SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll Database Analysed #531051 Valid SQL Injection – 2019-08-06 – 801 JumpCloud API Key leaked via Open Github Repository. Analysed #716292 Valid Authentication – 2019-12-30 – 739 Webshell via File Upload on ecjobs.starbucks.com.cn Analysed #506646 Valid Command and Code Injection – 2019-11-13 – 688 RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/ Analysed #502758 Valid Command and Code Injection – 2019-04-10 – 572 XXE at ecjobs.starbucks.com.cn/retail/hxpublic_v6/hxdynamicpage6.aspx Analysed #500515 Valid Injection and Smuggling – 2019-11-13 – 319 Subdomain takeover of datacafe-cert.starbucks.com Analysed #665398 Valid Access Control – 2019-08-28 – 311 Singapore - Account Takeover via IDOR Analysed #876300 Valid Insecure Direct Object Reference – 2020-07-28 – 260 Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sg Analysed #1027822 Valid Access Control – 2020-12-09 – 247 Misuse of an authentication cookie combined with a path traversal on app.starbucks.com permitted access to restricted data Analysed #876295 Valid File and Path Handling – 2020-06-16 – 239 Blind SQLi leading to RCE, from Unauthenticated access to a test API Webservice Analysed #592400 Valid SQL Injection – 2019-07-22 – 236 Blind SQL Injection on starbucks.com.gt and WAF Bypass :* Analysed #549355 Valid SQL Injection – 2019-06-19 – 210 sdrc.starbucks.com - Information Disclosure via unsecured attachment directory Analysed #769016 Valid Information Disclosure – 2020-02-26 – 197 Reflected Cross site Scripting (XSS) on www.starbucks.com Analysed #438240 Valid Cross-site Scripting – 2019-03-08 – 181 Bug in GraphQL and API integration leads to limited user address disclosure #473742 Valid Access Control – 2019-03-08 – 144 Subdomain takeover of d02-1-ag.productioncontroller.starbucks.com #661751 Valid Access Control – 2019-08-15 – 122 Subdomain takeover of mydailydev.starbucks.com #570651 Valid Server-Side Request Forgery – 2019-05-22 – 122 China – Limited Partner PII Regarding Work Scheduling via Unauthenticated API Endpoint #659248 Valid Information Disclosure – 2020-04-01 – 116 Subdomain takeover on svcgatewayus.starbucks.com #325336 Valid Access Control – 2018-06-25 – 109 Subdomain takeover on happymondays.starbucks.com due to non-used AWS S3 DNS record #186766 Valid Access Control – 2016-12-19 – 105 Thailand - a small number of SMB CCTV footage backup servers were accessible without authentication. #417360 Valid Access Control – 2019-11-19 – 99 Subdomain takeover on wfmnarptpc.starbucks.com #388622 Valid Access Control – 2018-08-09 – 91 Multiple Subdomain takeovers via unclaimed instances #276269 Valid Access Control – 2017-12-04 – 83 Korea - LFI via path traversal at https://msr.istarbucks.co.kr:6443/appif/ #780021 Valid File and Path Handling – 2020-03-10 – 81 Cross-Site Scripting (XSS) on www.starbucks.com | .co.uk login pages #881115 Valid Cross-site Scripting – 2020-06-30 – 78 Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using Chrome #1113559 Valid Cross-Site Request Forgery – 2021-05-18 – 77 Leaking sensitive files on Github leads to internal files (python scripts,SQL files) #301831 Valid Information Disclosure – 2018-05-17 – 73 Reflected cross-site scripting on multiple Starbucks assets. #629745 Valid Cross-site Scripting – 2019-10-16 – 72 Reflected XSS in https://www.starbucks.co.jp/store/search/ #496375 Valid Cross-site Scripting – 2019-05-22 – 72 China - president-starbucks.com.cn DNS configuration reported as takeover #423269 Valid Access Control – 2020-03-17 – 71 Parameter Manipulation allowed for viewing of other user’s teavana.com orders #141090 Valid Authentication – 2017-01-13 – 71 [mena.starbucks.com] Laravel App Log & Configuration Disclosure. #401098 Valid Information Disclosure – 2019-09-30 – 63 Singapore - Unrestricted File Upload Leads to XSS on campaign.starbucks.com.sg/api/upload #883151 Valid Cross-site Scripting – 2020-07-22 – 61 WAF bypass via double encoded non standard ASCII chars permitted a reflected XSS on response page not found pages - (629745 bypass) #716761 Valid Cross-site Scripting – 2020-01-29 – 58 Information disclosure on sim.starbucks.com #632808 Valid Information Disclosure – 2019-11-13 – 58 Store Development Resource Center was vulnerable to a Remote Code Execution - Unauthenticated Remote Command Injection (CVE-2019-0604) #536134 Valid Command and Code Injection – 2019-12-12 – 57 Open Redirection in Login - Korean Starbucks #380939 Valid Open Redirect – 2019-03-20 – 54 Subdomain takeover on developer.openapi.starbucks.com #275714 Valid Access Control – 2018-02-17 – 51 Unauthorized access to jiratest.starbucks.com #332586 Valid Authentication – 2018-05-30 – 49 Information Leak - Github - JMS Information #360811 Valid Information Disclosure – 2018-08-16 – 48 Java Deserialization RCE via JBoss on card.starbucks.in #221294 Valid Command and Code Injection – 2017-05-22 – 48 China - ecjobsdc.starbucks.com.cn html/shtml file upload vulnerability #412481 Valid Access Control – 2020-01-29 – 46 China - IDOR on Reservation Staging/Non Production Site - https://reservation.stg.starbucks.com.cn #715054 Valid Insecure Direct Object Reference – 2020-09-22 – 45 Reflected XSS in https://www.starbucks.com/account/create/redeem/MCP131XSR via xtl_amount, xtl_coupon_code, xtl_amount_type parameters #531042 Valid Cross-site Scripting – 2019-11-13 – 43 Java Deserialization RCE via JBoss JMXInvokerServlet/EJBInvokerServlet on card.starbucks.in #153026 Valid Command and Code Injection – 2017-02-03 – 42 Able to purchase a gift card with any amount #316789 Valid Insecure Direct Object Reference – 2018-07-20 – 41 svcardproxydevus.starbucks.com Subdomain take over #380158 Valid Access Control – 2018-07-23 – 39 PHPinfo page #367050 Valid Information Disclosure – 2019-06-12 – 39 Stored XSS on www.starbucks.com.sg/careers/career-center/career-landing-* #507957 Valid Cross-site Scripting – 2019-04-10 – 37 Parameter Manipulation allowed for editing the shipping address for other user’s teavana.com subscriptions. #141120 Valid Authentication – 2017-01-26 – 37 Thailand - Insecure Direct Object Reference permits an unauthorized user to transfer funds from a victim using only the victims Starbucks card #766437 Valid Insecure Direct Object Reference – 2020-02-11 – 36