Findings
100
0
Valid Findings (confirmed exploitable)
| Severity | Type | Domain | Title |
|---|---|---|---|
| Critical | csp_unsafe_inline |
signup.sendgrid.com | csp_unsafe_inline on signup.sendgrid.com |
| Critical | csp_wildcard |
signup.sendgrid.com | csp_wildcard on signup.sendgrid.com |
| Critical | secret_exposed_aws_client_id |
ads.tiktok.com | secret_exposed_aws_client_id on ads.tiktok.com |
| Critical | secret_exposed_aws_client_id |
ads.tiktok.com | secret_exposed_aws_client_id on ads.tiktok.com |
| Critical | secret_exposed_aws_client_id |
academy-outbound-ads.tiktok.co | secret_exposed_aws_client_id on academy-outbound-ads.ti |
| Critical | secret_exposed_aws_client_id |
academy-outbound-ads.tiktok.co | secret_exposed_aws_client_id on academy-outbound-ads.ti |
| Critical | secret_exposed_aws_client_id |
academy-outbound-ads.tiktok.co | secret_exposed_aws_client_id on academy-outbound-ads.ti |
| High | secret_exposed_google_api_key |
ads.tiktok.com | secret_exposed_google_api_key on ads.tiktok.com |
| Medium | csp_unsafe_inline |
www.virtualterminal.com | csp_unsafe_inline on www.virtualterminal.com |
| Medium | csp_unsafe_inline |
autotask.net | csp_unsafe_inline on autotask.net |
| Medium | csp_wildcard |
autotask.net | csp_wildcard on autotask.net |
| Medium | csp_unsafe_inline |
github.com | csp_unsafe_inline on github.com |
| Medium | csp_wildcard |
github.com | csp_wildcard on github.com |
| Medium | csp_unsafe_inline |
app.sendgrid.com | csp_unsafe_inline on app.sendgrid.com |
| Medium | csp_wildcard |
app.sendgrid.com | csp_wildcard on app.sendgrid.com |
| Medium | csp_unsafe_inline |
luminor.lv | csp_unsafe_inline on luminor.lv |
| Medium | csp_unsafe_inline |
luminor.lt | csp_unsafe_inline on luminor.lt |
| Medium | csp_unsafe_inline |
luminor.ee | csp_unsafe_inline on luminor.ee |
| Medium | csp_unsafe_inline |
taxact.com | csp_unsafe_inline on taxact.com |
| Medium | csp_wildcard |
taxact.com | csp_wildcard on taxact.com |
| Medium | csp_unsafe_inline |
securefilepro.com | csp_unsafe_inline on securefilepro.com |
| Medium | csp_wildcard |
securefilepro.com | csp_wildcard on securefilepro.com |
| Medium | csp_unsafe_inline |
drakesoftware.com | csp_unsafe_inline on drakesoftware.com |
| Medium | csp_wildcard |
drakesoftware.com | csp_wildcard on drakesoftware.com |
| Medium | csp_unsafe_inline |
1040.com | csp_unsafe_inline on 1040.com |
| Medium | csp_wildcard |
1040.com | csp_wildcard on 1040.com |
| Medium | csp_missing_formaction |
windsurf.com | csp_missing_formaction on windsurf.com |
| Medium | csp_missing_baseuri |
windsurf.com | csp_missing_baseuri on windsurf.com |
| Medium | csp_cdn_bypass_potential |
windsurf.com | csp_cdn_bypass_potential on windsurf.com |
| Medium | clickjacking_vulnerable |
devin.ai | clickjacking_vulnerable on devin.ai |
| Medium | dangerous_js_innerHTML |
devin.ai | dangerous_js_innerHTML on devin.ai |
| Medium | dangerous_js_eval_ |
devin.ai | dangerous_js_eval_ on devin.ai |
| Medium | prototype_pollution_potential |
devin.ai | prototype_pollution_potential on devin.ai |
| Medium | rbac_admin_paths |
deepwiki.com | rbac_admin_paths on deepwiki.com |
| Medium | dangerous_js_innerHTML |
deepwiki.com | dangerous_js_innerHTML on deepwiki.com |
| Medium | postmessage_no_origin |
deepwiki.com | postmessage_no_origin on deepwiki.com |
| Medium | prototype_pollution_potential |
deepwiki.com | prototype_pollution_potential on deepwiki.com |
| Medium | cors_wildcard |
deepwiki.com | cors_wildcard on deepwiki.com |
| Medium | csp_missing_formaction |
deepwiki.com | csp_missing_formaction on deepwiki.com |
| Medium | csp_missing_baseuri |
deepwiki.com | csp_missing_baseuri on deepwiki.com |
| Medium | clickjacking_vulnerable |
cognition.com | clickjacking_vulnerable on cognition.com |
| Medium | clickjacking_vulnerable |
cognition.ai | clickjacking_vulnerable on cognition.ai |
| Medium | dangerous_js_innerHTML |
cognition.ai | dangerous_js_innerHTML on cognition.ai |
| Medium | dangerous_js_eval_ |
cognition.ai | dangerous_js_eval_ on cognition.ai |
| Medium | postmessage_no_origin |
cognition.ai | postmessage_no_origin on cognition.ai |
| Medium | prototype_pollution_potential |
cognition.ai | prototype_pollution_potential on cognition.ai |
| Medium | cors_wildcard |
cognition.ai | cors_wildcard on cognition.ai |
| Medium | csp_unsafe_inline |
partner.getyourguide.com | csp_unsafe_inline on partner.getyourguide.com |
| Medium | csp_wildcard |
partner.getyourguide.com | csp_wildcard on partner.getyourguide.com |
| Medium | dangerous_js_innerHTML |
affiliate-id.tokopedia.com | dangerous_js_innerHTML on affiliate-id.tokopedia.com |
| Medium | postmessage_no_origin |
affiliate-id.tokopedia.com | postmessage_no_origin on affiliate-id.tokopedia.com |
| Medium | prototype_pollution_potential |
affiliate-id.tokopedia.com | prototype_pollution_potential on affiliate-id.tokopedia |
| Medium | csp_missing_formaction |
affiliate-id.tokopedia.com | csp_missing_formaction on affiliate-id.tokopedia.com |
| Medium | csp_missing_baseuri |
affiliate-id.tokopedia.com | csp_missing_baseuri on affiliate-id.tokopedia.com |
| Medium | rbac_admin_paths |
ads.tiktok.com | rbac_admin_paths on ads.tiktok.com |
| Medium | dangerous_js_new Function_ |
ads.tiktok.com | dangerous_js_new Function_ on ads.tiktok.com |
| Medium | dangerous_js_innerHTML |
ads.tiktok.com | dangerous_js_innerHTML on ads.tiktok.com |
| Medium | postmessage_no_origin |
ads.tiktok.com | postmessage_no_origin on ads.tiktok.com |
| Medium | prototype_pollution_potential |
ads.tiktok.com | prototype_pollution_potential on ads.tiktok.com |
| Medium | sourcemap_exposed |
ads.tiktok.com | sourcemap_exposed on ads.tiktok.com |
| Medium | csp_missing_formaction |
ads.tiktok.com | csp_missing_formaction on ads.tiktok.com |
| Medium | csp_missing_baseuri |
ads.tiktok.com | csp_missing_baseuri on ads.tiktok.com |
| Medium | csp_cdn_bypass_potential |
ads.tiktok.com | csp_cdn_bypass_potential on ads.tiktok.com |
| Medium | clickjacking_vulnerable |
academy-outbound-ads.tiktok.co | clickjacking_vulnerable on academy-outbound-ads.tiktok. |
| Medium | exposed_aws_config |
academy-outbound-ads.tiktok.co | exposed_aws_config on academy-outbound-ads.tiktok.com |
| Medium | exposed_aws_credentials |
academy-outbound-ads.tiktok.co | exposed_aws_credentials on academy-outbound-ads.tiktok. |
| Medium | exposed_git_HEAD |
academy-outbound-ads.tiktok.co | exposed_git_HEAD on academy-outbound-ads.tiktok.com |
| Medium | dangerous_js_new Function_ |
academy-outbound-ads.tiktok.co | dangerous_js_new Function_ on academy-outbound-ads.tikt |
| Medium | dangerous_js_innerHTML |
academy-outbound-ads.tiktok.co | dangerous_js_innerHTML on academy-outbound-ads.tiktok.c |
| Medium | dangerous_js_eval_ |
academy-outbound-ads.tiktok.co | dangerous_js_eval_ on academy-outbound-ads.tiktok.com |
| Medium | postmessage_no_origin |
academy-outbound-ads.tiktok.co | postmessage_no_origin on academy-outbound-ads.tiktok.co |
| Medium | prototype_pollution_potential |
academy-outbound-ads.tiktok.co | prototype_pollution_potential on academy-outbound-ads.t |
| Medium | vulnerable_library_vue |
academy-outbound-ads.tiktok.co | vulnerable_library_vue on academy-outbound-ads.tiktok.c |
| Medium | vulnerable_library_react |
academy-outbound-ads.tiktok.co | vulnerable_library_react on academy-outbound-ads.tiktok |
| Medium | sourcemap_exposed |
academy-outbound-ads.tiktok.co | sourcemap_exposed on academy-outbound-ads.tiktok.com |
| Medium | csp_unsafe_inline |
www.gogoair.com | csp_unsafe_inline on www.gogoair.com |
| Medium | csp_wildcard |
www.gogoair.com | csp_wildcard on www.gogoair.com |
| Medium | csp_unsafe_inline |
gosatcom.net | csp_unsafe_inline on gosatcom.net |
| Medium | csp_wildcard |
gosatcom.net | csp_wildcard on gosatcom.net |
| Medium | csp_unsafe_inline |
discoverfinancial.com | csp_unsafe_inline on discoverfinancial.com |
| Medium | csp_unsafe_inline |
discover.com | csp_unsafe_inline on discover.com |
| Medium | csp_unsafe_inline |
firefox-ci-tc.services.mozilla | csp_unsafe_inline on firefox-ci-tc.services.mozilla.com |
| Medium | csp_unsafe_inline |
developer.mozilla.org | csp_unsafe_inline on developer.mozilla.org |
| Medium | csp_wildcard |
developer.mozilla.org | csp_wildcard on developer.mozilla.org |
| Medium | csp_unsafe_inline |
crash-stats.allizom.org | csp_unsafe_inline on crash-stats.allizom.org |
| Medium | csp_unsafe_inline |
bugzilla.mozilla.org | csp_unsafe_inline on bugzilla.mozilla.org |
| Medium | csp_wildcard |
addons.allizom.org | csp_wildcard on addons.allizom.org |
| Medium | csp_wildcard |
accounts.firefox.com | csp_wildcard on accounts.firefox.com |
| Medium | csp_unsafe_inline |
k8s.gcr.io | csp_unsafe_inline on k8s.gcr.io |
| Medium | csp_unsafe_inline |
arrive-server.shopifycloud.com | csp_unsafe_inline on arrive-server.shopifycloud.com |
| Medium | csp_wildcard |
arrive-server.shopifycloud.com | csp_wildcard on arrive-server.shopifycloud.com |
| Medium | csp_unsafe_inline |
customers.gitlab.com | csp_unsafe_inline on customers.gitlab.com |
| Medium | csp_wildcard |
customers.gitlab.com | csp_wildcard on customers.gitlab.com |
| Low | missing_security_header |
www.virtualterminal.com | missing_security_header on www.virtualterminal.com |
| Low | missing_security_header |
www.accessmyiq.com | missing_security_header on www.accessmyiq.com |
| Low | missing_security_header |
us.identity.konghq.com | missing_security_header on us.identity.konghq.com |
| Low | missing_security_header |
konghq.com | missing_security_header on konghq.com |
| Low | missing_security_header |
developer.konghq.com | missing_security_header on developer.konghq.com |
| Low | missing_security_header |
app.insomnia.rest | missing_security_header on app.insomnia.rest |
| Low | missing_security_header |
autotask.net | missing_security_header on autotask.net |