Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports

12,262

CVE-linked

1,866

Programs

343

New This Week

Severity: All Critical High Medium Low

Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375

Improper Authentication on Alertmanager instance

IBM Improper Authentication - Generic (CWE-287)

Medium

2024-02-29

Arbitrary file read from Cloudflare Pages build environment

Cloudflare Public Bug Bounty

Medium

2024-02-23

Ability to getting Twitter Blue verified badge without purchase it

X / xAI Business Logic Errors (CWE-840)

Medium

2024-02-22

Employee-only Area Bypass

LinkedIn Improper Access Control - Generic (CWE-284)

Medium

2024-02-19

# Drivers can access the customers phone number, current location without getting their offer accepted!

inDrive Information Disclosure (CWE-200)

Medium

2024-02-19

Disclosure of users' ip address whenever they view my fright offer on image preview (Without interaction)

inDrive Information Disclosure (CWE-200)

Medium

2024-02-19

CSP bypass on PortSwigger.net using Google script resources

PortSwigger Web Security Cross-site Scripting (XSS) - Reflected (CWE-79)

Medium

2024-02-18

Can download files by zipping the folder

Nextcloud Improper Access Control - Generic (CWE-284)CVE-2024-22404

Medium

2024-02-17

Improper handling of wildcards in --allow-fs-read and --allow-fs-write

Node.js Improper Access Control - Generic (CWE-284)CVE-2024-21890

Medium

2024-02-15

Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding)

Node.js Use of a Broken or Risky Cryptographic Algorithm (CWE-327)CVE-2023-46809

Medium

2024-02-15

[demo.stripo.email] HTTP request Smuggling

Stripo Inc HTTP Request Smuggling (CWE-444)

Medium

2024-02-15

Non-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on Stripo

Stripo Inc Cleartext Transmission of Sensitive Information (CWE-319)

Medium

2024-02-15

IDOR in one subdomain of █████████ -> change information of pets without athorization!

Mars Insecure Direct Object Reference (IDOR) (CWE-639)

Medium

2024-02-14

CVE-2018-6389 exploitation - using scripts loader

Publitas CVE-2018-6389

Medium

2024-02-13

Subdomain takeover on one of the subdomain under mozgcp.net