Logitech Program Statistics

View program

15 total issues disclosed

$1,400 total paid publicly

Most disclosed (2 disclosures) — Open Redirect

Disclosed Reports

Report Title Vulnerability Type Disclosed By Severity Disclosed on
clickjacking on deleting user's clips [https://crossclip.com/clips] UI Redressing (Clickjacking) ibrahimatix0x01 Low 2021-11-05
Steal any users `access_token` via open redirect in https://streamlabs.com/global/identity?popup=1&r= None supplied sudi Medium 2021-11-04
session takeover via open protocol redirection on streamlabs.com Open Redirect f_m Medium 2021-09-01
Privilege Escalation Leads to Control The Owner Access Token Which leads to control the stream [streamlabs.com] Privilege Escalation mrmax4o4 Low 2021-04-27
SSRF allows reading AWS EC2 metadata using "readapi" variable in Streamlabs Cloudbot Server-Side Request Forgery (SSRF) nrockhouse Medium 2021-02-24
Manipulating response leads to free access to Streamlabs Prime Business Logic Errors sudi Medium 2021-01-21
Sensitive information disclosure to shared access user via streamlabs platform api Information Disclosure ht0x0 Medium 2021-01-20
Moderator user has access to owner's support portal and tickets Improper Access Control - Generic ht0x0 Medium 2021-01-20
Host Header injection in oslo.io (using X-Forwarded-For header) leading to email spoofing Business Logic Errors hammodmt High 2021-01-07
One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.com Cross-Site Request Forgery (CSRF) surajbhosale Medium 2021-01-06
Stored XSS on oslo.io in notifications via project name change Cross-site Scripting (XSS) - Stored optional Medium 2021-01-05
CSRF in changing users donation_settings [https://streamlabs.com/api/v6/viewer-portal/viewer-settings/donation_settings] Cross-Site Request Forgery (CSRF) sudi Medium 2020-12-26
Stored XSS in [https://streamlabs.com/dashboard#/*goal] pages Cross-site Scripting (XSS) - Stored sudi Low 2020-12-26
IDOR when creating App on [platform.streamlabs.com/api/v1/store/whitelist] with user_id field Insecure Direct Object Reference (IDOR) bugra Low 2020-11-26
GET based Open redirect on [streamlabs.com/content-hub/streamlabs-obs/search?query=] Open Redirect raywando Low 2020-10-10