[Grab Android/iOS] Insecure deeplink leads to sensitive information disclosure Analysed #401793 Valid Cross-site Scripting – 2019-03-15 – 552 www.drivegrab.com SQL injection #273946 Valid SQL Injection – 2017-11-17 $4,500 205 Leaking sensitive information on Github lead full access to all Grab Slack channels #397527 Valid Information Disclosure – 2018-09-11 – 145 Subdomain Takeover Via Insecure CloudFront Distribution cdn.grab.com #352869 Valid Memory Corruption – 2021-02-24 $1,000 142 Leak ██████████ information in real time through API request #307050 Valid Authentication – 2018-02-03 $3,000 103 Access Grab_Road BigData Database via Open Presto coordinator #266766 Valid Information Disclosure – 2017-11-30 $5,000 97 Authorization bypass using login by phone option+horizontal escalation possible on Grab Android App #205000 Valid Authentication – 2017-09-14 – 68 Blind stored xss [parcel.grab.com] > name parameter #251224 Valid Cross-site Scripting – 2017-09-14 $750 50 Two-factor authentication bypass on Grab Android App #202425 Valid Authentication – 2017-09-12 – 46 Git repository found #248693 Valid Information Disclosure – 2017-08-13 – 43 Private Grab Messages on Android App can be accessed and cached by Search Engines #221558 Valid No weakness recorded – 2017-09-14 – 34 Registration enabled on ███grab.com #318099 Valid Information Disclosure – 2018-02-28 – 32 [growth.grab.com] Reflected XSS via Base64-encoded "q" param on "my.html" Valentine's microsite #320679 Valid Cross-site Scripting – 2018-03-02 – 29 Unrestricted access to https://██████.█████myteksi.net/ #304386 Valid Access Control – 2018-02-12 $250 23 stored xss in comments : driver exam #274443 Valid Cross-site Scripting – 2017-11-30 $250 21 [parcel.grab.com] DOM XSS at /assets/bower_components/lodash/perf/ #248560 Valid Cross-site Scripting – 2017-08-16 – 21 CSV Injection https://hub.grab.com #244292 Valid Command and Code Injection – 2017-10-27 – 20 Unrestricted access to Eureka server on ██████ #304240 Valid Access Control – 2018-02-06 $500 17 Dom based xss affecting all pages from https://www.grab.com/. #247246 Valid Cross-site Scripting – 2017-08-17 – 16 Production secret key leak in config/secrets.yml #456997 Informative Cryptography – 2019-01-08 – 11