Soumettre une vulnérabilité de sécurité

Vous êtes sur le point de soumettre un rapport à la Banque Toronto-Dominion. Fournissez autant d'informations que possible sur le problème potentiel que vous avez découvert. Plus vous fournirez d'informations, plus vite la Banque Toronto-Dominion sera en mesure de valider le problème. Si vous ne l'avez pas encore fait, pensez à consulter notre Page de sécurité.

▶▼ Points forts

Faille

Sélectionnez le type de problème potentiel que vous avez découvert. Vous ne parvenez pas à en choisir un seul? Sélectionnez la solution la plus adaptée ou soumettez un rapport distinct pour chaque faiblesse.

Soumettre un rapport sans faille

Soumettre avec faille

Allocation of Resources Without Limits or Throttling

CWE-770

Array Index Underflow

CWE-129

ASI01: Agent Goal Hijack

ASI02: Tool Misuse and Exploitation

ASI03: Identity and Privilege Abuse

ASI04: Agentic Supply Chain Vulnerabilities

ASI05: Unexpected Code Execution (RCE)

ASI06: Memory & Context Poisoning

ASI07: Insecure Inter-Agent Communication

ASI08: Cascading Failures

ASI09: Human-Agent Trust Exploitation

ASI10: Rogue Agents

Authentication Bypass Using an Alternate Path or Channel

CWE-288

Buffer Over-read

CWE-126

Buffer Underflow

CWE-124

Buffer Under-read

CWE-127

Business Logic Errors

CWE-840

Classic Buffer Overflow

CWE-120

Cleartext Storage of Sensitive Information

CWE-312

Cleartext Transmission of Sensitive Information

CWE-319

Client-Side Enforcement of Server-Side Security

CWE-602

Code Injection

CWE-94

Command Injection - Generic

CWE-77

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-362

CRLF Injection

CWE-93

Cross-Site Request Forgery (CSRF)

CWE-352

Cross-site Scripting (XSS) - DOM

CWE-79

Cross-site Scripting (XSS) - Generic

CWE-79

Cross-site Scripting (XSS) - Reflected

CWE-79

Cross-site Scripting (XSS) - Stored

CWE-79

Cryptographic Issues - Generic

CWE-310

Deserialization of Untrusted Data

CWE-502

Double Free

CWE-415

Download of Code Without Integrity Check

CWE-494

Embedded Malicious Code

CWE-506

Execution with Unnecessary Privileges

CWE-250

Exposed Dangerous Method or Function

CWE-749

External Control of Critical State Data

CWE-642

Externally Controlled Reference to a Resource in Another Sphere

CWE-610

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

CWE-75

File and Directory Information Exposure

CWE-538

Forced Browsing

CWE-425

Heap Overflow

CWE-122

HTTP Request Smuggling

CWE-444

HTTP Response Splitting

CWE-113

Improper Access Control - Generic

CWE-284

Improper Authentication - Generic

CWE-287

Improper Authorization

CWE-285

Improper Certificate Validation

CWE-295

Improper Check or Handling of Exceptional Conditions

CWE-703

Improper Export of Android Application Components

CWE-926

Improper Following of a Certificate's Chain of Trust

CWE-296

Improper Handling of Highly Compressed Data (Data Amplification)

CWE-409

Improper Handling of Insufficient Permissions or Privileges

CWE-280

Improper Handling of URL Encoding (Hex Encoding)

CWE-177

Improper Input Validation

CWE-20

Improper Neutralization of Escape, Meta, or Control Sequences

CWE-150

Improper Neutralization of HTTP Headers for Scripting Syntax

CWE-644

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE-80

Improper Null Termination

CWE-170

Improper Privilege Management

CWE-269

Improper Restriction of Authentication Attempts

CWE-307

Inadequate Encryption Strength

CWE-326

Inclusion of Functionality from Untrusted Control Sphere

CWE-829

Incomplete Blacklist

CWE-184

Incorrect Authorization

CWE-863

Incorrect Calculation of Buffer Size

CWE-131

Incorrect Comparison

CWE-697

Incorrect Permission Assignment for Critical Resource

CWE-732

Information Disclosure

CWE-200

Information Exposure Through an Error Message

CWE-209

Information Exposure Through Debug Information

CWE-215

Information Exposure Through Directory Listing

CWE-548

Information Exposure Through Discrepancy

CWE-203

Information Exposure Through Sent Data

CWE-201

Information Exposure Through Timing Discrepancy

CWE-208

Insecure Direct Object Reference (IDOR)

CWE-639

Insecure Storage of Sensitive Information

CWE-922

Insecure Temporary File

CWE-377

Insufficiently Protected Credentials

CWE-522

Insufficient Session Expiration

CWE-613

Integer Overflow

CWE-190

Integer Underflow

CWE-191

Key Exchange without Entity Authentication

CWE-322

LDAP Injection

CWE-90

Leftover Debug Code (Backdoor)

CWE-489

LLM02:2025 Sensitive Information Disclosure

LLM03:2025 Supply Chain

LLM04:2025 Data and Model Poisoning

LLM05:2025 Improper Output Handling

LLM06:2025 Excessive Agency

LLM07:2025 System Prompt Leakage

LLM08:2025 Vector and Embedding Weaknesses

LLM09:2025 Misinformation

LLM10:2025 Unbounded Consumption

Malware

CAPEC-549

Man-in-the-Middle

CWE-300

Memory Corruption - Generic

CWE-119

Misconfiguration

CWE-16

Missing Authentication for Critical Function

CWE-306

Missing Authorization

CWE-862

Missing Encryption of Sensitive Data

CWE-311

Missing Required Cryptographic Step

CWE-325

Modification of Assumed-Immutable Data (MAID)

CWE-471

NULL Pointer Dereference

CWE-476

Off-by-one Error

CWE-193

Open Redirect

CWE-601

OS Command Injection

CWE-78

Out-of-bounds Read

CWE-125

Password in Configuration File

CWE-260

Path Traversal

CWE-22

Path Traversal: '.../...//'

CWE-35

Phishing

CAPEC-98

Plaintext Storage of a Password

CWE-256

Privacy Violation

CWE-359

Privilege Escalation

CAPEC-233

Relative Path Traversal

CWE-23

Reliance on Cookies without Validation and Integrity Checking in a Security Decision

CWE-784

Reliance on Reverse DNS Resolution for a Security-Critical Action

CWE-350

Reliance on Untrusted Inputs in a Security Decision

CWE-807

Remote File Inclusion

CWE-98

Replicating Malicious Code (Virus or Worm)

CWE-509

Resource Injection

CWE-99

Reusing a Nonce, Key Pair in Encryption

CWE-323

Reversible One-Way Hash

CWE-328

Security Through Obscurity

CWE-656

Server-Side Request Forgery (SSRF)

CWE-918

Session Fixation

CWE-384

SQL Injection

CWE-89

Stack Overflow

CWE-121

Storing Passwords in a Recoverable Format

CWE-257

Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-367

Trust of System Event Data

CWE-360

Type Confusion

CWE-843

UI Redressing (Clickjacking)

CAPEC-103

Unchecked Error Condition

CWE-391

Uncontrolled Recursion

CWE-674

Uncontrolled Resource Consumption

CWE-400

Unprotected Transport of Credentials

CWE-523

Unrestricted Upload of File with Dangerous Type

CWE-434

Untrusted Search Path

CWE-426

Unverified Password Change

CWE-620

Use After Free

CWE-416

Use of a Broken or Risky Cryptographic Algorithm

CWE-327

Use of a Key Past its Expiration Date

CWE-324

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-338

Use of Externally-Controlled Format String

CWE-134

Use of Hard-coded Credentials

CWE-798

Use of Hard-coded Cryptographic Key

CWE-321

Use of Hard-coded Password

CWE-259

Use of Inherently Dangerous Function

CWE-242

Use of Insufficiently Random Values

CWE-330

User Interface (UI) Misrepresentation of Critical Information

CWE-451

Violation of Secure Design Principles

CWE-657

Weak Cryptography for Passwords

CWE-261

Weak Password Recovery Mechanism for Forgotten Password

CWE-640

Wrap-around Error

CWE-128

Write-what-where Condition

CWE-123

XML Entity Expansion

CWE-776

XML External Entities (XXE)

CWE-611

XML Injection

CWE-91

XSS Using MIME Type Mismatch

CAPEC-209

Preuve de concept

La preuve de concept est la partie la plus importante de votre rapport. Des étapes claires et reproductibles nous aideront à valider ce problème le plus rapidement possible.

Titre*

Un titre clair et concis inclut le type de vulnérabilité et l'actif impacté.

Description*

Quelle est la vulnérabilité? Comment la reproduire, étape par étape?

Impact*

Quel impact un attaquant peut-il avoir sur la sécurité?

Pièces jointes

Vous pouvez joindre tout fichier pertinent à votre signalement, comme des captures d'écran, des journaux ou tout autre fichier permettant de reproduire le problème.

E-mail

Saisissez votre adresse e-mail pour recevoir des mises à jour sur l'état de votre soumission. Si vous souhaitez rester anonyme, vous pouvez laisser ce champ vide.

En cliquant sur «Soumettre rapport», vous acceptez les Conditions générales de HackerOne et reconnaissez avoir lu le Code de conduite, la Politique de confidentialité et les Directives de divulgation de HackerOne.

Soumettre une vulnérabilité de sécurité

▶▼ Points forts

Actif

Faille

Sévérité

Preuve de concept