Fee discounts can be redeemed many times, resulting in unlimited fee-free transactions Analysed #1849626 Valid Input Validation and Logic Medium 2023-02-25 $5,000 266 Mass Account Takeover at https://app.taxjar.com/ - No user Interaction Analysed #1581240 Valid Authentication Critical 2022-07-11 – 253 Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/ Analysed #1685970 Valid Authentication High 2022-10-19 – 212 Email change or personal data change on the account. Analysed #1250037 Valid Insecure Direct Object Reference Critical 2022-01-21 $3,000 149 Possible XSS vulnerability without a content security bypass Analysed #1804177 Valid Cross-site Scripting Medium 2023-05-01 $2,000 131 CSRF token validation system is disabled on Stripe Dashboard Analysed #1483327 Valid Cross-Site Request Forgery Medium 2022-04-02 – 113 Mass account takeover! Analysed #1634165 Valid Misconfiguration and Insecure Design High 2022-12-21 – 101 User can pay using archived price by manipulating the request sent to `POST /v1/payment_pages/for_plink` Analysed #1328278 Valid Insecure Direct Object Reference Medium 2022-01-19 – 100 CSRF token validation system is disabled on Stripe Dashboard Analysed #1493437 Valid Cross-Site Request Forgery Medium 2022-05-31 $2,500 87 Promotion code can be used more than redemption limit. Analysed #1717650 Valid Race Conditions Low 2023-02-13 – 55 HTML Injection in the Invoice memos field Analysed #1257767 Valid Access Control Medium 2023-03-01 $500 53 Bypassing domain deny_list rule in Smokescreen via trailing dot leads to SSRF Analysed #1410214 Valid Server-Side Request Forgery Low 2022-03-23 – 51 XSS vulnerability without a content security bypass in a `CUSTOM` App through Button tag Analysed #1823216 Valid Cross-site Scripting Medium 2023-05-01 $2,000 46 Tomcat Servlet Examples accessible at https://44.240.33.83:38443 and https://52.36.56.155:38443 Analysed #1560149 Valid Access Control Medium 2022-10-19 – 39 Verifying email bypass Analysed #1121896 Valid Access Control Low 2023-03-03 – 35 Fully TaxJar account control and ability to disclose and modify business account settings Due to Broken Access Control in /current_user_data Analysed #1677541 Valid Access Control Medium 2022-10-19 – 33 The `stripe/veneur` GitHub repository links to a domain `veneur.org`, which is not under stripe's control Analysed #2011298 Valid Misconfiguration and Insecure Design Low 2023-07-03 – 26 [Broken Access Control ] Unauthorized Linking accounts & Linked Accounts info DIsclosure Analysed #1672614 Valid Access Control Low 2022-12-20 – 26 CSRF in Importing CSV files [app.taxjar.com] Analysed #1637761 Valid Cross-Site Request Forgery Low 2023-03-16 – 26 GRAPHQL cross-tenant IDOR giving write access thought the operation UpdateAtlasApplicationPerson Analysed #1066203 Valid Insecure Direct Object Reference High 2022-03-08 – 25 Unauthorized Canceling/Unsubscribe TaxJar account & Payment information DIsclosure Analysed #1679124 Valid Access Control Medium 2022-12-20 – 24 Bypass global deny-lists by wrapping domains using "[]" in https://github.com/stripe/smokescreen #1528242 Valid Input Validation and Logic Low 2022-05-18 – 20 Local applications from user's computer can listen for webhooks via insecure gRPC server from stripe-cli #1369191 Valid Authentication Low 2022-10-19 – 20 Without verifying email and activate account, user can perform all action which are not supposed to be done #1272305 Valid Misconfiguration and Insecure Design Low 2022-07-18 – 20 Object injection in `stripe-billing-typographic` GitHub project via /auth/login #1183335 Valid Injection and Smuggling Low 2023-03-06 – 17 Bypassing domain deny_list rule in Smokescreen via double brackets [[]] which leads to SSRF #1580495 Valid Server-Side Request Forgery Low 2022-10-19 – 11