repository icon
bookwyrm-social / bookwyrm Project repository

Social reading and reviewing, decentralized with ActivityPub

Submit a report

FIRST INTERACTION

WITHIN1 DAY

REVIEW

WITHIN4 DAYS

FIX

WITHIN6 DAYS

Take over any type of status of any users (like review,...) and modify it or del...
mq-xz
pending
No rate limit on delete account feature allows an attacker to delete the victim...
nehalr777
pending
Audit url open for permitted schemes.
ahsentekdemir
self closed
UI Redressing (Clickjacking)
0xcybery
self closed
Improper Link Input Validation leads to Open Redirect [bookwyrm.social]
agnihackers
pending
insecure direct object reference
gaurav-g2
pending
Idor lead to create list in private group
gaurav-g2
pending
Authorization Bypass: Blocked User can still send Direct Messages to the the Use...
ahmad0x1
duplicate
Critical
Send message to blocked user
gaurav-g2
Critical
Tabnabbing via window.opener [bookwyrm.social]
agnihackers
High
•$5•CVE-2022-35953
No Rate Limit On Reset Password Page [ bookwyrm.social ]
agnihackers
duplicate
Critical
Account Takeover
agnihackers
duplicate
Critical
Idor when creating group
gaurav-g2
Critical
•$10
Insecure Direct Object References when creating a list
khanhchauminh
Critical
•$14
Cross-Site Request Forgery (CSRF)
khanhchauminh
Critical
•$14
Insecure direct object references in "comment" function
nhienit2010
duplicate
Critical
Insecure direct object references in "review" function
nhienit2010
Critical
•$10
Insecure direct object references in "reply" function
nhienit2010
duplicate
Critical
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
7h3h4ckv157
pending
Server-Side Request Forgery (SSRF)
khanhchauminh
pending
Insecure redirect when submit invalid form
nhienit2010
High
•$5
Insecure direct object references in `create-shelf` function
nhienit2010
Critical
•$10
Insecure Storage of Sensitive Information
khanhchauminh
pending
No Rate Limit On Resend confirmation link Page
khanhchauminh
duplicate
Critical
Email enumeration via Resend link page
khanhchauminh
High
•$8
Email Verification Bypass Leads To Account Takeover
akshayravic09yc47
Critical
•$10•CVE-2022-2651
Account Takeover
akshayravic09yc47
Critical
•$10•CVE-2022-35925
Accept weak password in reset-password function
nhienit2010
Critical
•$10
Open redirect when login successfully
nhienit2010
High
•$5
Cross-Site Request Forgery (CSRF)
khanhchauminh
High
•$6
Weak policy at Change password function
khanhchauminh
Critical
•$12
No Password Verification on Changing password leads to Account takeover
khanhchauminh
duplicate
Critical
Weak Password Change Mechanism
7h3h4ckv157
High
•$5
No Rate Limit On Reset Password Page
khanhchauminh
Critical
•$12
Cross-Site Request Forgery (CSRF)
khanhchauminh
High
•$6
Email enumeration via Reset password page
khanhchauminh
Low
Mutation Stored XSS at homepage
vovikhangcdv
Critical
•$10•CVE-2022-31136
Improper Link Input Validation leads to Cross-site Scripting (XSS)
vovikhangcdv
Medium