Git flag injection leads to arbitrary file write #1070247 Valid File and Path Handling – 2021-07-25 – 54 Command injection on Phabricator instance with an evil hg branch name #288704 Valid Command and Code Injection – 2017-11-11 – 41 IDOR bug to See hidden slowvote of any user even when you dont have access right #661978 Valid Insecure Direct Object Reference – 2019-08-29 $300 36 SSRF in notifications.server configuration #850114 Valid Server-Side Request Forgery – 2020-05-15 $300 28 Broken Authentication and Session Management #17474 Valid Authentication – 2014-08-05 – 26 Phabricator is vulnerable to padding oracle attacks and chosen-ciphertext attacks. #216746 Valid Cryptography – 2017-04-05 $750 23 Markdown parsing issue enables insertion of malicious tags #758002 Valid Cross-site Scripting – 2019-12-13 – 21 Log in a user to another account #774 Valid Cross-Site Request Forgery – 2014-02-22 $300 21 User can link non-public file attachments, leading to file disclose on edit by higher-privileged user #763177 Valid Input Validation and Logic – 2022-06-26 $500 20 Window.opener protection Bypass #306414 Valid No weakness recorded – 2018-02-17 $300 19 Possible to make restricted files public on Phabricator via Diffusion #1560717 Valid Access Control – 2022-07-29 $2,000 17 Bypass auth.email-domains #2224 Valid Authentication – 2014-03-25 $1,000 15 User with only Viewing Privilege can send message to Room #202499 Valid Access Control – 2017-02-01 $300 14 Login CSRF using Twitter OAuth #2228 Valid Cross-Site Request Forgery – 2014-03-26 – 14 Improperly implemented password recovery link functionality #809 Valid Authentication – 2014-02-27 $300 14 Bypass auth.email-domains (2) #2233 Valid Authentication – 2014-03-26 $500 13 Exposing voting results on the Slowvote application without actually voting #434116 Valid No weakness recorded – 2018-11-05 $300 12 Window.opener fix bypass #317243 Valid No weakness recorded – 2018-02-18 $300 12 HTML in Diffusion not escaped in certain circumstances #148865 Valid Cross-site Scripting – 2016-08-01 – 12 Administrator can create user without entering high security mode #351361 Valid Authentication – 2018-05-22 – 11 Global default settings page is accessible to non-administrators #1563139 Valid Access Control – 2022-05-09 $300 10 Differential "Show Raw File" feature exposes generated files to unauthorised users #213942 Valid Information Disclosure – 2017-03-16 – 10 OAuth Stealing Attack (New) #3930 Valid Open Redirect – 2014-04-13 $400 10 Conduit feed.publish API allows you to spoof other users or make it look like you have access to a restricted object #1566325 Valid No weakness recorded – 2022-05-18 $300 9 OAuth access_token stealing in Phabricator #3596 Valid Open Redirect – 2014-04-11 $450 9 Issue:Form does not contain an anti-CSRF token #513134 N/A Cross-Site Request Forgery – 2019-03-22 – 8 Fetching binaries (for software installation) over HTTP without verification (RCE as ROOT by MITM) #186352 Valid No weakness recorded – 2016-12-29 $300 8 Forgot Password Issue #23363 Valid Authentication – 2014-09-10 – 8 Persistent XSS: Editor link #4114 Valid Cross-site Scripting – 2014-04-16 $300 8 Control character allowed in username #3921 Valid No weakness recorded – 2014-04-12 $300 8 Deprecated owners.query API bypasses object view policy #1584409 Valid Access Control – 2022-05-31 $300 7 TOTP Key is shorter than RFC 4226 recommended minimum #435648 Valid Cryptography – 2018-12-07 $300 7 IRC-Bot exposes information #222870 Valid Information Disclosure – 2017-04-21 – 7 UnAuthorized Editorial Publishing to Blogs #3356 Valid Authentication – 2014-04-05 $300 7 Slowvote and Countdown can cause Denial of Service due to recursive inclusion #1563142 Valid Denial of Service – 2022-05-09 – 5 Request vulnerable to CSRF #513137 N/A Cross-Site Request Forgery – 2019-03-22 – 5 The special code in editor has no Authority control and can lead to Information Disclosure #221950 Informative Information Disclosure – 2017-04-22 – 5 The mailbox verification API interface is unlimited and can be used as a mailbox bomb #221948 N/A Access Control – 2017-04-26 – 5 Enumerating emails through "Forgot Password" form #203614 Informative Misconfiguration and Insecure Design – 2017-02-06 – 5 Content Spoofing through URL #28792 Informative Misconfiguration and Insecure Design – 2014-09-20 – 5 Broken Authentication and Session Management lead to take over account #1271710 N/A Access Control High 2021-07-21 – 4 Error page Text Injection. #156196 N/A Misconfiguration and Insecure Design – 2016-08-25 – 4 SSRF vulnerability (access to metadata server on EC2 and OpenStack) #53088 Valid Information Disclosure – 2015-03-26 $300 4 Password Reset Links Not Expiring #22858 Informative Authentication – 2014-09-06 – 4 Edit Policy restriction does not prevent comments. #923759 Informative Access Control – 2020-07-17 – 3 Autoclose can close any task regardless of policies/spaces #220909 Valid No weakness recorded – 2017-04-24 – 3 Restricted file access when it exists in old versions of task or wiki document #203658 Informative Misconfiguration and Insecure Design – 2017-02-06 – 3 link reset problem #164483 N/A No weakness recorded – 2016-08-30 – 3 No authentication required to add an email address. #139965 Informative Authentication – 2016-05-27 – 3 Server Side Request Forgery in macro creation #50537 Informative Information Disclosure – 2015-03-09 – 3