Bypassing domain deny_list rule in Smokescreen via double brackets [[]] which leads to SSRF #1580495 Valid Server-Side Request Forgery – 2022-10-19 – 11 Object injection in `stripe-billing-typographic` GitHub project via /auth/login #1183335 Valid Injection and Smuggling – 2023-03-06 – 17 Without verifying email and activate account, user can perform all action which are not supposed to be done #1272305 Valid Misconfiguration and Insecure Design – 2022-07-18 – 20 Local applications from user's computer can listen for webhooks via insecure gRPC server from stripe-cli #1369191 Valid Authentication – 2022-10-19 – 20 Bypass global deny-lists by wrapping domains using "[]" in https://github.com/stripe/smokescreen #1528242 Valid Input Validation and Logic – 2022-05-18 – 20 Unauthorized Canceling/Unsubscribe TaxJar account & Payment information DIsclosure #1679124 Valid Access Control – 2022-12-20 – 24 GRAPHQL cross-tenant IDOR giving write access thought the operation UpdateAtlasApplicationPerson #1066203 Valid Insecure Direct Object Reference – 2022-03-08 – 25 CSRF in Importing CSV files [app.taxjar.com] #1637761 Valid Cross-Site Request Forgery – 2023-03-16 – 26 [Broken Access Control ] Unauthorized Linking accounts & Linked Accounts info DIsclosure #1672614 Valid Access Control – 2022-12-20 – 26 The `stripe/veneur` GitHub repository links to a domain `veneur.org`, which is not under stripe's control #2011298 Valid Misconfiguration and Insecure Design – 2023-07-03 – 26 Fully TaxJar account control and ability to disclose and modify business account settings Due to Broken Access Control in /current_user_data #1677541 Valid Access Control – 2022-10-19 – 33 Verifying email bypass #1121896 Valid Access Control – 2023-03-03 – 35 Tomcat Servlet Examples accessible at https://44.240.33.83:38443 and https://52.36.56.155:38443 #1560149 Valid Access Control – 2022-10-19 – 39 XSS vulnerability without a content security bypass in a `CUSTOM` App through Button tag #1823216 Valid Cross-site Scripting – 2023-05-01 $2,000 46 Bypassing domain deny_list rule in Smokescreen via trailing dot leads to SSRF #1410214 Valid Server-Side Request Forgery – 2022-03-23 – 51 HTML Injection in the Invoice memos field #1257767 Valid Access Control – 2023-03-01 $500 53 Promotion code can be used more than redemption limit. #1717650 Valid Race Conditions – 2023-02-13 – 55 CSRF token validation system is disabled on Stripe Dashboard #1493437 Valid Cross-Site Request Forgery – 2022-05-31 $2,500 87 User can pay using archived price by manipulating the request sent to `POST /v1/payment_pages/for_plink` #1328278 Valid Insecure Direct Object Reference – 2022-01-19 – 100 Mass account takeover! #1634165 Valid Misconfiguration and Insecure Design – 2022-12-21 – 101 CSRF token validation system is disabled on Stripe Dashboard #1483327 Valid Cross-Site Request Forgery – 2022-04-02 – 113 Possible XSS vulnerability without a content security bypass #1804177 Valid Cross-site Scripting – 2023-05-01 $2,000 131 Email change or personal data change on the account. #1250037 Valid Insecure Direct Object Reference – 2022-01-21 $3,000 149 Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/ #1685970 Valid Authentication – 2022-10-19 – 212 Mass Account Takeover at https://app.taxjar.com/ - No user Interaction Analysed #1581240 Valid Authentication – 2022-07-11 – 253 Fee discounts can be redeemed many times, resulting in unlimited fee-free transactions Analysed #1849626 Valid Input Validation and Logic – 2023-02-25 $5,000 266