critical file found etc/passwd on www.reddit.com #1187003 N/A Information Disclosure High 2021-10-21 – 10 XSS in redditmedia.com can compromise data of reddit.com #862882 N/A Cross-site Scripting Medium 2022-08-03 – 10 Rate limit is implemented in Reddit , but its not working . #1609004 Duplicate Authentication Low 2023-05-18 – 9 User Account has been taken out #1195340 Duplicate Authentication Critical 2021-10-21 – 9 Huge amount of Subdomains Takeovers at Reddit.com #1966262 Duplicate Access Control Medium 2023-05-18 – 8 hardcoded api secret & api key in com.reddit.frontpage #1241116 Informative Authentication Critical 2021-10-21 – 8 No Rate limit on change password leads to account takeover #1165285 Duplicate Authentication Low 2021-12-13 – 8 Regular Expression Denial of Service vulnerability #1538157 Informative Denial of Service Medium 2022-04-12 – 6 Broken links make users from France unable to understand the allowed content policy #1461207 Informative No weakness recorded None 2023-05-18 – 6 sensitive data exposure #1716249 N/A Information Disclosure High 2022-11-10 – 5 Broken Authendication And Session Management #1167029 N/A Access Control – 2021-10-21 – 5 Reflected XSS via File Upload #1816181 N/A Cross-site Scripting Medium 2023-05-18 – 4 S3 bucket Upload on studio.redditinc.com (s3-r-w.ap-east-1.amazonaws.com) #1276733 Informative Access Control Low 2021-10-21 – 4 CVE-2020-11022 #1812768 N/A Cross-site Scripting Medium 2023-05-18 – 3 Email Verification Bypass And Get access to user's private invitation. #1350401 N/A Input Validation and Logic Medium 2021-10-21 – 3 Several Subdomains Takeover #1591085 N/A No weakness recorded High 2022-06-08 – 2 No rate limit on password reset leads to email enumeration at gateway-production.dubsmash.com #1425884 No longer public No weakness recorded – – – 2 com.reddit.frontpage vulernable to Task Hijacking (aka StrandHogg Attack) #1325649 Duplicate Input Validation and Logic Medium 2021-12-13 – 2 No Password Length Restriction leads to Denial of Service #1243009 Duplicate Denial of Service None 2021-10-21 – 2 Vulnerability Name: URL Redirection / Unvalidate Open Redirect #1182824 N/A Open Redirect – 2021-10-21 – 2 Content Spoofing/Text Injection at https://gateway-production.dubsmash.com #1166770 N/A Input Validation and Logic None 2021-10-27 – 1 Content Spoofing #1165919 N/A Input Validation and Logic Low 2021-10-21 – 1