224 matches found
Coinbase: Requestor Email Disclosure via Email Notification
When a Coinbase user requests money from another coinbase user, the user that receives the request sees an email that says, in part: John Smith [email protected] sent you a request to pay 1 BTC using Coinbase. Where John Smith is the sending account's display name meaning you can make it whatever you...
Coinbase: Information disclosue in Android Application
Duplicate report we missed closing out...
Coinbase: Information disclosure in coinbase android app
Per our policy, issues which require rooted victim devices are in-scope...
Coinbase: Window.opener bug at www.coinbase.com
Window.Opener Bug Description: When you open a link in a new tab target="blank" , the page that opens in a new tab can access the initial tab and change it's location using the window.opener property. Browsers Verified In: Mozilla Firefox Steps To Reproduce: 1. Visit https://www.coinbase.com/ 2. ...
Coinbase: Authentication Issue
Hello there, I noticed while creating Recurring payment while 2FA is enabled it asks a user to enter verification code. So when someone confirm the Reccuring payment a request is sent to : POST /recurringpayments/58087a3d6861ee015644fc48/confirm HTTP/1.1 Host: beta.coinbase.com User-Agent:...
Coinbase: Information disclosure of user by email using buy widget
In the Coinbase Buy Widget flow, we were displaying the last 4 digits of a user's phone number for verification purposes e.g. "we've send a code to xxx-1234". Industry standard seems to be 2 digits instead of 4, so we now mask all but the last 2 digits...
Coinbase: Information leakage on https://docs.gdax.com
docs.gdax.com was exposing the nginx version in error pages. We changed the nginx configuration to not report that information as a defense-in-depth measure...
Coinbase: coinbase Email leak while sending and requesting
Due to a bug first reported by another researcher, when one coinbase user sent bitcoin to another coinbase user, the receiving user had the sending user's email address silently added to their contact list. While this does not raise PII exposure concerns under our Privacy Policy, we felt it was...
Coinbase: window.opener is leaking to external domains upon redirect on Safari
Although Coinbase cleared window.opener on external redirects, it was not effective on WebKit-based browsers Safari since Safari's cross-origin security prevents the modification of window.opener of a child window if it lies on a different origin, yet still allows the child window to access...
Coinbase: Create Multiple Account Using Similar X-CSRF token
Multiple Accounts can be created using the similar X-csrf token ! I have tested and created around 45+ accounts in this way ! Take a look ! in attachment ! i have created account range from test1-test27 3 times ! File is also attached for tested creating accounts !...
Coinbase: Content Injection error page
poc url: https://images.coinbase.com/has.been.changed.to.https://images.attacker.com/,so.please.visit.https://images.attacker.com...
Coinbase: No authorization required in iOS device web-application
Hey, this is Ahsan Tahir! I've found a authorization issue in coinbase! :- Issue ======= When we login to coinbase using PC not authorized it asks for authorization using a link, which is sent to our email and we have to authorize it by clicking on that email; but, when we login to a iOS device...
Coinbase: No authorization required in Windows phone web-application
Hey, this is Ahsan Tahir! I've found a authorization issue in coinbase! :- Issue ======= When we login to coinbase using PC not authorized it asks for authorization using a link, which is sent to our email and we have to authorize it by clicking on that email; but, when we login to a windows phon...
Coinbase: Application error message
poc url:https://developers.coinbase.com/api/%e3h This page contains an error/warning message that may disclose sensitive information.The message can also contain the location of the file that produced the unhandled exception.This may be a false positive if the error message is found in...
Coinbase: Transaction Pending Via Ip Change
Hi , Wamim Here . I Normally Use my Account From My Country Ip Email But Last Some Days I Checked And Found That When I Change My Ip Before Login Or Sending that time I got Mail After The Money Send Kindly Note That From Normal Ip when You sent you received mail instant when money sent .but this...
Coinbase: Cookie not secure
The cloudflare cookie does not have the Secure flag set. When a cookie is set with the Secure flag, it instructs the browser that the cookie can only be accessed over secure SSL channels. This is an important security protection for session cookies...
Coinbase: User's legal name could be changed despite front end controls being disabled
Despite the front-end form fields being disabled, a user could still change his/her legal name by manually manipulating the form in developer tools, or by manually creating a POST request with the necessary parameter names and values...
Coinbase: Sending payments via QR code does not require confirmation
Coinbase pushed out a feature whereby scanning a QR code inside the Coinbase Mobile app would complete payments under 0.1BTC without further confirmation. Upon reviewing this report and further consideration of the possible security implications of this feature, it was reverted. This issue has a...
Coinbase: Email leak in transcations in Android app
When a user received bitcoin from another Coinbase user, it was possible for the recipient to see the sender's email address in the transactions list in the Android app, despite the fact that users are told their emails would not be shown to other users. test...