SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll Database Analysed #531051 Valid SQL Injection Critical 2019-08-06 – 801 JumpCloud API Key leaked via Open Github Repository. Analysed #716292 Valid Authentication Critical 2019-12-30 – 739 RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/ Analysed #502758 Valid Command and Code Injection Critical 2019-04-10 – 572 Subdomain takeover of datacafe-cert.starbucks.com Analysed #665398 Valid Access Control High 2019-08-28 – 311 Singapore - Account Takeover via IDOR Analysed #876300 Valid Insecure Direct Object Reference Critical 2020-07-28 – 260 Blind SQLi leading to RCE, from Unauthenticated access to a test API Webservice Analysed #592400 Valid SQL Injection Critical 2019-07-22 – 236 Blind SQL Injection on starbucks.com.gt and WAF Bypass :* Analysed #549355 Valid SQL Injection High 2019-06-19 – 210 Reflected Cross site Scripting (XSS) on www.starbucks.com Analysed #438240 Valid Cross-site Scripting Medium 2019-03-08 – 181 Subdomain takeover of d02-1-ag.productioncontroller.starbucks.com Analysed #661751 Valid Access Control High 2019-08-15 – 122 Subdomain takeover of mydailydev.starbucks.com Analysed #570651 Valid Server-Side Request Forgery High 2019-05-22 – 122 China – Limited Partner PII Regarding Work Scheduling via Unauthenticated API Endpoint Analysed #659248 Valid Information Disclosure Critical 2020-04-01 – 116 Subdomain takeover on svcgatewayus.starbucks.com Analysed #325336 Valid Access Control Critical 2018-06-25 – 109 Subdomain takeover on happymondays.starbucks.com due to non-used AWS S3 DNS record Analysed #186766 Valid Access Control High 2016-12-19 – 105 Thailand - a small number of SMB CCTV footage backup servers were accessible without authentication. Analysed #417360 Valid Access Control Medium 2019-11-19 – 99 Subdomain takeover on wfmnarptpc.starbucks.com Analysed #388622 Valid Access Control High 2018-08-09 – 91 Multiple Subdomain takeovers via unclaimed instances Analysed #276269 Valid Access Control High 2017-12-04 – 83 Korea - LFI via path traversal at https://msr.istarbucks.co.kr:6443/appif/ Analysed #780021 Valid File and Path Handling Critical 2020-03-10 – 81 Cross-Site Scripting (XSS) on www.starbucks.com | .co.uk login pages Analysed #881115 Valid Cross-site Scripting High 2020-06-30 – 78 Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using Chrome Analysed #1113559 Valid Cross-Site Request Forgery High 2021-05-18 – 77 Leaking sensitive files on Github leads to internal files (python scripts,SQL files) Analysed #301831 Valid Information Disclosure Critical 2018-05-17 – 73 Reflected cross-site scripting on multiple Starbucks assets. Analysed #629745 Valid Cross-site Scripting Low 2019-10-16 – 72 Reflected XSS in https://www.starbucks.co.jp/store/search/ Analysed #496375 Valid Cross-site Scripting Medium 2019-05-22 – 72 China - president-starbucks.com.cn DNS configuration reported as takeover Analysed #423269 Valid Access Control High 2020-03-17 – 71 [mena.starbucks.com] Laravel App Log & Configuration Disclosure. Analysed #401098 Valid Information Disclosure High 2019-09-30 – 63 WAF bypass via double encoded non standard ASCII chars permitted a reflected XSS on response page not found pages - (629745 bypass) Analysed #716761 Valid Cross-site Scripting Low 2020-01-29 – 58 Information disclosure on sim.starbucks.com Analysed #632808 Valid Information Disclosure Low 2019-11-13 – 58 Store Development Resource Center was vulnerable to a Remote Code Execution - Unauthenticated Remote Command Injection (CVE-2019-0604) Analysed #536134 Valid Command and Code Injection Critical 2019-12-12 – 57 Open Redirection in Login - Korean Starbucks Analysed #380939 Valid Open Redirect Low 2019-03-20 – 54 Subdomain takeover on developer.openapi.starbucks.com Analysed #275714 Valid Access Control High 2018-02-17 – 51 Unauthorized access to jiratest.starbucks.com Analysed #332586 Valid Authentication Critical 2018-05-30 – 49 Information Leak - Github - JMS Information Analysed #360811 Valid Information Disclosure High 2018-08-16 – 48 Java Deserialization RCE via JBoss on card.starbucks.in Analysed #221294 Valid Command and Code Injection Critical 2017-05-22 – 48 China - ecjobsdc.starbucks.com.cn html/shtml file upload vulnerability Analysed #412481 Valid Access Control High 2020-01-29 – 46 China - IDOR on Reservation Staging/Non Production Site - https://reservation.stg.starbucks.com.cn Analysed #715054 Valid Insecure Direct Object Reference Medium 2020-09-22 – 45 Reflected XSS in https://www.starbucks.com/account/create/redeem/MCP131XSR via xtl_amount, xtl_coupon_code, xtl_amount_type parameters Analysed #531042 Valid Cross-site Scripting Medium 2019-11-13 – 43 Java Deserialization RCE via JBoss JMXInvokerServlet/EJBInvokerServlet on card.starbucks.in Analysed #153026 Valid Command and Code Injection – 2017-02-03 – 42 Able to purchase a gift card with any amount Analysed #316789 Valid Insecure Direct Object Reference High 2018-07-20 – 41 svcardproxydevus.starbucks.com Subdomain take over Analysed #380158 Valid Access Control High 2018-07-23 – 39 PHPinfo page Analysed #367050 Valid Information Disclosure Low 2019-06-12 – 39 Stored XSS on www.starbucks.com.sg/careers/career-center/career-landing-* Analysed #507957 Valid Cross-site Scripting Medium 2019-04-10 – 37 www.starbucks.co.uk Reflected XSS via utm_source parameter Analysed #140616 Valid Cross-site Scripting – 2016-12-19 – 36 Subdomain takeover on svcgatewaydevus.starbucks.com and svcgatewayloadus.starbucks.com Analysed #383564 Valid Access Control Critical 2018-07-23 – 35 Time-based Blind SQLi on news.starbucks.com Analysed #198292 Valid SQL Injection High 2017-02-24 – 35 Persistent XSS in www.starbucks.com Analysed #188972 Valid Cross-site Scripting High 2017-01-17 – 35 CRLF injection on www.starbucks.com Analysed #858650 Valid Injection and Smuggling Medium 2020-09-01 – 34 SSRF at ideas.starbucks.com Analysed #500468 Valid Server-Side Request Forgery High 2019-04-03 – 33 Starbucks China Android app cloud storage service leaks a credential. Analysed #440629 Valid Information Disclosure High 2019-09-30 – 33 Singapore - XXE at https://www.starbucks.com.sg/RestApi/soap11 Analysed #762251 Valid Injection and Smuggling High 2020-07-22 – 32 athome.starbucks.com - URL parameter tampering of review forms permitted possible content injection Analysed #367589 Valid Input Validation and Logic Medium 2020-03-17 – 31 Account take over of 'light' starbuckscardb2b users Analysed #767829 Valid Authentication High 2020-01-29 – 30