Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,231
CVE-linked
1,858
Programs
342
New This Week
12
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 657 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Internet-based attacker can run Flash apps in local sandboxes by using special URL schemes (PSIRT-3299, CVE-2015-3079)
Internet Bug Bounty Information Disclosure (CWE-200)CVE-2015-3044CVE-2015-3079
Unknown
2019-10-18
Flash Player information disclosure (etc.) CVE-2015-3044, PSIRT-3298
Internet Bug Bounty Information Disclosure (CWE-200)CVE-2015-3044
Unknown
2019-10-18
Exposing debug.log file leads to server full path disclosure
Nextcloud Information Disclosure (CWE-200)
Low
2019-10-17
[Brave browser] WebTorrent has DNS rebinding vulnerability
Brave Software Information Disclosure (CWE-200)
Low
2019-10-16
external entity expansion in Apache POI
Internet Bug Bounty Information Disclosure (CWE-200)
Unknown
2019-10-14
Multiple issues in Libxml2 (2.9.2 - 2.9.5)
Internet Bug Bounty Information Disclosure (CWE-200)CVE-2016-1835CVE-2016-1836CVE-2016-1837CVE-2016-7115CVE-2015-7115CVE-2016-7116CVE-2015-7116CVE-2016-1762CVE-2016-4447CVE-2017-16931CVE-2017-16932
Medium
2019-10-14
Information disclosure in mmap module - python 2.7.12
Internet Bug Bounty Information Disclosure (CWE-200)
Low
2019-10-13
Disclosure of Email title report in quick award paypout email (no content mode)
HackerOne Information Disclosure (CWE-200)
Low
2019-10-11
Information Disclosure (can access all ███s) within ███████ view █████████ Portal
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2019-10-08
Publicly accessible Order confirmations leaking User Emails on ███
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2019-10-08
SSRF on █████████ Allowing internal server data access
U.S. Dept Of Defense Information Disclosure (CWE-200)CVE-2017-9506
Critical
2019-10-08
PII leakage due to caching of Order/Contract ID's on █████████
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2019-10-08
Know whether private project name exists or not within a group using link comments
GitLab Information Disclosure (CWE-200)
Low
2019-10-07
Full Path disclosure on 500 error
Liberapay Information Disclosure (CWE-200)
Low
2019-10-05
full path disclosure on www.rockstargames.com via apache filename brute forcing
Rockstar Games Information Disclosure (CWE-200)
Low
2019-10-04
██████ Authenticated User Data Disclosure
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2019-10-04
Reports Modal in app.mopub.com Disclose by any user
X / xAI Information Disclosure (CWE-200)
Medium
2019-10-02
[mena.starbucks.com] Laravel App Log & Configuration Disclosure.
Starbucks Information Disclosure (CWE-200)
High
2019-09-30
Starbucks China Android app cloud storage service leaks a credential.
Starbucks Information Disclosure (CWE-200)
High
2019-09-30
Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve status
HackerOne Information Disclosure (CWE-200)
Low
2019-09-29
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud583—
Shopify464—
curl447—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—