漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告

12,219

关联 CVE

1,854

参与项目数

342

近 7 天新增

14

严重度: All Critical High Medium Low

类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375

项目筛选：nodejs✕

HTTP Request Smuggling Due To Improper Delimiting of Header Fields

Node.js HTTP Request Smuggling (CWE-444)CVE-2022-32214

Medium

2022-07-07

HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding

Node.js HTTP Request Smuggling (CWE-444)CVE-2022-32215

Medium

2022-07-07

Node.js Certificate Verification Bypass via String Injection

Node.js Improper Following of a Certificate's Chain of Trust (CWE-296)CVE-2021-44531 CVE-2021-44532 CVE-2021-44533

Medium

2022-02-10

HTTP Request Smuggling due to ignoring chunk extensions

Node.js HTTP Request Smuggling (CWE-444)CVE-2021-22960

Medium

2021-11-02

HTTP Request Smuggling due to accepting space before colon

Node.js HTTP Request Smuggling (CWE-444)CVE-2021-22959

Medium

2021-10-20

OOB read in libuv

Node.js Buffer Over-read (CWE-126)CVE-2021-22918

Medium

2021-07-05

Node Installer Local Privilege Escalation

Node.js Privilege Escalation (CAPEC-233)CVE-2021-22921 CVE-2021-29221 CVE-2021-22117

Medium

2021-07-01

`fs.realpath.native` on darwin may cause buffer overflow

Node.js Classic Buffer Overflow (CWE-120)CVE-2020-8252

Medium

2020-10-17

Fix for CVE-2018-12122 can be bypassed via keep-alive requests

Node.js Uncontrolled Resource Consumption (CWE-400)CVE-2018-12122

Medium

2020-02-13

Pull Request #12949 - Security Implications without CVE assignment

Node.js Command Injection - Generic (CWE-77)

Medium

2020-02-13

url.parse() hostname spoofing via javascript: URIs

Node.js Cross-site Scripting (XSS) - Generic (CWE-79)

Medium

2020-01-15

Http request splitting

Node.js HTTP Response Splitting (CWE-113)

Medium

2020-01-15

CRLF Injection in legacy url API (url.parse().hostname)

Node.js CRLF Injection (CWE-93)

Medium

2020-01-10

高频漏洞类型

最活跃项目

项目	报告数	最高赏金
U.S. Dept Of Defense	896	—
Internet Bug Bounty	817	—
HackerOne	609	—
Nextcloud	582	—
Shopify	464	—
curl	439	—
Node.js third-party modules	307	—
GitLab	258	—
X / xAI	250	$2,500
Uber	239	$9,895