Passive stored XSS at broadcast room Analysed #423797 Valid Cross-site Scripting High 2018-11-06 – 74 Reflected XSS on secure.chaturbate.com Analysed #413412 Valid Cross-site Scripting High 2018-10-18 $800 69 Account Takeover via billing Analysed #394329 Valid Access Control Critical 2018-09-19 $8,000 56 Open redirection at https://chaturbate.com/auth/login/ Analysed #411723 Valid Open Redirect Low 2018-10-22 – 55 Blind SSRF at https://chaturbate.com/notifications/update_push/ Analysed #411865 Valid Server-Side Request Forgery High 2018-10-21 – 54 Forget password link not expiring after email change. Analysed #411337 Valid Access Control Medium 2018-09-20 – 46 The auto login link does not expire on changing email id Analysed #472026 Valid Access Control Low 2019-05-16 – 45 CSS Injection on /embed/ via bgcolor parameter leaks user's CSRF token and allows for XSS Analysed #386334 Valid Cross-site Scripting High 2018-09-19 – 43 DoS attacks utilizing camo.stream.highwebmedia.com Analysed #507525 Valid Denial of Service Medium 2019-05-01 $400 41 Stored XSS in chat topic due to insecure emoticon parsing on any message type #429298 Valid Cross-site Scripting Medium 2018-11-01 $450 33 View Failed Approval and Pending videos other users #411679 Valid No weakness recorded Low 2018-10-21 $200 28 Web cache deception attack - expose token information #397508 Valid Information Disclosure Medium 2018-09-20 – 28 Rate limit missing at room login #385381 Valid Authentication Medium 2018-09-30 $500 28 Open redirect on chaturbate.com (tipping/purchase_success) #413426 Valid Open Redirect Low 2018-10-25 $250 26 Camo Image Proxy Bypass with CSS Escape Sequences #745953 Valid Injection and Smuggling Low 2019-12-18 – 25 Update Chat Allowed By Option ( without age verification ) #422698 Valid Input Validation and Logic Low 2018-10-18 – 23 Missing Rate Limitation at /apps/upload_app/ #416906 Valid Input Validation and Logic Low 2018-10-07 – 21 Missing Rate Limitation at /photo_videos/photoset/create #426547 Valid Input Validation and Logic Low 2018-11-24 – 20 No rate limiting in changing room subject. #418145 Valid No weakness recorded Low 2018-10-09 – 19 Stored XSS on chaturbate.com (wish list) #425048 Valid Cross-site Scripting Low 2018-11-06 $100 18 [chaturbate.com] - CSRF Vulnerability on image upload #401483 Valid No weakness recorded Medium 2018-09-19 $300 17 Chaturbate "/chat_ignore_list/" endpoint does not check for Account status: Disabled before adding Ignore via POST #415398 Valid Input Validation and Logic Low 2018-10-31 – 16 Form Replay in customer information form #411620 Valid Authentication Medium 2019-01-11 – 16 Unrestricted POST request size on roomlogin endpoint #418254 Valid Denial of Service Low 2018-10-07 $200 15 No rate limiting in starting up a bot. #418151 Valid No weakness recorded Low 2018-10-09 – 15 No rate limit in stats api token endpoint #412526 Valid Authentication Low 2018-10-19 – 15 Login form on non-HTTPS page on http://stream.highwebmedia.com/auth/login/ #386735 Valid Cryptography Low 2018-09-20 – 15 Cross-origin resource sharing: arbitrary origin trusted on chatws25.stream.highwebmedia.com #417453 Informative Access Control None 2018-10-04 – 14 CSRF on change video thumbnail at https://chaturbate.com #416682 Valid Cross-Site Request Forgery Low 2018-10-07 – 14 No rate limit in affiliate statsapi endpoint #413505 Valid Authentication Low 2018-10-19 – 14 CSV Injection with the CSV export feature #386116 Valid Command and Code Injection Low 2018-09-20 – 14 [chatws25.stream.highwebmedia.com] - Reflected XSS in c parameter #413442 Valid Cross-site Scripting Medium 2018-09-26 $350 13 Bypass subdomain limits using race condition #395351 Valid Race Conditions Low 2018-09-27 $100 13 Users may still able to view chat room panel of password protected rooms #386351 Valid Access Control Medium 2018-09-20 – 13 Leaking Username and Password in the URLs via Virustotal, can leads to account takeover #411920 Informative Information Disclosure None 2018-09-21 – 11 Password protected rooms total number of viewers disclosure to unauthorized members #411822 Valid Information Disclosure Low 2018-09-24 – 11 Private and group tokens per minute endpoint active for disabled users #403603 Valid Access Control Low 2018-09-27 $150 11 Add non-existent room moderator #385239 Valid Input Validation and Logic Low 2018-10-19 – 11 Homograph attack on redirect URL (https://chaturbate.com/external_link/?url) #385145 Valid Misconfiguration and Insecure Design Low 2018-09-20 – 11 Open redirect in securegatewayaccess.com / secure.chaturbate.com via prejoin_data parameter #400982 Valid Open Redirect Medium 2018-09-19 $250 10 CSRF in REPORT EMOTICON feature #395731 Valid Cross-Site Request Forgery Low 2018-09-27 $250 10 Blind SSRF on image proxy camo.stream.highwebmedia.com #385178 Valid Server-Side Request Forgery Medium 2018-09-20 – 10 Stored XSS against all Chaturbate users using an application name #384814 Valid Cross-site Scripting Medium 2018-09-19 – 10 Homograph attack on redirect URL #385372 Valid Misconfiguration and Insecure Design Low 2018-10-19 – 9 Unrestricted POST request size on /customer_support/information_form/ endpoint #514293 Valid Misconfiguration and Insecure Design Low 2019-05-01 – 8 Stats Token doesn't expire after deactivating account #394516 Valid Access Control Low 2018-09-27 $250 8 CSRF in cancel group and private show requests #396338 Valid Cross-Site Request Forgery Medium 2018-09-21 $300 7 Reflected XSS on ssl-ccstatic.highwebmedia.com via player.swf #386340 Valid Cross-site Scripting Medium 2018-09-19 – 7 CSRF in "send them an email and browser notification" feature #396802 Valid Cross-Site Request Forgery Low 2018-09-27 $150 6 A 10GB file is reachable #416516 Informative Information Disclosure None 2018-10-01 – 4