Meta / Facebook | writeups.xyz

Title	Vulnerabilities	Programs	Authors
Missing permission check for Facebook gaming community invites	Information Disclosure Broken Authorization	Meta / Facebook	Philippe Harewood (@Phwd)
Facebook Vulnerability: Expose Group Member — $3000	IDOR	Meta / Facebook	Muhammad Sholikhin (@MuhammadLikhin)
Not valid bug that leads to us a multiple Valid Report in Facebook	Information Disclosure	Meta / Facebook	Kent Jarold Abulag (@Wkemenhehehegsg)
How I Found Multiple Bugs On FaceBook In 1 Month And a Part For My Methodology & Tools	SSTI SQL Injection Authentication Bypass Privilege Escalation Reflected XSS	Meta / Facebook	Orwa Atyat (@GodfatherOrwa)
Facebook Vulnerability: $1500 for Removing Document Cover	Broken Authorization IDOR	Meta / Facebook	Muhammad Sholikhin (@MuhammadLikhin)
Facebook Email/phone disclosure using Binary search	Password Reset Information Disclosure Bruteforce	Meta / Facebook	Rikesh Baniya (@Rikeshbaniya)
View Other User Private Livestream Data	IDOR	Meta / Facebook	Geva (@Geva_7)
Bulletin.com email address leak	Information Disclosure GraphQL	Meta / Facebook	Philippe Harewood (@Phwd)
Disclose unconfirmed email/phone of a Facebook user	Information Disclosure	Meta / Facebook	Youssef Sammouda (@Samm0uda)
Oversightboard.com site-wide CSRF due to missing checking	CSRF	Meta / Facebook	Youssef Sammouda (@Samm0uda)
User’s location diclosure in the “Nearby Friends” feature. $15,500 Bounty	Information Disclosure	Meta / Facebook	Yavor Rusev / Явор Русев
How I could have accessed all your private videos/photos saved inside your device without even unlocking it?	Broken Authorization Logic Flaw	Meta / Facebook	Samip Aryal (@Samiparyal_)
Disclose leads form details of any Facebook Business Account or Facebook Page (Bug Bounty)	IDOR GraphQL	Meta / Facebook	Amine Aboud (@Amineaboud)
CSRF from which we can create a support ticket in Victim’s Account (500$)	CSRF	Meta / Facebook	Rohit Kumar (@Rohitcoder)
Victim’s Anti CSRF Token could be exposed to Third-party Applications installed on user’s Device (500$)	Information Disclosure	Meta / Facebook	Rohit Kumar (@Rohitcoder)
Oculus SSO “Account Linking” bug leads to account takeover on third party websites and inside VR Games/Apps	SSO Broken Authentication Account Takeover	Meta / Facebook	Youssef Sammouda (@Samm0uda)
Third-Party Apps were still getting your private Facebook data even after their access expiry.	Logic Flaw	Meta / Facebook	Samip Aryal (@Samiparyal_)
Writeups: Facebook Whitehat program(2021): Instagram Live setting bug	Logic Flaw	Meta / Facebook	Takashi Suzuki
One-click reflected XSS in www.instagram.com due to unfiltered URI schemes leads to account takeover	Reflected XSS Account Takeover	Meta / Facebook	Youssef Sammouda (@Samm0uda)
Simple logical Bug turned into a bounty	Logic Flaw	Meta / Facebook	Sndp Giri
Workplace by Facebook \| Unauthorized access to companies environment — $27,5k	Broken Authorization Logic Flaw IDOR	Meta / Facebook	Marcos Ferreira (@Mvinni_)
Identify a Facebook user by his phone number despite privacy settings set	Privacy Issue Information Disclosure	Meta / Facebook	Youssef Sammouda (@Samm0uda)
Account takeover of Instagram accounts due to unrestricted permissions of third-party application’s generated tokens	OAuth Broken Authorization Account Takeover	Meta / Facebook	Youssef Sammouda (@Samm0uda)
Facebook account takeover due to unsafe redirects after the OAuth flow	OAuth Open Redirect Account Takeover	Meta / Facebook	Youssef Sammouda (@Samm0uda)
Page Owners Can’t remove or change page roles of deactivated users (or if Attacker blocks the page owner) in Facebook Lite, Facebook for Android and touch.facebook.com	Logic Flaw	Meta / Facebook	Baibhav Anand (@SpongeBhav)

Page 5 of 22