Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1310 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,262
CVE-linked
1,866
Programs
343
New This Week
0
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Browser Self XSS Protection not implemented
Weblate Information Disclosure (CWE-200)
Unknown
2018-09-26
Shared file link - password protection bypass under certain conditions
Nextcloud Information Disclosure (CWE-200)CVE-2018-16467CVE-2019-5449
Medium
2018-09-25
Password protected rooms total number of viewers disclosure to unauthorized members
Chaturbate Information Disclosure (CWE-200)
Low
2018-09-24
Web cache deception attack - expose token information
Chaturbate Information Disclosure (CWE-200)
Medium
2018-09-20
Leaking sensitive information on Github lead full access to all Grab Slack channels
Grab Information Disclosure (CWE-200)
Critical
2018-09-11
Phishing user to download malicious app could lead to leakage of User Access Token, Email, Name and Profile photo via exported RemoteService
Eternal Information Disclosure (CWE-200)
Low
2018-09-11
Open port leads to information disclosure
Weblate Information Disclosure (CWE-200)
Low
2018-09-10
[informatica.com]- Information Disclosure
Informatica Information Disclosure (CWE-200)
Medium
2018-09-05
Cross-site information assertion leak via Content Security Policy
Internet Bug Bounty Information Disclosure (CWE-200)
Unknown
2018-09-05
Stealing Private Information in VK Android App through PlayerProxy Port Remotely
VK.com Information Disclosure (CWE-200)
Critical
2018-09-02
Доступ к администраторским faq
VK.com Information Disclosure (CWE-200)
High
2018-09-02
Information Leak - GitHub - Endpoint Configuration Details
Uber Information Disclosure (CWE-200)
Medium
2018-08-27
Information / sensitive data disclosure on some endpoints
WordPress Information Disclosure (CWE-200)
Medium
2018-08-22
Internal usage of AdBlockPlus may expose PoC URLs to unknown third-parties
HackerOne Information Disclosure (CWE-200)
Low
2018-08-17
Information Leak - Github - JMS Information
Starbucks Information Disclosure (CWE-200)
High
2018-08-16
Private program policy page still accessible after user left the program
HackerOne Information Disclosure (CWE-200)
Medium
2018-08-12
GitHub API Key for BrewTestBot is publicly exposed
Homebrew Information Disclosure (CWE-200)
Critical
2018-08-11
Basic auth details is still work on report ( 351555 )
Reverb.com Information Disclosure (CWE-200)
Low
2018-08-09
TeamProfile exposes partially sensitive information through GraphQL
HackerOne Information Disclosure (CWE-200)
Low
2018-08-08
Просмотр приложений любого пользователя / группы
VK.com Information Disclosure (CWE-200)
Medium
2018-07-28
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify465—
curl464—
Node.js third-party modules307—
GitLab258—
X / xAI250 $7,000
Uber239—