目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1020 元

100%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,244
关联 CVE
1,864
参与项目数
343
近 7 天新增
23
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 657 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Public and secret api key leaked via omise github repo(owned by omise)
Omise Information Disclosure (CWE-200)
None
2019-03-25
credentials leakage in public lead to view dev websites
Eternal Information Disclosure (CWE-200)
Low
2019-03-18
Stealing Facebook OAuth Code Through Screenshot viewer
Rockstar Games Information Disclosure (CWE-200)
Medium
2019-03-05
Email enumeration of users
Homebrew Information Disclosure (CWE-200)
Medium
2019-03-05
Snippet JS template allows attacker to read a user's private snippets
GitLab Information Disclosure (CWE-200)
Low
2019-03-03
Users able to set video url for unpublished words and able to see the name of unpublished words
Urban Dictionary Information Disclosure (CWE-200)
Low
2019-03-02
AWS bucket leading to iOS test build code and configuration exposure
Slack Information Disclosure (CWE-200)
Critical
2019-02-23
report id is exposed for undisclosed reports in Hacktivity
HackerOne Information Disclosure (CWE-200)
Low
2019-02-16
XSSI: Quick Navigation Interface - leak of private page/post titles
Ian Dunn Information Disclosure (CWE-200)
Medium
2019-02-15
Guests Will Disclose the Private Project Full Activity Via Project Activity Feeds
GitLab Information Disclosure (CWE-200)
None
2019-02-08
Client secret, server tokens for developer applications returned by internal API
Uber Information Disclosure (CWE-200)
Unknown
2019-02-08
Confidential data of users and limited metadata of programs and reports accessible via GraphQL
HackerOne Information Disclosure (CWE-200)
Critical
2019-02-03
Disclosure of h1 challenges name through the calendar
HackerOne Information Disclosure (CWE-200)
Low
2019-01-30
Line feed injection in get request leads AWS S3 Bucket information disclosure
RATELIMITED Information Disclosure (CWE-200)
Medium
2019-01-14
Source Code Disclosure
Urban Dictionary Information Disclosure (CWE-200)
Unknown
2019-01-08
Disclosure of information about the system, configuration files.
Smule Information Disclosure (CWE-200)
Low
2019-01-03
Exposure of tinyMCE js source code with plugin version disclosure which can leads to exploit further attacks.
RATELIMITED Information Disclosure (CWE-200)
Low
2018-12-29
ActiveStorage service's signed URLs can be hijacked via AppCache+Cookie stuffing trick when using GCS or DiskService
Ruby on Rails Information Disclosure (CWE-200)CVE-2018-16477
High
2018-12-27
Information disclosure
HackerOne Information Disclosure (CWE-200)
Low
2018-12-27
Timing attack towards endpoints on the web without CSRF
HackerOne Information Disclosure (CWE-200)
Low
2018-12-27
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud583—
Shopify464—
curl457—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—