Employee's GitHub Token Found In Travis CI Build Logs Analysed #496937 Valid Information Disclosure – 2019-05-22 $5,000 408 Account takeover through the combination of cookie manipulation and XSS Analysed #534450 Valid Cross-site Scripting – 2019-12-03 – 292 Ability to DOS any organization's SSO and open up the door to account takeovers Analysed #976603 Valid Authentication – 2021-04-15 $10,500 260 Config override using non-validated query parameter allows at least reflected XSS by injecting configuration into state Analysed #1082847 Valid Input Validation and Logic – 2021-03-01 – 223 Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's origin Analysed #389108 Valid No weakness recorded – 2019-08-01 – 202 Previously created sessions continue being valid after MFA activation Analysed #667739 Valid Access Control – 2019-08-19 – 176 Lack of CSRF header validation at https://g-mail.grammarly.com/profile #629892 Valid Information Disclosure – 2019-10-31 – 140 `socket` command allows sending data over WebSockets to arbitrary origins from Grammarly Extension #395729 Valid No weakness recorded – 2019-07-15 – 140 Unauthenticated users can access all food.grammarly.io user's data #745495 Valid Access Control – 2020-08-10 – 138 Lack or Origin check leads to Cross-Site Websocket Hijacking (CSWSH) #535436 Valid Access Control – 2020-01-04 $800 134 Use Github pack with Coda employee github account (search code of Coda's private repositories) #676581 Valid No weakness recorded – 2020-01-02 – 104 Grammarly Keyboard for Android <4.1 leaks user input through logs (except for sensitive input fields) #462416 Valid Information Disclosure – 2019-06-03 – 84 “email” MFA mode allows bypassing MFA from victim’s device when the device trust is not expired #665722 Valid Authentication – 2019-08-12 $2,500 82 Grammarly Keyboard for Android "Authorization Code with PKCE" flow implementation vulnerability that allows account takeover #824931 Valid Cryptography – 2020-07-24 – 76 DOM based CSS Injection on grammarly.com #500436 Valid Cross-site Scripting – 2019-05-06 $250 63 `open-url` command allows opening unlimited number of tabs pointing to arbitrary URLs #389076 Valid No weakness recorded – 2019-04-23 – 37 Permissive CORS policy trusting arbitrary extensions origin #412490 Valid Access Control – 2019-11-06 $500 33 "More on Wikipedia" link disclose "Referrer" and leak `window.opener` reference for arbitrary websites #409518 Valid Misconfiguration and Insecure Design – 2019-04-30 – 29 Unrestricted access to any "connected pack" on docs #777942 Valid Access Control – 2020-04-14 – 27 Can register any mobile number in MFA without current code. #667740 Valid Access Control – 2019-08-15 – 15