Reflected XSS on card.starbucks.com.sg/unsubRevert.php via the 'ct' Parameter #541199 Valid Cross-site Scripting Medium 2019-12-12 – 4 China - Open redirect at trackinghub.starbucks.com.cn #856137 Valid Open Redirect Low 2020-06-30 – 4 China - Leaked credentials permitted a limited ability to create Starbucks coupons and cards #766770 Valid Authentication High 2020-04-01 – 5 Reflected XSS on card.starbucks.com.sg/unsub.php via the 'ct' Parameter #540399 Valid Cross-site Scripting Medium 2019-12-12 – 7 CSRF exploit | Adding/Editing comment of wishlist items (teavana.com - Wishlist-Comments) #177639 Valid Cross-Site Request Forgery Medium 2017-02-13 – 8 [connect.teavana.com] Open Redirect and abuse of connect.teavana.com #217430 Valid Open Redirect Medium 2017-07-27 – 8 Hong Kong - Open Redirect on card.starbucks.com.hk #743524 Valid Open Redirect Low 2020-03-10 – 8 Korea - Reflected XSS on https://www.istarbucks.co.kr/app/getGiftStock.do via "skuNo" and "skuImgUrl" parameters #768345 Valid Cross-site Scripting Medium 2020-08-18 – 8 Stored XSS in Adress Book (starbucks.com/account/profile) #186554 Valid Cross-site Scripting Low 2017-05-31 – 9 Brute Force Attack against PIN on Card History Page Could Lead to Card Information Discovery / Fraud #194318 Valid Misconfiguration and Insecure Design None 2017-02-28 – 9 CSRF in Report Lost or Stolen Page https://www.starbucks.com/account/card #233099 Valid Cross-Site Request Forgery Medium 2017-09-25 – 9 Thailand - SNMP Publicly Accessible #455726 Valid Access Control High 2020-10-07 – 9 CSRF vulnerability in saving payment card on store.starbucks.com (COBilling -AddCreditCard) #177635 Valid Cross-Site Request Forgery Low 2017-05-15 – 10 Reflected XSS in openapi.starbucks.com /searchasyoutype/v1/search?x-api-key= #213190 Valid Cross-site Scripting Medium 2017-07-25 – 10 Open Redirect on Greater Asia domains #731618 Valid Open Redirect Low 2020-04-21 – 10 http://digital.starbucks.com/ Creation of Google G Suite Account on Behalf of starbucks. #191179 Valid Information Disclosure Low 2017-01-17 – 11 CSRF: add item to victim's cart automatically (starbucks.com - updatecart) #177472 Valid Cross-Site Request Forgery Medium 2017-06-02 – 13 out of date disqus shortname usage in the web app source code #172780 Valid Misconfiguration and Insecure Design Critical 2017-08-12 – 14 Reflected XSS on https://www.starbucks.co.uk/shop/paymentmethod/ (bypass for 227486) #252908 Valid Cross-site Scripting Medium 2020-06-16 – 14 Reflected DOM XSS on www.starbucks.co.uk #396493 Valid Cross-site Scripting Medium 2020-06-16 – 14 India - An Insecure Direct Object Reference (IDOR) allowed unauthorized access to view card index number and monetary balance #701160 Valid Insecure Direct Object Reference Medium 2019-12-12 – 14 Dom Based Xss DIV.innerHTML parameters store.starbucks* #188185 Valid Cross-site Scripting Low 2017-01-12 – 15 Reflected XSS on teavana.com (Locale-Change) #190798 Valid Cross-site Scripting Medium 2017-06-09 – 15 DOM XSS on teavana.com via "pr_zip_location" parameter #209736 Valid Cross-site Scripting Medium 2017-05-03 – 15 Backup Source Code Detected #389454 Valid No weakness recorded Medium 2018-09-21 – 15 Minimal information disclosure of internal asset names and links which were not publicly accessible. #805699 Valid Information Disclosure Low 2020-03-17 – 15 Exposed Unencrypted Telnet Endpoint #194454 Valid No weakness recorded Low 2017-02-08 – 16 Sidekiq web UI (Ruby background processing) accessible unauthenticated via https://gift-test.starbucks.co.jp/sidekiq/busy #423286 Valid Access Control Medium 2018-10-24 – 16 Korea - LFI Server directory traversal at starbucks.co.kr #844067 Valid File and Path Handling High 2020-04-30 – 16 DOM-based XSS in store.starbucks.co.uk on IE 11 #241619 Valid Cross-site Scripting Low 2017-11-03 – 17 Lack of Controls Allowing for Card and PIN Enumeration Leading to Fraud #198494 Valid No weakness recorded High 2017-07-01 – 18 Able to reset other user's password in https://card.starbucks.com.sg/ #315879 Valid Authentication Medium 2018-07-23 – 18 Open redirect / Reflected XSS payload in root that affects all your sites (store.starbucks.* / shop.starbucks.* / teavana.com) #196846 Valid Cross-site Scripting Medium 2017-06-14 – 19 Stored XSS in comments on https://www.starbucks.co.uk/blog/* #218226 Valid Cross-site Scripting High 2017-06-27 – 19 Host header injection/redirection via newsletter signup #229498 Valid No weakness recorded Low 2018-06-08 – 19 Default credentials for the temporary POC site alipoc.stg.starbucks.com.cn permitted WAF bypass and RCE #881548 Valid Command and Code Injection Medium 2020-06-16 – 19 India - OTP bypass on Phone number verification for account creation #762695 Valid Authentication Medium 2020-04-21 – 20 Singapore - IDOR in campaign.starbucks.com.sg #783332 Valid Insecure Direct Object Reference Medium 2020-03-17 – 20 DVR default username and password #398797 Valid No weakness recorded Medium 2018-10-15 – 21 Persistent CSRF in /GiftCert-AddToBasket prevents purchases on eCommerce sites #206319 Valid Cross-Site Request Forgery High 2017-05-15 – 22 Unauthorized access to a system used for CI/CD processes #410475 Valid Authentication High 2018-11-01 – 22 unuse domain still in using at wechat by Starbucks East China #471265 Valid Access Control Critical 2019-01-22 – 22 [newscdn.starbucks.com] CRLF Injection, XSS #192749 Valid Injection and Smuggling Medium 2017-03-09 – 23 Thailand – a small number of alarm system portals accessible with the default credentials Analysed #406486 Valid Authentication High 2019-11-18 – 23 Improper handling of payment callback allows topping up a Swiss Starbucks Card bypassing actual payment via a crafted success message Analysed #682617 Valid Input Validation and Logic High 2019-11-18 – 23 Possible subdomain takeover at openapi.starbucks.com Analysed #241503 Valid No weakness recorded High 2017-08-15 – 24 Bulgaria - Subdomain takeover of mail.starbucks.bg Analysed #736863 Valid Access Control High 2019-12-12 – 26 Reflected XSS by exploiting CSRF vulnerability on teavana.com wishlist comment module. (wishlist-comments) Analysed #177508 Valid Cross-site Scripting Medium 2017-02-13 – 27 [stagecafrstore.starbucks.com] CRLF Injection, XSS Analysed #192667 Valid Cross-site Scripting Low 2018-01-22 – 27 XSS on https://www.starbucks.co.uk (can lead to credit card theft) (/shop/paymentmethod) Analysed #227486 Valid Cross-site Scripting High 2018-05-22 – 27