Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,224
CVE-linked
1,856
Programs
342
New This Week
5
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
iframes considered harmful
Coinbase Violation of Secure Design Principles (CWE-657)
Unknown
2015-12-01
IDOR on remoing Share
Enter Violation of Secure Design Principles (CWE-657)
Unknown
2015-11-27
No rate limit which leads to "Users information Disclosure" including verfification documents etc.
Enter Violation of Secure Design Principles (CWE-657)
Unknown
2015-11-27
Potential for financial loss, negative Values for "Buy fee" and "Sell Fee"
Enter Violation of Secure Design Principles (CWE-657)
Unknown
2015-11-26
The csrf token remains same after user logs in
Enter Violation of Secure Design Principles (CWE-657)
Unknown
2015-11-26
owncloud.com: Content Sniffing not disabled
ownCloud Violation of Secure Design Principles (CWE-657)
Unknown
2015-11-12
SPF records not found
Coinbase Violation of Secure Design Principles (CWE-657)
Unknown
2015-10-14
owncloud.com: PermError SPF Permanent Error: Too many DNS lookups
ownCloud Violation of Secure Design Principles (CWE-657)
Unknown
2015-10-11
owncloud.com: Outdated plugins contains public exploits
ownCloud Violation of Secure Design Principles (CWE-657)
Unknown
2015-10-11
Config
ownCloud Violation of Secure Design Principles (CWE-657)
Unknown
2015-10-11
Passwords Returned in Later Responses.
Shopify Violation of Secure Design Principles (CWE-657)
Unknown
2015-09-30
[s3.owncloud.com] Web Server HTTP Trace/Track Method Support
ownCloud Violation of Secure Design Principles (CWE-657)
Unknown
2015-09-28
Extremely high Course rating values could be set in order to make really high Average rating of the course. Negative values could be set to.
Udemy Violation of Secure Design Principles (CWE-657)
Unknown
2015-09-25
Weak HSTS age in support hackerone site
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2015-09-18
gallery_plus: Content Spoofing
ownCloud Violation of Secure Design Principles (CWE-657)
Unknown
2015-09-11
Password appears in user name field
ownCloud Violation of Secure Design Principles (CWE-657)
Unknown
2015-09-11
Content spoofing through Referel header
Flox Violation of Secure Design Principles (CWE-657)
Unknown
2015-08-29
SSRF via 'Insert Image' feature of Products/Collections/Frontpage
Shopify Violation of Secure Design Principles (CWE-657)
Unknown
2015-08-24
Gain reputation by creating a duplicate of an existing report
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2015-08-14
Improper Verification of email address while saving Account Settings
X / xAI Violation of Secure Design Principles (CWE-657)
Unknown
2015-08-13
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud583—
Shopify464—
curl442—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—