | Adding/Editing comment of wishlist items (teavana.com - Wishlist-Comments) #177639 Valid Cross-Site Request Forgery – 2017-02-13 – 8 [connect.teavana.com] Open Redirect and abuse of connect.teavana.com #217430 Valid Open Redirect – 2017-07-27 – 8 Missing CSRF Token On Add Coupon To Basket #227725 Duplicate Cross-Site Request Forgery – 2019-01-22 – 8 Hong Kong - Open Redirect on card.starbucks.com.hk #743524 Valid Open Redirect – 2020-03-10 – 8 Korea - Reflected XSS on https://www.istarbucks.co.kr/app/getGiftStock.do via "skuNo" and "skuImgUrl" parameters #768345 Valid Cross-site Scripting – 2020-08-18 – 8 Stored XSS in Adress Book (starbucks.com/account/profile) #186554 Valid Cross-site Scripting – 2017-05-31 – 9 Brute Force Attack against PIN on Card History Page Could Lead to Card Information Discovery / Fraud #194318 Valid Misconfiguration and Insecure Design – 2017-02-28 – 9 Starbucks.com is reachable via ip address thus possible to link any doamin to Starbucks. #197585 N/A Cryptography – 2017-01-26 – 9 CSRF in Report Lost or Stolen Page https://www.starbucks.com/account/card #233099 Valid Cross-Site Request Forgery – 2017-09-25 – 9 Thailand - SNMP Publicly Accessible #455726 Valid Access Control – 2020-10-07 – 9 CSRF vulnerability in saving payment card on store.starbucks.com (COBilling -AddCreditCard) #177635 Valid Cross-Site Request Forgery – 2017-05-15 – 10 Reflected XSS in openapi.starbucks.com /searchasyoutype/v1/search?x-api-key= #213190 Valid Cross-site Scripting – 2017-07-25 – 10 Missing CSRF Token On Remove Coupun From Cart #227726 Duplicate Cross-Site Request Forgery – 2019-02-08 – 10 Open Redirect on Greater Asia domains #731618 Valid Open Redirect – 2020-04-21 – 10 http://digital.starbucks.com/ Creation of Google G Suite Account on Behalf of starbucks. #191179 Valid Information Disclosure – 2017-01-17 – 11 CSRF: add item to victim's cart automatically (starbucks.com - updatecart) #177472 Valid Cross-Site Request Forgery – 2017-06-02 – 13 out of date disqus shortname usage in the web app source code #172780 Valid Misconfiguration and Insecure Design – 2017-08-12 – 14 Reflected XSS on https://www.starbucks.co.uk/shop/paymentmethod/ (bypass for 227486) #252908 Valid Cross-site Scripting – 2020-06-16 – 14 Reflected DOM XSS on www.starbucks.co.uk #396493 Valid Cross-site Scripting – 2020-06-16 – 14 India - An Insecure Direct Object Reference (IDOR) allowed unauthorized access to view card index number and monetary balance #701160 Valid Insecure Direct Object Reference – 2019-12-12 – 14 Dom Based Xss DIV.innerHTML parameters store.starbucks* #188185 Valid Cross-site Scripting – 2017-01-12 – 15 Reflected XSS on teavana.com (Locale-Change) #190798 Valid Cross-site Scripting – 2017-06-09 – 15 DOM XSS on teavana.com via "pr_zip_location" parameter #209736 Valid Cross-site Scripting – 2017-05-03 – 15 Backup Source Code Detected #389454 Valid No weakness recorded – 2018-09-21 – 15 Minimal information disclosure of internal asset names and links which were not publicly accessible. #805699 Valid Information Disclosure – 2020-03-17 – 15 Exposed Unencrypted Telnet Endpoint #194454 Valid No weakness recorded – 2017-02-08 – 16 Sidekiq web UI (Ruby background processing) accessible unauthenticated via https://gift-test.starbucks.co.jp/sidekiq/busy #423286 Valid Access Control – 2018-10-24 – 16 Korea - LFI Server directory traversal at starbucks.co.kr #844067 Valid File and Path Handling – 2020-04-30 – 16 DOM-based XSS in store.starbucks.co.uk on IE 11 #241619 Valid Cross-site Scripting – 2017-11-03 – 17 Lack of Controls Allowing for Card and PIN Enumeration Leading to Fraud #198494 Valid No weakness recorded – 2017-07-01 – 18 Able to reset other user's password in https://card.starbucks.com.sg/ #315879 Valid Authentication – 2018-07-23 – 18 Open redirect / Reflected XSS payload in root that affects all your sites (store.starbucks.* / shop.starbucks.* / teavana.com) #196846 Valid Cross-site Scripting – 2017-06-14 – 19 Stored XSS in comments on https://www.starbucks.co.uk/blog/* #218226 Not checked yet Cross-site Scripting – – – 19 Host header injection/redirection via newsletter signup #229498 Valid No weakness recorded – 2018-06-08 – 19 Default credentials for the temporary POC site alipoc.stg.starbucks.com.cn permitted WAF bypass and RCE #881548 Valid Command and Code Injection – 2020-06-16 – 19 India - OTP bypass on Phone number verification for account creation #762695 Valid Authentication – 2020-04-21 – 20 Singapore - IDOR in campaign.starbucks.com.sg #783332 Valid Insecure Direct Object Reference – 2020-03-17 – 20 DVR default username and password #398797 Valid No weakness recorded – 2018-10-15 – 21