Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Error Page Text Injection#176042 | Informative | Misconfiguration and Insecure Design | – | 2017-11-09 | – | – |
| Possible content spoofing due to missing error page#179021 | Informative | Misconfiguration and Insecure Design | – | 2017-11-09 | – | – |
| [Yelp Blog] Backslash in search string causes JS error#179732 | Informative | Misconfiguration and Insecure Design | – | 2017-11-09 | – | – |
| Clickjacking @ Main Domain[www.yelp.com]#197115 | Informative | Misconfiguration and Insecure Design | – | 2017-11-09 | – | – |
| One of yelp.com url is redirecting to domain which is not yet purchased#207431 | Informative | Open Redirect | – | 2017-11-09 | – | – |
| ClickJacking in editing business name#227837 | Informative | Misconfiguration and Insecure Design | – | 2017-11-09 | – | – |
| User can be fooled to Bookmark any restaurant by clickjacking#228295 | Informative | Misconfiguration and Insecure Design | – | 2017-11-09 | – | – |
| ClickJacking#179839 | Duplicate | Misconfiguration and Insecure Design | – | 2017-11-09 | – | 1 |
| Nginx version disclosure via forbidden page#197880 | Informative | Information Disclosure | – | 2017-11-21 | – | 1 |
| Clickjacking: X-Frame Header Missing#168358 | Informative | Misconfiguration and Insecure Design | – | 2017-11-09 | – | 2 |
| Yelp.com is vulnerable to SWEET32 attack#199436 | Informative | Cryptography | – | 2017-11-09 | – | 2 |
| Click jacking in delete image of user in Yelp#201848 | Duplicate | Misconfiguration and Insecure Design | – | 2017-11-09 | – | 2 |
| Research papers on yelp are getting indexed by google bots.#207435 | N/A | Information Disclosure | – | 2017-11-09 | – | 2 |
| Weak Password Policy#237544 | Informative | Misconfiguration and Insecure Design | – | 2017-11-09 | – | 2 |
| Subdomain Takeover on delivey.yelp.com#1715538 | N/A | Input Validation and Logic | – | 2022-11-12 | – | 2 |
| Content spoofing on yelp.onelogin#180559 | Informative | Open Redirect | – | 2017-11-09 | – | 3 |
| JDBC credentials leaked via github#935573 | Informative | Information Disclosure | – | 2020-07-27 | – | 3 |
| If the website does not impose additional defense against CSRF attacks, failing to use the 'Lax' or 'Strict' values could increase the risk of exposur#1707680 | N/A | No weakness recorded | – | 2022-11-30 | – | 3 |
| no rate limit in forgot password session#1714970 | N/A | No weakness recorded | – | 2022-09-29 | – | 3 |
| Missing X-Frame-Options header#49888 | Duplicate | Misconfiguration and Insecure Design | – | 2017-11-09 | – | 4 |
| Nginx server version disclosure on engineeringblog#180346 | Informative | Information Disclosure | – | 2017-11-09 | – | 4 |
| Email flooding using user invitation feature in biz.yelp.com due to lack of rate limiting#963368 | N/A | Misconfiguration and Insecure Design | – | 2020-09-29 | – | 4 |
| IDOR in locid parameter allowing to view others accounts Profile Locations#966949 | Informative | Input Validation and Logic | – | 2020-09-02 | – | 4 |
| password field autocomplete enabled#1023773 | Informative | Information Disclosure | – | 2022-09-27 | – | 4 |
| Fraudulent claim of business.#1422227 | N/A | No weakness recorded | – | 2023-02-06 | – | 4 |
| xmlrpc file enabled#1575401 | Duplicate | Information Disclosure | – | 2022-06-16 | – | 4 |
| CORS Misconfiguration on trust.yelp.com#1716286 | N/A | No weakness recorded | – | 2022-10-10 | – | 4 |
| Autofill/Autosave password on login#1720621 | N/A | Authentication | – | 2022-10-11 | – | 4 |
| IDOR(indirect object references) on add friend,complement and send message#166849 | N/A | Misconfiguration and Insecure Design | – | 2017-11-09 | – | 5 |
| Ngnix Server version disclosure 404 Page!#167036 | Informative | Information Disclosure | – | 2017-11-09 | – | 5 |
| ClickJacking on IMPORTANT Functions of Yelp#305128 | Valid | Misconfiguration and Insecure Design | – | 2020-08-21 | – | 5 |
| Server-side request forgery (ssrf)#1712240 | N/A | Server-Side Request Forgery | – | 2022-09-28 | – | 5 |
| installed.json sensitive file was publicly accessible on your web application which discloses information about authors and admins#1586524 | Informative | Information Disclosure | – | 2022-10-22 | – | 6 |
| Requesting Show CheckIn Alert for Non Friend User#174882 | Valid | Information Disclosure | – | 2016-10-27 | – | 7 |
| X.509 certificate validation fails on international vanity domains#180538 | Valid | Misconfiguration and Insecure Design | – | 2017-02-06 | – | 7 |
| Firefly's verify_access_token() function does a byte-by-byte comparison of HMAC values.#240958 | Valid | Cryptography | – | 2017-07-10 | – | 7 |
| Unauthorized Use of Victim Credit Card#391385 | Valid | Information Disclosure | – | 2020-08-21 | – | 7 |
| Clickjacking lead to remove review#965141 | Valid | No weakness recorded | – | 2020-09-01 | – | 7 |
| Self-XSS via location cookie city field when getting suggestions for a new location#166709 | Informative | Cross-site Scripting | – | 2016-11-30 | – | 8 |
| Verification of E-Mail address possible on https://biz.yelp.com/login and https://biz.yelp.com/forgot#166265 | Valid | Information Disclosure | – | 2016-10-27 | – | 10 |
| Verification of email addresses possible through https://www.yelp.com/signup/facebook#194721 | Valid | Information Disclosure | – | 2017-09-16 | – | 10 |
| Robots.txt file with potentially sensitive content.#1724771 | N/A | Information Disclosure | – | 2023-01-13 | – | 10 |
| Public Github Repo Leaking Internal Credentials#1763266 | Informative | No weakness recorded | – | 2022-11-07 | – | 10 |
| IDNs displayed in unicode in messages/about/talk sections (Homograph Attack)#172933 | Valid | Misconfiguration and Insecure Design | – | 2017-11-09 | – | 12 |
| Leaking sensitive information lead to compromise employer API keys#273630 | Valid | Information Disclosure | – | 2017-11-09 | – | 12 |
| PURGE is not authenticated#629612 | Informative | Authentication | – | 2023-01-19 | – | 12 |
| CSRF on signup endpoint (auto-api.yelp.com)#178831 | Valid | Cross-Site Request Forgery | – | 2017-03-01 | – | 13 |
| Clickjacking Vulnerability found on Yelp#214087 | Valid | Cross-Site Request Forgery | – | 2017-05-12 | – | 13 |
| No rate limit on subscribe form#1708824 | Informative | Input Validation and Logic | – | 2022-10-05 | – | 13 |
| [engineeringblog.yelp.com] CRLF Injection#66391 | N/A | No weakness recorded | – | 2017-11-09 | – | 14 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.