RCE on build server via misconfigured pip install Analysed #946409 Valid Supply Chain and Malicious Code – 2021-02-09 – 366 yelp.com XSS ATO (via login keylogger, link Google account) Analysed #2010530 Valid Cross-site Scripting – 2023-08-15 – 324 I.D.O.R To Order,Book,Buy,reserve On YELP FOR FREE (UNAUTHORIZED USE OF OTHER USER'S CREDIT CARD) Analysed #391092 Valid Insecure Direct Object Reference – 2020-08-19 – 214 Object Level access control leads to reading user's full requests, sessions, and error messages #2891449 Valid Access Control Medium 2025-01-18 – 113 CRITICAL Insecure Direct Object Reference (I.D.O.R) - Link Other User's Credit Card #358143 Valid Information Disclosure – 2020-08-19 – 87 Access to internal CMS containing private Data #100926 Valid Authentication – 2016-10-07 – 83 Unauthorized Reservation Cancellation Through IDOR Vulnerability #2944357 Duplicate Insecure Direct Object Reference High 2025-01-29 – 79 Yelp for Business: locked Email field silently editable via API #3766455 Valid Input Validation and Logic Medium 2026-07-02 – 76 Privilege Escalation - A Non Owner User Who Does not Have access to the user management can invite other users to the restaurant page #2396549 Valid Access Control Low 2025-01-29 – 75 X-Forward-For Header allows to bypass access restrictions #1011767 Valid Access Control – 2020-10-26 – 73 Privilege Escalation - A Low Privilege User who does not have access to the user management module can remove the owner of the business account #2396571 Valid Access Control Low 2025-01-28 – 60 RXSS AT https://proze.yelp.com/tmsubscribe.net/vidsn.aspx #2947762 Valid Cross-site Scripting Medium 2025-06-30 – 56 Debug Deep Link Abuse Allows Repeated Forced Logout and Application Disruption #3829030 Valid Misconfiguration and Insecure Design Low 2026-08-13 – 54 Bybass The Closing of the account and logged again to your account #167489 Valid Authentication – 2016-10-21 – 34 I.D.O.R TO EDIT ALL USER'S CREDIT CARD INFORMATION+(Partial credit card info disclosure) #361984 Valid Insecure Direct Object Reference – 2020-08-19 – 32 No rate limiting for confirmation email lead to email flooding #774050 Valid Misconfiguration and Insecure Design – 2020-02-11 – 24 Multiple Vulnerabilities in (*.blog.yelp.com) - Leakage user admin Sensitive Exposure #779656 Informative Input Validation and Logic – 2020-01-29 – 23 Able to download arbitrary PHP files at yelpblog.com #194351 Valid Access Control – 2017-02-06 – 21 Information disclosure - emails disclosed in response > staging.seatme.us #49170 Valid Cross-Site Request Forgery – 2017-05-11 – 21 CORS Misconfiguration on Yelp #1707616 Informative No weakness recorded – 2022-09-28 – 19 CRITICAL-CLICKJACKING at Yelp Reservations Resulting in exposure of victim Private Data (Email info) + Victim Credit Card MissUse. #355859 Valid Access Control – 2020-08-21 – 18 Password reset token not expiring #170161 Valid Authentication – 2017-11-09 – 18 Direct access to tox.ini file which is contain configuration details #1824865 Valid Information Disclosure – 2023-03-02 – 15 DoS of https://blog.yelp.com/ and other WP instances via CVE-2018-6389 #753491 Informative No weakness recorded – 2020-01-17 – 15 [engineeringblog.yelp.com] CRLF Injection #66391 N/A No weakness recorded – 2017-11-09 – 14 No rate limit on subscribe form #1708824 Informative Input Validation and Logic – 2022-10-05 – 13 Clickjacking Vulnerability found on Yelp #214087 Valid Cross-Site Request Forgery – 2017-05-12 – 13 CSRF on signup endpoint (auto-api.yelp.com) #178831 Valid Cross-Site Request Forgery – 2017-03-01 – 13 PURGE is not authenticated #629612 Informative Authentication – 2023-01-19 – 12 Leaking sensitive information lead to compromise employer API keys #273630 Valid Information Disclosure – 2017-11-09 – 12 IDNs displayed in unicode in messages/about/talk sections (Homograph Attack) #172933 Valid Misconfiguration and Insecure Design – 2017-11-09 – 12 Public Github Repo Leaking Internal Credentials #1763266 Informative No weakness recorded – 2022-11-07 – 10 Robots.txt file with potentially sensitive content. #1724771 N/A Information Disclosure – 2023-01-13 – 10 Verification of email addresses possible through https://www.yelp.com/signup/facebook #194721 Valid Information Disclosure – 2017-09-16 – 10 Verification of E-Mail address possible on https://biz.yelp.com/login and https://biz.yelp.com/forgot #166265 Valid Information Disclosure – 2016-10-27 – 10 Self-XSS via location cookie city field when getting suggestions for a new location #166709 Informative Cross-site Scripting – 2016-11-30 – 8 Clickjacking lead to remove review #965141 Valid No weakness recorded – 2020-09-01 – 7 Unauthorized Use of Victim Credit Card #391385 Valid Information Disclosure – 2020-08-21 – 7 Firefly's verify_access_token() function does a byte-by-byte comparison of HMAC values. #240958 Valid Cryptography – 2017-07-10 – 7 X.509 certificate validation fails on international vanity domains #180538 Valid Misconfiguration and Insecure Design – 2017-02-06 – 7 Requesting Show CheckIn Alert for Non Friend User #174882 Valid Information Disclosure – 2016-10-27 – 7 installed.json sensitive file was publicly accessible on your web application which discloses information about authors and admins #1586524 Informative Information Disclosure – 2022-10-22 – 6 Server-side request forgery (ssrf) #1712240 N/A Server-Side Request Forgery – 2022-09-28 – 5 ClickJacking on IMPORTANT Functions of Yelp #305128 Valid Misconfiguration and Insecure Design – 2020-08-21 – 5 Ngnix Server version disclosure 404 Page! #167036 Informative Information Disclosure – 2017-11-09 – 5 IDOR(indirect object references) on add friend,complement and send message #166849 N/A Misconfiguration and Insecure Design – 2017-11-09 – 5 Autofill/Autosave password on login #1720621 N/A Authentication – 2022-10-11 – 4 CORS Misconfiguration on trust.yelp.com #1716286 N/A No weakness recorded – 2022-10-10 – 4 xmlrpc file enabled #1575401 Duplicate Information Disclosure – 2022-06-16 – 4 Fraudulent claim of business. #1422227 N/A No weakness recorded – 2023-02-06 – 4