Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
10
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Editable Wiki repo by anyone
RATELIMITED Violation of Secure Design Principles (CWE-657)
Low
2018-12-20
SPF Records (SMTP protection not used)
MyCrypto Violation of Secure Design Principles (CWE-657)
Medium
2018-12-17
Brave allows flash to follow 307 redirects to other origins with arbitrary content-types
Brave Software Violation of Secure Design Principles (CWE-657)
Medium
2018-12-12
SSLv3 Poodle Vulnerability
FormAssembly Violation of Secure Design Principles (CWE-657)
High
2018-11-24
App messaging can be hijacked by third-party websites
Shopify Violation of Secure Design Principles (CWE-657)
Medium
2018-11-07
Homograph attack on redirect URL
Chaturbate Violation of Secure Design Principles (CWE-657)
Low
2018-10-19
possibility to create account without username
Infogram Violation of Secure Design Principles (CWE-657)
Medium
2018-10-09
2nd issue>>> flood of email no rate limit on delete account confirmation email >>
Weblate Violation of Secure Design Principles (CWE-657)
Low
2018-09-28
flood of comment no rate limit on commnets >> by using different user agent
Weblate Violation of Secure Design Principles (CWE-657)
Low
2018-09-28
Homograph attack on redirect URL (https://chaturbate.com/external_link/?url)
Chaturbate Violation of Secure Design Principles (CWE-657)
Low
2018-09-20
Weak Password Policy on Signup at https://accounts.bistudio.com/auth
BOHEMIA INTERACTIVE a.s. Violation of Secure Design Principles (CWE-657)
Unknown
2018-09-18
Insecure Account Removal #2
Weblate Violation of Secure Design Principles (CWE-657)
Low
2018-08-28
Password reset token leakage via referer
Semrush Violation of Secure Design Principles (CWE-657)
Low
2018-08-14
Arbitrary local code execution via DLL hijacking from executable installer
Brave Software Violation of Secure Design Principles (CWE-657)
Medium
2018-07-09
CSRF at [Apply to this program] that lead to submit your request automatic with out any validations
HackerOne Violation of Secure Design Principles (CWE-657)
Low
2018-07-05
SUBDOMAIN TAKEOVER [http://dev.rbk.money/]
RBKmoney Violation of Secure Design Principles (CWE-657)
Medium
2018-07-02
Error Page Content Spoofing or Text Injection
Semrush Violation of Secure Design Principles (CWE-657)
Low
2018-06-29
Race Condition : Exploiting the loyalty claim https://xxx.vendhq.com/loyalty/claim/email/xxxxx url and gain x amount of loyalty bonus/cash
Vend VDP Violation of Secure Design Principles (CWE-657)
Medium
2018-06-07
Current CSP Policy chained with HTML Injection can lead to Data Exfiltration
Liberapay Violation of Secure Design Principles (CWE-657)
None
2018-06-04
The csrf token remains same after user logs in
Liberapay Violation of Secure Design Principles (CWE-657)
Unknown
2018-06-04
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895